{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/qaic/qaic_data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9baafc2fea096279e75480f93fd5942e8336b510",
              "status": "affected",
              "version": "ff13be8303336ead5621712f2c55012d738878b5",
              "versionType": "git"
            },
            {
              "lessThan": "8dd6edbe26770df147136c3f2ac976c873b82650",
              "status": "affected",
              "version": "ff13be8303336ead5621712f2c55012d738878b5",
              "versionType": "git"
            },
            {
              "lessThan": "97a8e89cdef36207a8776edc03d6931763a06ad0",
              "status": "affected",
              "version": "ff13be8303336ead5621712f2c55012d738878b5",
              "versionType": "git"
            },
            {
              "lessThan": "8c795012d0e06b7740e40319b86ff8d2a435098d",
              "status": "affected",
              "version": "ff13be8303336ead5621712f2c55012d738878b5",
              "versionType": "git"
            },
            {
              "lessThan": "aa16b2bc0f02709919e2435f531406531e5bcc69",
              "status": "affected",
              "version": "ff13be8303336ead5621712f2c55012d738878b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/accel/qaic/qaic_data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Add overflow check to remap_pfn_range during mmap\n\nThe call to remap_pfn_range in qaic_gem_object_mmap is susceptible to\n(re)mapping beyond the VMA if the BO is too large. This can cause use\nafter free issues when munmap() unmaps only the VMA region and not the\nadditional mappings. To prevent this, check the remaining size of the\nVMA before remapping and truncate the remapped length if sg-\u003elength is\ntoo large.\n\n[jhugo: fix braces from checkpatch --strict]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access via the QAIC accel device node (/dev/accel/accel*) through DRM ioctls and mmap syscalls; there is no network-facing attack surface.\nAC:L - An attacker fully controls BO allocation size, partial mmap length, and munmap timing, deterministically mapping PFNs beyond the VMA without races or external conditions.\nPR:L - No DRM master or root is required; any unprivileged local user with access to the accel device node (common on shared cloud AI inference hosts) can create a BO, partial-mmap it, and trigger the bug.\nUI:N - Exploitation requires only attacker-initiated ioctl and mmap operations on an open accel file descriptor, with no victim interaction.\nS:U - The UAF corrupts kernel page-table mappings within the same kernel security domain; it does not cross VM, container, or IOMMU boundaries.\nC:H - The commit explicitly identifies a use-after-free of page structures left mapped past the VMA; UAF of kernel mappings enables arbitrary kernel memory read primitives.\nI:H - UAF on kernel page structures can be leveraged for arbitrary kernel memory writes and local privilege escalation through heap grooming and control of freed pages.\nA:H - Accessing stale PFN mappings after BO teardown causes kernel oops/panic; UAF reliably threatens system availability even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:42.519Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9baafc2fea096279e75480f93fd5942e8336b510"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dd6edbe26770df147136c3f2ac976c873b82650"
        },
        {
          "url": "https://git.kernel.org/stable/c/97a8e89cdef36207a8776edc03d6931763a06ad0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c795012d0e06b7740e40319b86ff8d2a435098d"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa16b2bc0f02709919e2435f531406531e5bcc69"
        }
      ],
      "title": "accel/qaic: Add overflow check to remap_pfn_range during mmap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64051",
    "datePublished": "2026-07-19T15:39:34.608Z",
    "dateReserved": "2026-07-19T07:54:57.029Z",
    "dateUpdated": "2026-08-05T12:38:42.519Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_vrr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2f9aa8d42b7fc17621894456433ac07689fb4a21",
              "status": "affected",
              "version": "117cd09ba52857a60dc5d7f61941046625d8ff5a",
              "versionType": "git"
            },
            {
              "lessThan": "5225122b9cad6b0c61e767fb2adea8c07da925be",
              "status": "affected",
              "version": "117cd09ba52857a60dc5d7f61941046625d8ff5a",
              "versionType": "git"
            },
            {
              "lessThan": "6598ac1721c3a5543efdbcab579a8561268d7ce1",
              "status": "affected",
              "version": "117cd09ba52857a60dc5d7f61941046625d8ff5a",
              "versionType": "git"
            },
            {
              "lessThan": "f16218689b41efcbc491207cd7716477b1223879",
              "status": "affected",
              "version": "117cd09ba52857a60dc5d7f61941046625d8ff5a",
              "versionType": "git"
            },
            {
              "lessThan": "df1582c0a101e2e2f133dd331d2a3258bb6a7518",
              "status": "affected",
              "version": "117cd09ba52857a60dc5d7f61941046625d8ff5a",
              "versionType": "git"
            },
            {
              "lessThan": "c726c8bbee5115dad37fa7867136ebaa50690331",
              "status": "affected",
              "version": "117cd09ba52857a60dc5d7f61941046625d8ff5a",
              "versionType": "git"
            },
            {
              "lessThan": "f8a9262c7a6fc2de9802e14b0228114f0333869e",
              "status": "affected",
              "version": "117cd09ba52857a60dc5d7f61941046625d8ff5a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_vrr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/vrr: require valid min/max vfreq for VRR\n\nEnsure the EDID provided min/max vfreq are valid. Most scenarios are\nalready covered (by coincidence) through the checks in\nintel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit\nabout it. At worst, a zero min_vfreq could lead to a division by zero in\nintel_vrr_compute_vmax().\n\nDiscovered using AI-assisted static analysis confirmed by Intel Product\nSecurity.\n\n(cherry picked from commit 1765cf59f517b02f3b0591fe5120930d08bddeb6)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:12.167Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2f9aa8d42b7fc17621894456433ac07689fb4a21"
        },
        {
          "url": "https://git.kernel.org/stable/c/5225122b9cad6b0c61e767fb2adea8c07da925be"
        },
        {
          "url": "https://git.kernel.org/stable/c/6598ac1721c3a5543efdbcab579a8561268d7ce1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f16218689b41efcbc491207cd7716477b1223879"
        },
        {
          "url": "https://git.kernel.org/stable/c/df1582c0a101e2e2f133dd331d2a3258bb6a7518"
        },
        {
          "url": "https://git.kernel.org/stable/c/c726c8bbee5115dad37fa7867136ebaa50690331"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8a9262c7a6fc2de9802e14b0228114f0333869e"
        }
      ],
      "title": "drm/i915/vrr: require valid min/max vfreq for VRR",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68254",
    "datePublished": "2026-08-10T12:01:20.400Z",
    "dateReserved": "2026-07-30T09:28:09.377Z",
    "dateUpdated": "2026-08-23T12:46:12.167Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/iwpm_msg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf",
              "status": "affected",
              "version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
              "versionType": "git"
            },
            {
              "lessThan": "87111356d58d86edb221ba144d261ed83a5b8bbe",
              "status": "affected",
              "version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
              "versionType": "git"
            },
            {
              "lessThan": "abda65bdd13084c771842adaac1f652d0660dd82",
              "status": "affected",
              "version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
              "versionType": "git"
            },
            {
              "lessThan": "137b5918931d4d05aa8ea8d3adf67f7224eef63c",
              "status": "affected",
              "version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
              "versionType": "git"
            },
            {
              "lessThan": "5877c043398d5fa0e93919a3d837e5cd7a98a961",
              "status": "affected",
              "version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
              "versionType": "git"
            },
            {
              "lessThan": "f2c7b39dde2e61df8157066969cc2a408cd3dcd9",
              "status": "affected",
              "version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
              "versionType": "git"
            },
            {
              "lessThan": "c26a0052cceed4c4d380ee5808b699f937fb58d8",
              "status": "affected",
              "version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
              "versionType": "git"
            },
            {
              "lessThan": "6ed3d14fc45d3da6025e7fe4a6a09066856698e2",
              "status": "affected",
              "version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/iwpm_msg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Prefer NLA_NUL_STRING\n\nThese attributes are evaluated as c-string (passed to strcmp), but\nNLA_STRING doesn\u0027t check for the presence of a \\0 terminator.\n\nEither this needs to switch to nla_strcmp() and needs to adjust printf fmt\nspecifier to not use plain %s, or this needs to use NLA_NUL_STRING.\n\nAs the code has been this way for long time, it seems to me that userspace\ndoes include the terminating nul, even tough its not enforced so far, and\nthus NLA_NUL_STRING use is the simpler solution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached when userspace sends crafted NETLINK_RDMA (protocol 20) messages to the iWARP Port Mapper netlink handlers in `iwpm_register_pid_cb()` and `iwpm_mapping_info_cb()`, not from remote network packets.\nAC:L - An attacker fully controls the netlink attribute payload and can send a maximal-length string without a NUL terminator to reliably trigger unbounded `strcmp()` reads; no race or victim-dependent state is required beyond reaching the handler.\nPR:N - IWPM netlink ops lack `RDMA_NL_ADMIN_PERM`, and `netlink_sendmsg()` only enforces `CAP_NET_ADMIN` when `dst_pid` or `dst_group` is non-zero, so an unprivileged local process can send messages to the kernel RDMA netlink socket without capabilities or user-namespace tricks.\nUI:N - Exploitation requires only a local process sending a crafted netlink message; no victim interaction such as mounting a filesystem or opening a device is needed.\nS:U - Impact is confined to kernel RDMA/iWARP port-mapper state (e.g., `iwpm_user_pid`, mapping tables) within the same kernel security authority and does not cross VM, container, or IOMMU boundaries.\nC:H - `NLA_STRING` does not enforce a NUL terminator, yet `strcmp()` reads until `\\0`, causing an out-of-bounds kernel read past the attribute boundary; error paths also pass the pointer to `%s` in `pr_info()`, enabling further kernel memory disclosure.\nI:H - By sending exactly 19 bytes of `iWarpPortMapperUser` without a terminator, an attacker can make `strcmp()` read a NUL from NLA padding and pass validation, hijacking `iwpm_user_pid` and redirecting subsequent iWARP port-mapping operations to attacker-controlled userspace.\nA:H - Unbounded `strcmp()` on a non-NUL-terminated netlink attribute can read beyond the skb buffer and trigger a kernel page fault/oops, and successful port-mapper impersonation can disrupt iWARP connectivity on affected systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:38.134Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/87111356d58d86edb221ba144d261ed83a5b8bbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/abda65bdd13084c771842adaac1f652d0660dd82"
        },
        {
          "url": "https://git.kernel.org/stable/c/137b5918931d4d05aa8ea8d3adf67f7224eef63c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5877c043398d5fa0e93919a3d837e5cd7a98a961"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2c7b39dde2e61df8157066969cc2a408cd3dcd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c26a0052cceed4c4d380ee5808b699f937fb58d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ed3d14fc45d3da6025e7fe4a6a09066856698e2"
        }
      ],
      "title": "RDMA/core: Prefer NLA_NUL_STRING",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63860",
    "datePublished": "2026-07-19T14:04:48.153Z",
    "dateReserved": "2026-07-19T07:54:57.017Z",
    "dateUpdated": "2026-08-05T12:36:38.134Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/policy_unpack.h",
            "security/apparmor/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "643221da57dbb1a8fd800610331cf1ec27969f71",
              "status": "affected",
              "version": "3b8e77c7abab40e6de9ad9de730d77984a498840",
              "versionType": "git"
            },
            {
              "lessThan": "b17f0c59cc1525765625cf07d0391b7f9c1ed7e5",
              "status": "affected",
              "version": "d9d8560b9b7932f8cffc4c068c14289220900f79",
              "versionType": "git"
            },
            {
              "lessThan": "a7a2890028f16e5b0af0bb005d80fcb32559cca3",
              "status": "affected",
              "version": "6b6ba87579c7e7c669e0bec91823e7fb693bc5df",
              "versionType": "git"
            },
            {
              "lessThan": "15fd83a1e42ede15070968806bb6c8b1a5170688",
              "status": "affected",
              "version": "6ef1f2926c41ab96952d9696d55a052f1b3a9418",
              "versionType": "git"
            },
            {
              "lessThan": "ce261a20b41db522e320a41bbf1292bf85af66df",
              "status": "affected",
              "version": "f9761add6d100962a23996cb68f3d6abdd4d1815",
              "versionType": "git"
            },
            {
              "lessThan": "c3ca2631073b2cef06824fd2bfc452ff7a1023de",
              "status": "affected",
              "version": "af782cc8871e3683ddd5a3cd2f7df526599863a9",
              "versionType": "git"
            },
            {
              "lessThan": "5e34fa9f6f7cd688ae153fff13139a5cf2d42339",
              "status": "affected",
              "version": "a0b7091c4de45a7325c8780e6934a894f92ac86b",
              "versionType": "git"
            },
            {
              "lessThan": "6f060496d03e4dc560a40f73770bd08335cb7a27",
              "status": "affected",
              "version": "a0b7091c4de45a7325c8780e6934a894f92ac86b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "763e838adc3c7ec5a7df2990ce84cad951e42721",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.177",
              "status": "affected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.144",
              "status": "affected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.95",
              "status": "affected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.38",
              "status": "affected",
              "version": "6.18.18",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/include/policy_unpack.h",
            "security/apparmor/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.253",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "6.1.169",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "6.6.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.12.77",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.18.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix use-after-free in rawdata dedup loop\n\naa_replace_profiles() walks ns-\u003erawdata_list to dedup the incoming\npolicy blob against entries already attached to existing profiles.\nPer the kernel-doc on struct aa_loaddata, list membership does not\nhold a reference: profiles hold pcount, and when the last pcount\ndrops, do_ploaddata_rmfs() is queued on a workqueue that takes\nns-\u003elock and removes the entry. Between dropping the last pcount\nand the workqueue running, an entry remains on the list with\npcount == 0.\n\naa_get_profile_loaddata() is an unconditional kref_get() on\npcount, so when the dedup loop hits such an entry, refcount\nhardening reports\n\n  refcount_t: addition on 0; use-after-free.\n\ninside aa_replace_profiles(), and the poisoned counter then\ntrips \"saturated\" and \"underflow\" warnings on the subsequent\nuses of the same loaddata.\n\nBefore commit a0b7091c4de4 (\"apparmor: fix race on rawdata\ndereference\") the dedup path used a get_unless_zero-style helper\non a single counter, so the existing \"if (tmp)\" guard was\nmeaningful. The split-refcount refactor introduced\naa_get_profile_loaddata(), which has plain kref_get() semantics,\nand the guard quietly became a no-op.\n\nIntroduce aa_get_profile_loaddata_not0(), matching the existing\n_not0 convention used by aa_get_profile_not0(), and use it for\nthe rawdata_list dedup lookup so dying entries are skipped.\n\nReproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu\n24.04 + stress-ng 0.17.06:\n\n  stress-ng --apparmor 1 --klog-check --timeout 60s\n\nWithout this patch the three refcount_t warnings fire within a\nfew seconds. With it the same 60 s run is clean. Coverage is a\nsmoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN\nand CONFIG_PROVE_LOCKING would be welcome from anyone with the\ncycles."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local write() to AppArmor policy management interfaces (.load/.replace) under securityfs/apparmorfs, not through any network-facing protocol.\nAC:L - An attacker with policy-admin capability can reliably win the race by concurrently loading/replacing and removing profiles with identical rawdata blobs, as demonstrated by stress-ng reproducing refcount UAF warnings within seconds.\nPR:L - Triggering aa_replace_profiles() requires CAP_MAC_ADMIN plus policy-view rights; on typical AppArmor deployments (e.g. Ubuntu) namespace-root in an unprivileged user namespace can obtain CAP_MAC_ADMIN via unprivileged_userns_apparmor_policy without init-namespace root.\nUI:N - Exploitation is driven entirely by the attacker\u0027s own policy load/replace/remove operations and does not require any action from another user or administrator.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security boundary, not a cross-VM or cross-security-authority escape.\nC:H - The vulnerability is a use-after-free on aa_loaddata profile refcounts; refcount hardening reports \"addition on 0; use-after-free\" and poisons the counter, creating a path to arbitrary kernel memory disclosure.\nI:H - UAF and refcount saturation/underflow on aa_loaddata enable heap corruption primitives that can be leveraged for arbitrary kernel writes and local privilege escalation.\nA:H - The bug reliably triggers refcount_t UAF warnings and corrupts subsequent refcount operations on the same loaddata, causing kernel instability and potential crash/panic under concurrent policy management."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:35.761Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/643221da57dbb1a8fd800610331cf1ec27969f71"
        },
        {
          "url": "https://git.kernel.org/stable/c/b17f0c59cc1525765625cf07d0391b7f9c1ed7e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7a2890028f16e5b0af0bb005d80fcb32559cca3"
        },
        {
          "url": "https://git.kernel.org/stable/c/15fd83a1e42ede15070968806bb6c8b1a5170688"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce261a20b41db522e320a41bbf1292bf85af66df"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3ca2631073b2cef06824fd2bfc452ff7a1023de"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e34fa9f6f7cd688ae153fff13139a5cf2d42339"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f060496d03e4dc560a40f73770bd08335cb7a27"
        }
      ],
      "title": "apparmor: fix use-after-free in rawdata dedup loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63827",
    "datePublished": "2026-07-19T12:02:22.083Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-17T04:51:35.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d1f8705d6545d20950991785306d08884b0056fc",
              "status": "affected",
              "version": "d0e274af2f2e44b9d496f5d2c0431fdd2ea76fb8",
              "versionType": "git"
            },
            {
              "lessThan": "91eb15c026debd8b7bfbd83f062e6245a4e69964",
              "status": "affected",
              "version": "d0e274af2f2e44b9d496f5d2c0431fdd2ea76fb8",
              "versionType": "git"
            },
            {
              "lessThan": "b09508dd7bc4a8948ea00603041a918c09788502",
              "status": "affected",
              "version": "d0e274af2f2e44b9d496f5d2c0431fdd2ea76fb8",
              "versionType": "git"
            },
            {
              "lessThan": "2afc2d5098866518a5c446a2e647b1b3f43daaf4",
              "status": "affected",
              "version": "d0e274af2f2e44b9d496f5d2c0431fdd2ea76fb8",
              "versionType": "git"
            },
            {
              "lessThan": "c058786b09cfab080125bc3ee7928a181dcbd37a",
              "status": "affected",
              "version": "d0e274af2f2e44b9d496f5d2c0431fdd2ea76fb8",
              "versionType": "git"
            },
            {
              "lessThan": "8709c66e665a2a09192853d4f3d0fb4bd0f76403",
              "status": "affected",
              "version": "d0e274af2f2e44b9d496f5d2c0431fdd2ea76fb8",
              "versionType": "git"
            },
            {
              "lessThan": "2c1fb2335f5e3afb34f91bc07ecb63517c328090",
              "status": "affected",
              "version": "d0e274af2f2e44b9d496f5d2c0431fdd2ea76fb8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()\n\nmt76_connac_get_he_phy_cap routine can theoretically return NULL so\ncheck cap pointer before dereferencing it."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:33:00.744Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d1f8705d6545d20950991785306d08884b0056fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/91eb15c026debd8b7bfbd83f062e6245a4e69964"
        },
        {
          "url": "https://git.kernel.org/stable/c/b09508dd7bc4a8948ea00603041a918c09788502"
        },
        {
          "url": "https://git.kernel.org/stable/c/2afc2d5098866518a5c446a2e647b1b3f43daaf4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c058786b09cfab080125bc3ee7928a181dcbd37a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8709c66e665a2a09192853d4f3d0fb4bd0f76403"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c1fb2335f5e3afb34f91bc07ecb63517c328090"
        }
      ],
      "title": "wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68309",
    "datePublished": "2026-08-10T12:02:43.950Z",
    "dateReserved": "2026-07-30T09:28:09.381Z",
    "dateUpdated": "2026-08-19T16:33:00.744Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/cgx.c",
            "drivers/net/ethernet/marvell/octeontx2/af/cgx.h",
            "drivers/net/ethernet/marvell/octeontx2/af/rvu.h",
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c",
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c",
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d3c6b0f48f126a36955b3fb4154a59d0b3621d97",
              "status": "affected",
              "version": "94d942c5fb970ac2166216838b278613decfa9a0",
              "versionType": "git"
            },
            {
              "lessThan": "3bd438a58e910db5dc369aa25dfed1fc95f1b596",
              "status": "affected",
              "version": "94d942c5fb970ac2166216838b278613decfa9a0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/cgx.c",
            "drivers/net/ethernet/marvell/octeontx2/af/cgx.h",
            "drivers/net/ethernet/marvell/octeontx2/af/rvu.h",
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c",
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c",
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Block VFs from clobbering special CGX PKIND state\n\nPF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND\nprogramming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must\nnot reset the LMAC RX PKIND or default TX parse config over the PF setup.\n\nAdd cgx_get_pkind() and rvu_cgx_is_pkind_config_permitted() so VFs skip\ncgx_set_pkind(), rvu_npc_set_pkind(), and NIX_AF_LFX_TX_PARSE_CFG updates\nwhen the LMAC is using NPC_RX_HIGIG_PKIND or NPC_RX_EDSA_PKIND."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a malicious SR-IOV VF tenant to send NIX_LF_ALLOC mailbox messages over PCI BAR registers during netdev bring-up; the vulnerable AF code is not reachable from remote network packets.\nAC:L - In the target OcteonTX2 DSA/HiGig multi-tenant deployment, a VF reliably triggers the bug by opening its netdev; no races or attacker-uncontrollable memory layout are needed once HiGig/EDSA parsing is enabled on the shared LMAC.\nPR:L - The attacker is a cloud/NFV tenant with an assigned OcteonTX2 VF; triggering NIX LF allocation during interface up requires only guest-level netdev privileges (e.g., CAP_NET_ADMIN in the VM), not host root or init-namespace admin rights.\nUI:N - No victim interaction is required; the clobber occurs automatically when the attacker brings up or reinitializes their VF network interface through the standard driver probe/open path.\nS:C - A VF guest corrupts host-managed shared CGX LMAC hardware PKIND and NPC parse configuration, impacting the PF and other functions on that port beyond the VF\u0027s own security authority\u2014crossing the VM/tenant isolation boundary.\nC:H - Resetting HiGig/EDSA RX PKIND misconfigures NPC packet parsing for the entire shared LMAC, potentially misdelivering or exposing fabric/switch-tagged traffic intended for the PF or other tenants to the attacker\u0027s VF.\nI:H - The VF forcibly overwrites shared LMAC RX PKIND via cgx_set_pkind() and programs default TX parse config, corrupting host-controlled switching-header parsing that governs how transmitted and received fabric traffic is processed on the port.\nA:H - Clobbering special HiGig/EDSA PKIND state breaks correct packet parsing for all PF/VF traffic on the shared LMAC, causing sustained loss of connectivity and denial of network service to the host and co-located tenants."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:16.718Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d3c6b0f48f126a36955b3fb4154a59d0b3621d97"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bd438a58e910db5dc369aa25dfed1fc95f1b596"
        }
      ],
      "title": "octeontx2-af: Block VFs from clobbering special CGX PKIND state",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74527",
    "datePublished": "2026-08-15T12:27:43.568Z",
    "dateReserved": "2026-08-15T05:44:03.912Z",
    "dateUpdated": "2026-08-17T05:48:16.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/accel/bmc150-accel-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5a9f521e0a49a0266200fd535b32a9668ecb33b",
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "versionType": "git"
            },
            {
              "lessThan": "2fe0531dd73eff1de0f2584cb77716d645e548d5",
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "versionType": "git"
            },
            {
              "lessThan": "d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff",
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "versionType": "git"
            },
            {
              "lessThan": "bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc",
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "versionType": "git"
            },
            {
              "lessThan": "89f4a4ca0ac3a933c750569a771c079a290b0721",
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "versionType": "git"
            },
            {
              "lessThan": "3e766526827acd542bcd36c20c4d5f397e0f6521",
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "versionType": "git"
            },
            {
              "lessThan": "35a3cd8fd65e15029eb90f1e510045b1bb071175",
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "versionType": "git"
            },
            {
              "lessThan": "ce0e1cae26096fe959a0da5563a6d6d5a801d5fb",
              "status": "affected",
              "version": "3bbec9773389112330954a6a64422eaa78d546c1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/accel/bmc150-accel-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: accel: bmc150: clamp the device-reported FIFO frame count\n\n__bmc150_accel_fifo_flush() copies the number of samples the device\nreports in its hardware FIFO into an on-stack buffer\n\n\tu16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];\n\nwhich is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The\nframe count is read from the FIFO_STATUS register and only masked to its\n7 valid bits:\n\n\tcount = val \u0026 0x7F;\n\nso it can be 0..127. The only other limit applied to it is the optional\ncaller-supplied sample budget:\n\n\tif (samples \u0026\u0026 count \u003e samples)\n\t\tcount = samples;\n\nwhich does not constrain count on the flush-all path (samples == 0), and\nleaves it well above 32 whenever samples is larger. count samples are\nthen transferred into buffer[]:\n\n\tbmc150_accel_fifo_transfer(data, (u8 *)buffer, count);\n\nbmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a\nmalfunctioning, malicious or counterfeit accelerometer (or an attacker\ntampering with the I2C/SPI bus) that reports up to 127 frames writes up\nto 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up\nto 570 bytes that clobbers the stack canary, saved registers and the\nreturn address.\n\nClamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[]\nis sized for, before the transfer, mirroring the watermark clamp already\ndone in bmc150_accel_set_watermark(). A well-formed flush reports at most\nBMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:56:54.396Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b5a9f521e0a49a0266200fd535b32a9668ecb33b"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fe0531dd73eff1de0f2584cb77716d645e548d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0e6d924a5484e005cae5aff6a0aa07a22f3c9ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfffc98f3de92e0f76be7c7b72e63ac1776a6dbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/89f4a4ca0ac3a933c750569a771c079a290b0721"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e766526827acd542bcd36c20c4d5f397e0f6521"
        },
        {
          "url": "https://git.kernel.org/stable/c/35a3cd8fd65e15029eb90f1e510045b1bb071175"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce0e1cae26096fe959a0da5563a6d6d5a801d5fb"
        }
      ],
      "title": "iio: accel: bmc150: clamp the device-reported FIFO frame count",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64504",
    "datePublished": "2026-07-25T08:51:58.887Z",
    "dateReserved": "2026-07-19T15:36:31.793Z",
    "dateUpdated": "2026-08-17T04:56:54.396Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_device.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "67bc3647e418e23dc0d17604bdba634a73de809f",
              "status": "affected",
              "version": "9d0af8b4def0de6b734ec8db08e96da0458facb6",
              "versionType": "git"
            },
            {
              "lessThan": "a343d028ad6c174da8dc6af560c51e6d140a6727",
              "status": "affected",
              "version": "9d0af8b4def0de6b734ec8db08e96da0458facb6",
              "versionType": "git"
            },
            {
              "lessThan": "6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa",
              "status": "affected",
              "version": "9d0af8b4def0de6b734ec8db08e96da0458facb6",
              "versionType": "git"
            },
            {
              "lessThan": "f5988b5c300a32ff751724ffd33d5a8d5873e4a7",
              "status": "affected",
              "version": "9d0af8b4def0de6b734ec8db08e96da0458facb6",
              "versionType": "git"
            },
            {
              "lessThan": "ea772a440d56b285f4d491affac50ecd41f6b402",
              "status": "affected",
              "version": "9d0af8b4def0de6b734ec8db08e96da0458facb6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_device.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix aperture mapping leak\n\namdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver\nfini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to\nalways return false, so iounmap(aper_base_kaddr) never runs on normal\ndriver unload, leaving an orphaned entry in the x86 PAT interval tree.\n\nOn connected_to_cpu hardware, the aperture is mapped write-back (WB) via\nioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC)\nover the same range. The WC vs WB conflict causes:\n\n  ioremap error for 0x..., requested 0x1, got 0x0\n  amdgpu: discovery failed: -2\n\nFix by switching to devres-managed mappings so cleanup is guaranteed\nregardless of drm_dev_enter() state:\n\n- connected_to_cpu path: devm_memremap(MEMREMAP_WB). For\n  IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut,\n  returning __va(offset) from the existing kernel direct map. No new\n  ioremap VA or PAT entry is created, so there is nothing to orphan.\n\n- dGPU path: devm_ioremap_wc() registers iounmap() as a devres action,\n  guaranteeing cleanup at device_del() time.\n\nAlso remove iounmap(aper_base_kaddr) from amdgpu_device_unmap_mmio()\nsince the mapping is now devres-owned.\n\nv2: Remove redundant x86_64 guard (Lijo)\n\n(cherry picked from commit d871e99879cb5fd1fa798b006b4888887e63a17a)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:58:50.338Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/67bc3647e418e23dc0d17604bdba634a73de809f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a343d028ad6c174da8dc6af560c51e6d140a6727"
        },
        {
          "url": "https://git.kernel.org/stable/c/6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5988b5c300a32ff751724ffd33d5a8d5873e4a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea772a440d56b285f4d491affac50ecd41f6b402"
        }
      ],
      "title": "drm/amdgpu: fix aperture mapping leak",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68102",
    "datePublished": "2026-08-10T11:58:18.093Z",
    "dateReserved": "2026-07-30T09:28:09.368Z",
    "dateUpdated": "2026-08-17T04:58:50.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/ceph_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ac78549d186090ee7125d28c3a8c376573b36194",
              "status": "affected",
              "version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
              "versionType": "git"
            },
            {
              "lessThan": "463a264e9094384112a5c8b46f0a9ddaf8566904",
              "status": "affected",
              "version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
              "versionType": "git"
            },
            {
              "lessThan": "fe46b7e06f14f6f94766832df309b249cb689d27",
              "status": "affected",
              "version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
              "versionType": "git"
            },
            {
              "lessThan": "fc1010e7e0204ece6cc0f9af4f473e9553535eab",
              "status": "affected",
              "version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
              "versionType": "git"
            },
            {
              "lessThan": "d3dc8889d39a676bf840132bd5c5c48cb0daba23",
              "status": "affected",
              "version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
              "versionType": "git"
            },
            {
              "lessThan": "8f5a3abc54ba24dbceb14cc3a719908c4f688091",
              "status": "affected",
              "version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
              "versionType": "git"
            },
            {
              "lessThan": "b9fedda2f628e030384228de0dafc574b7fb0c2f",
              "status": "affected",
              "version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
              "versionType": "git"
            },
            {
              "lessThan": "e4c804726c4afce3ba648b982d564f6af2cfa328",
              "status": "affected",
              "version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/ceph_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: remove debugfs files before client teardown\n\nceph_destroy_client() tears down the monitor client before removing\nthe per-client debugfs files. A concurrent read of the monmap debugfs\nfile can enter monmap_show() after ceph_monc_stop() has freed\nmonc-\u003emonmap, triggering a use-after-free.\n\nRemove the debugfs files before stopping the OSD and monitor clients.\ndebugfs_remove() drains active handlers and prevents new accesses, so\nthe debugfs callbacks can no longer race the rest of client teardown."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to debugfs via read() on /sys/kernel/debug/ceph/client*/monmap concurrent with local ceph client teardown via umount or rbd unmap; the bug is not reachable through Ceph network protocol handlers.\nAC:L - The attacker controls both sides of the race by concurrently reading the monmap debugfs file while triggering ceph_destroy_client() via umount/rbd teardown, and can retry until the window between ceph_monc_stop() and debugfs removal is hit.\nPR:L - An unprivileged local user can use user-namespace capabilities (CAP_DAC_READ_SEARCH) to read root-owned debugfs files and race reads against libceph client teardown during automated volume detach or service restarts on Ceph storage nodes.\nUI:N - No victim user interaction is required; a local attacker can independently issue debugfs reads and trigger or time against client teardown without requiring another user to click, open files, or mount filesystems.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security domain and does not cross VM, container, or IOMMU boundaries; impact is standard kernel privilege escalation or crash.\nC:H - The use-after-free on monc-\u003emonmap permits reading freed heap memory containing monitor addresses and entity metadata, and UAF primitives are routinely leveraged for arbitrary kernel memory disclosure.\nI:H - Heap use-after-free on the variable-length ceph_monmap structure enables memory corruption that can be groomed into arbitrary kernel write primitives and local privilege escalation via control-flow hijacking.\nA:H - Concurrent access to freed monmap memory during debugfs iteration can cause kernel oops, BUG, or panic, and UAF corruption reliably threatens system availability even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:30:18.048Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ac78549d186090ee7125d28c3a8c376573b36194"
        },
        {
          "url": "https://git.kernel.org/stable/c/463a264e9094384112a5c8b46f0a9ddaf8566904"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe46b7e06f14f6f94766832df309b249cb689d27"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc1010e7e0204ece6cc0f9af4f473e9553535eab"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3dc8889d39a676bf840132bd5c5c48cb0daba23"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f5a3abc54ba24dbceb14cc3a719908c4f688091"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9fedda2f628e030384228de0dafc574b7fb0c2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4c804726c4afce3ba648b982d564f6af2cfa328"
        }
      ],
      "title": "libceph: remove debugfs files before client teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68153",
    "datePublished": "2026-08-10T11:59:19.302Z",
    "dateReserved": "2026-07-30T09:28:09.371Z",
    "dateUpdated": "2026-08-19T16:30:18.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b1882cf313ae44181146629b3578a7826c672c9",
              "status": "affected",
              "version": "ba01944adee9f4a71cf2879b9529057fd8de1972",
              "versionType": "git"
            },
            {
              "lessThan": "3e4f848f4a620e1d77c38459e73cf3b362f7bc6b",
              "status": "affected",
              "version": "ba01944adee9f4a71cf2879b9529057fd8de1972",
              "versionType": "git"
            },
            {
              "lessThan": "d5628f39fccc107dca00b98a491d9848898599f7",
              "status": "affected",
              "version": "ba01944adee9f4a71cf2879b9529057fd8de1972",
              "versionType": "git"
            },
            {
              "lessThan": "45c496756c6f6df6c3aeb5b2cb996993d2f14687",
              "status": "affected",
              "version": "ba01944adee9f4a71cf2879b9529057fd8de1972",
              "versionType": "git"
            },
            {
              "lessThan": "2fffc472bec490c8357defcee9c075ca74467352",
              "status": "affected",
              "version": "ba01944adee9f4a71cf2879b9529057fd8de1972",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()\n\nmt76_connac_get_eht_phy_cap routine can theoretically return NULL so\ncheck cap pointer before dereferencing it."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:02:58.582Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b1882cf313ae44181146629b3578a7826c672c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e4f848f4a620e1d77c38459e73cf3b362f7bc6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5628f39fccc107dca00b98a491d9848898599f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/45c496756c6f6df6c3aeb5b2cb996993d2f14687"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fffc472bec490c8357defcee9c075ca74467352"
        }
      ],
      "title": "wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68306",
    "datePublished": "2026-08-10T12:02:40.907Z",
    "dateReserved": "2026-07-30T09:28:09.381Z",
    "dateUpdated": "2026-08-17T05:02:58.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7df1df6f40c0720d30206aa35c0343b962350e0d",
              "status": "affected",
              "version": "953953abb66e52c224057ab91e404284fefeab62",
              "versionType": "git"
            },
            {
              "lessThan": "13fb413ae22a37c69341918a6d651d19a9b0b9b7",
              "status": "affected",
              "version": "601dd3b79769b38d30b693c40afdb2a4b7edf9d0",
              "versionType": "git"
            },
            {
              "lessThan": "bf4ebdb19ff9b3cdf992b50715fe61633327416a",
              "status": "affected",
              "version": "3969db6b22e3d90d8c5f22ac1a7fe0350a94c136",
              "versionType": "git"
            },
            {
              "lessThan": "e374f4e496fef8168784f93a4477d67be34485fd",
              "status": "affected",
              "version": "96c4af418586ee9a6aab61738644366426e05316",
              "versionType": "git"
            },
            {
              "lessThan": "4d8690dace005a38e6dbde9ecce2da3ad85c7c41",
              "status": "affected",
              "version": "96c4af418586ee9a6aab61738644366426e05316",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8c59eeeeffa1524ef57e173a89a1a3ff539888d5",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.142",
              "status": "affected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.92",
              "status": "affected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.34",
              "status": "affected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "6.6.128",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.12.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.18.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()\n\nCommit 96c4af418586 (\"cifs: Fix locking usage for tcon fields\")\nrefactored cifs code to change cifs_tcp_ses_lock for tc_lock around\ntc_count changes.\n\nThere was missing lock around tc_count increment inside\nsmb2_find_smb_sess_tcon_unlocked()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in the in-kernel SMB/CIFS client (fs/smb/client/), reached when processing SMB2 responses received over TCP from a remote server in cifs_demultiplex_thread(). A network-positioned attacker controlling or impersonating the SMB server can drive the vulnerable cancelled-mid handling path.\nAC:L - The attacker controls SMB response timing and can trigger concurrent cifs_put_tcon() via server-initiated disconnect/reconnect, racing the unprotected tc_count increment. Cancelled-mid conditions arise from normal concurrent I/O, signals, and unmount/reconnect activity that the attacker can reliably provoke.\nPR:N - Exploitation requires no local privileges on the victim; a remote malicious or compromised SMB server can attack any client that has an active CIFS mount/session, without the attacker holding an account or capabilities on the victim host.\nUI:N - No victim interaction is needed at exploit time in common deployments where CIFS shares are automounted at boot or persistently connected (cloud file shares, enterprise NAS); the attacker abuses an already-established SMB session rather than requiring a new mount action.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as guest-to-host VM breakout.\nC:H - The race can cause a use-after-free of struct cifs_tcon; UAF of kernel heap objects enables arbitrary memory disclosure through controlled reuse of the freed structure.\nI:H - The UAF leads to subsequent kernel operations (SMB2_close, workqueue handlers) on freed memory, providing a path to arbitrary kernel write and potential code execution via heap grooming.\nA:H - Winning the refcount race causes use-after-free of cifs_tcon with continued kernel use of the freed object, which can trigger kernel oops/panic and denial of service even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:37.286Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7df1df6f40c0720d30206aa35c0343b962350e0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/13fb413ae22a37c69341918a6d651d19a9b0b9b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf4ebdb19ff9b3cdf992b50715fe61633327416a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e374f4e496fef8168784f93a4477d67be34485fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d8690dace005a38e6dbde9ecce2da3ad85c7c41"
        }
      ],
      "title": "smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64136",
    "datePublished": "2026-07-19T15:40:30.351Z",
    "dateReserved": "2026-07-19T07:54:57.036Z",
    "dateUpdated": "2026-08-05T12:39:37.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/seq/seq_timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b7feeaca1f53b10df9b4de9eaf611767ca70dc92",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7478ef94b49bc9789cf1a003deec58b42283dde4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9d9be6fc30f384f92c4e1b8ed40bd9d4796b7833",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fb40d03ed792a8a8bf77aa0ee15df57b0ff78b07",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "24f0cabf173539f048946c8fc221131dc221f277",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6a10025c7fd09a7d2af37a3ae1da188569fce470",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "31a6163e301d832060f8236f1ed17cbc1ca198df",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2c4dc0ed50b05cd847a4b34b8cebf0775f19aeb9",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/seq/seq_timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: close a re-opened queue timer in the destructor\n\nqueue_delete() closes the queue timer, then frees it. snd_seq_timer_close()\nclears q-\u003etimer-\u003etimeri. snd_use_lock_sync() then drains borrowers, and\nsnd_seq_timer_delete() frees q-\u003etimer.\n\nA borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT\nthat took a queueptr() use_lock reference before the queue was unlinked\nruns snd_seq_timer_open() after the close. Open refuses re-open only while\ntimeri is set, and the close just cleared it, so it re-opens timeri.\n\nsnd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop()\nis a no-op, because running was cleared first. So it frees q-\u003etimer with the\ninstance still live. The queue is freed next.\n\nThe instance stays on the global timer with callback_data pointing at the\nfreed queue. A non-owner START on the unlocked queue arms it. The next tick\nderefs the freed queue in snd_seq_timer_interrupt().\n\nReachable by an unprivileged user with access to /dev/snd/seq. No CAP and\nno queue ownership required.\n\nClose any lingering instance in the destructor. There, -\u003etimeri can no\nlonger change: the queue is unlinked and all use_lock borrowers have\ndrained, so no snd_seq_queue_use() can re-open it. Close it before clearing\nq-\u003etimer. snd_timer_close() waits for any in-flight snd_seq_timer_interrupt()\nto finish, and that callback still reads q-\u003etimer (via snd_seq_check_queue()),\nso q-\u003etimer must stay valid until it drains."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through ioctls on the local character device /dev/snd/seq (SNDRV_SEQ_IOCTL_CREATE_QUEUE/DELETE_QUEUE/SET_QUEUE_CLIENT); no network or adjacent-network path exists to the ALSA sequencer.\nAC:L - The attacker controls both sides of the race \u2014 one thread deletes the queue while another spins on SET_QUEUE_CLIENT holding a queueptr() reference \u2014 and can retry the loop indefinitely on a default kernel with CONFIG_SND_SEQUENCER, so the window is reliably hit.\nPR:L - Only an unprivileged local user able to open /dev/snd/seq is needed; snd_seq_queue_use() performs no owner or access check and no capability is required, as the fix commit states explicitly.\nUI:N - The attacker\u0027s own threads create, delete and re-use the queue and the global system timer fires on its own; no victim action is involved.\nS:U - The use-after-free corrupts kernel heap objects within the same kernel security authority, giving at most kernel privilege escalation rather than crossing a VM, IOMMU or sandbox boundary.\nC:H - The stale timer instance dereferences the freed snd_seq_queue and snd_seq_timer, reading tick/time fields and freed prioq pointers that can be reclaimed by attacker-sprayed objects, giving a route to disclose arbitrary kernel memory.\nI:H - snd_seq_timer_interrupt() writes cur_time, tick and last_update into the freed snd_seq_timer slab and snd_seq_check_queue() dispatches events through freed queue pointers, yielding a controllable write primitive on reclaimed heap memory suitable for privilege escalation.\nA:H - Even unexploited, the timer callback derefs freed memory and takes a spinlock in a freed object from interrupt context, causing oops, lock corruption or panic \u2014 a repeatable denial of service for any local user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:08.116Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b7feeaca1f53b10df9b4de9eaf611767ca70dc92"
        },
        {
          "url": "https://git.kernel.org/stable/c/7478ef94b49bc9789cf1a003deec58b42283dde4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d9be6fc30f384f92c4e1b8ed40bd9d4796b7833"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb40d03ed792a8a8bf77aa0ee15df57b0ff78b07"
        },
        {
          "url": "https://git.kernel.org/stable/c/24f0cabf173539f048946c8fc221131dc221f277"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a10025c7fd09a7d2af37a3ae1da188569fce470"
        },
        {
          "url": "https://git.kernel.org/stable/c/31a6163e301d832060f8236f1ed17cbc1ca198df"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c4dc0ed50b05cd847a4b34b8cebf0775f19aeb9"
        }
      ],
      "title": "ALSA: seq: close a re-opened queue timer in the destructor",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68202",
    "datePublished": "2026-08-10T12:00:21.279Z",
    "dateReserved": "2026-07-30T09:28:09.374Z",
    "dateUpdated": "2026-08-23T12:46:08.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5c6375bced6147ec2e460ee3b653f4860d5ecdc2",
              "status": "affected",
              "version": "8eb77cc73977d88787b37c92831b1c242e035396",
              "versionType": "git"
            },
            {
              "lessThan": "ce494707a9c07f27c219ca67f3e138061f53d9b3",
              "status": "affected",
              "version": "8eb77cc73977d88787b37c92831b1c242e035396",
              "versionType": "git"
            },
            {
              "lessThan": "a9c24eda24bd15f432e37824e6fc440977cb241c",
              "status": "affected",
              "version": "8eb77cc73977d88787b37c92831b1c242e035396",
              "versionType": "git"
            },
            {
              "lessThan": "77798d7be6ef71e72fb6fc8a2901bf74ebc9706f",
              "status": "affected",
              "version": "8eb77cc73977d88787b37c92831b1c242e035396",
              "versionType": "git"
            },
            {
              "lessThan": "c04d9ece23deb9e26c19f9ca215e98b3295aa1bb",
              "status": "affected",
              "version": "8eb77cc73977d88787b37c92831b1c242e035396",
              "versionType": "git"
            },
            {
              "lessThan": "eca856950f7cb1a221e02b99d758409f2c5cec42",
              "status": "affected",
              "version": "8eb77cc73977d88787b37c92831b1c242e035396",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: account for fraggap on the paged allocation path\n\nIn __ip_append_data(), when the paged-allocation branch is taken,\nalloclen and pagedlen are computed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap, but the fraggap bytes carried over\nfrom the previous skb are copied into the new skb\u0027s linear area at\noffset transhdrlen by the subsequent skb_copy_and_csum_bits(). The\nlinear area is therefore undersized by fraggap bytes while pagedlen is\noverstated by the same amount.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached while a local process constructs outgoing IPv4 UDP/raw/ping datagrams through sendmsg/splice/sendfile-style socket paths. I did not find a defensible received-packet or unauthenticated remote path that supplies the required cork/MSG_MORE-style fraggap conditions.\nAC:L - The attacker can choose UDP socket options/flags, payload sizes, corking/MSG_MORE behavior, and splice/zerocopy-style paged sends to reach the fraggap paged-allocation path. There is no race or external timing condition required.\nPR:L - A normal unprivileged local user can create IPv4 UDP sockets and use UDP_CORK/MSG_MORE/splice or related paged send paths; raw sockets are CAP_NET_RAW-gated but are not needed for the strongest local trigger. This is therefore basic local user privilege, not real administrator privilege.\nUI:N - No victim interaction is required once the attacker can run the local send/splice sequence. The vulnerable skb construction happens synchronously in the attacker-driven socket send path.\nS:U - The impact is within the same kernel security authority as the vulnerable IPv4 networking code. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug under-allocates/accounting for the linear skb area and can copy attacker-controlled fraggap bytes past skb-\u003eend into trailing skb_shared_info metadata. Kernel memory corruption of this kind is reasonably capable of being developed into information disclosure, so the higher severity confidentiality value is appropriate.\nI:H - The copied fraggap bytes corrupt kernel skb metadata past the intended buffer boundary. This is an out-of-bounds write in kernel heap/networking structures and is scored as high integrity impact.\nA:H - The corrupted skb metadata can crash or destabilize the kernel networking stack, and related negative-copy accounting can also produce severe send-path failure behavior. Kernel crash or oops potential is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:30.453Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5c6375bced6147ec2e460ee3b653f4860d5ecdc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce494707a9c07f27c219ca67f3e138061f53d9b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9c24eda24bd15f432e37824e6fc440977cb241c"
        },
        {
          "url": "https://git.kernel.org/stable/c/77798d7be6ef71e72fb6fc8a2901bf74ebc9706f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c04d9ece23deb9e26c19f9ca215e98b3295aa1bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/eca856950f7cb1a221e02b99d758409f2c5cec42"
        }
      ],
      "title": "ipv4: account for fraggap on the paged allocation path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53366",
    "datePublished": "2026-07-16T05:13:40.893Z",
    "dateReserved": "2026-06-09T07:44:35.400Z",
    "dateUpdated": "2026-08-17T04:50:30.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "74f3e6e21ebc6c418d348f8ce68aef6fe6d82c82",
              "status": "affected",
              "version": "7fe4d391e937c2f048a43ff4b421e677f10d83c0",
              "versionType": "git"
            },
            {
              "lessThan": "8bc83f9ef6789571f399ff631a2a14a12b6d8585",
              "status": "affected",
              "version": "249c88e7fb45b6b705040c5af4bd0d0f2bc9735c",
              "versionType": "git"
            },
            {
              "lessThan": "579faba5ede6df6b7f36777c431dc8dcf9d272e7",
              "status": "affected",
              "version": "227a0cdf4a028a73dc256d0f5144b4808d718893",
              "versionType": "git"
            },
            {
              "lessThan": "ca58ad287bfc5b9d31a72ecb8650289df2b57250",
              "status": "affected",
              "version": "227a0cdf4a028a73dc256d0f5144b4808d718893",
              "versionType": "git"
            },
            {
              "lessThan": "b11511006f9e17000de3f4cadee451364f658ca3",
              "status": "affected",
              "version": "227a0cdf4a028a73dc256d0f5144b4808d718893",
              "versionType": "git"
            },
            {
              "lessThan": "16cd66443957e4ad42155c6fec401012f600c6f8",
              "status": "affected",
              "version": "227a0cdf4a028a73dc256d0f5144b4808d718893",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "58afdc9b18871eb1d461c725be9e9f3f44a39aeb",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.148",
              "status": "affected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.6.51",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix locking in unpair_device/disconnect_sync\n\nDereferencing RCU-protected pointers outside critical sections is\ninvalid and may lead to UAF.\n\nTake hdev-\u003elock for hci_conn lookup and hci_abort_conn().  Don\u0027t use RCU\nto ensure the conn is fully initialized at this point."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered by a local process sending MGMT_OP_DISCONNECT/MGMT_OP_UNPAIR_DEVICE on an AF_BLUETOOTH/BTPROTO_HCI socket bound to HCI_CHANNEL_CONTROL, and the freeing side is drivable locally via /dev/vhci events or ioctl(HCIDEVDOWN)/hci_conn_hash_flush; no over-the-air access is required.\nAC:L - The attacker controls both sides of the race \u2014 repeatedly queuing the mgmt command while tearing the connection down (vhci-injected disconnect-complete, HCIDEVDOWN, or connection timeout) \u2014 and can retry indefinitely, so the window is reached reliably.\nPR:L - The mgmt command needs a trusted control socket, but that capability is routinely held by the Bluetooth daemon and exposed to unprivileged session users through BlueZ Disconnect/RemoveDevice D-Bus methods, so an ordinary local user can drive the path with attacker-chosen addresses.\nUI:N - Both the mgmt command and the concurrent connection teardown are initiated programmatically by the attacker; no victim action such as pairing confirmation or opening a file is needed.\nS:U - The corruption is confined to kernel heap objects managed by the Bluetooth subsystem within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - hci_abort_conn() dereferences the freed hci_conn (conn-\u003ehdev, conn-\u003eabort_reason, conn-\u003ehandle) after it has been unlinked and released, so an attacker who reclaims the slab with controlled data obtains a read primitive over kernel memory and can leak pointers.\nI:H - The use-after-free is not read-only: hci_abort_conn() stores the attacker-reachable reason byte into conn-\u003eabort_reason and hci_conn_get() increments a refcount inside the freed object, giving a write primitive into reclaimed heap memory that is leverageable for control-flow hijack.\nA:H - Dereferencing a freed or partially initialized hci_conn and then queuing abort_conn_sync on it produces slab-use-after-free oopses, refcount underflow, and kernel panics, crashing the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:21.017Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/74f3e6e21ebc6c418d348f8ce68aef6fe6d82c82"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bc83f9ef6789571f399ff631a2a14a12b6d8585"
        },
        {
          "url": "https://git.kernel.org/stable/c/579faba5ede6df6b7f36777c431dc8dcf9d272e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca58ad287bfc5b9d31a72ecb8650289df2b57250"
        },
        {
          "url": "https://git.kernel.org/stable/c/b11511006f9e17000de3f4cadee451364f658ca3"
        },
        {
          "url": "https://git.kernel.org/stable/c/16cd66443957e4ad42155c6fec401012f600c6f8"
        }
      ],
      "title": "Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68392",
    "datePublished": "2026-08-10T12:04:11.543Z",
    "dateReserved": "2026-07-30T09:28:09.388Z",
    "dateUpdated": "2026-08-23T12:46:21.017Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6884fc142b17f456caac50c14505f509bfbcd012",
              "status": "affected",
              "version": "40e8a766a761f7fdc8530347527b344fddf6f1a8",
              "versionType": "git"
            },
            {
              "lessThan": "85eedff5f0c4aba5a66bc37a1bd6bcecd0d77b53",
              "status": "affected",
              "version": "40e8a766a761f7fdc8530347527b344fddf6f1a8",
              "versionType": "git"
            },
            {
              "lessThan": "4622214f0542f64b02c250db0f9c677eeb032d9b",
              "status": "affected",
              "version": "40e8a766a761f7fdc8530347527b344fddf6f1a8",
              "versionType": "git"
            },
            {
              "lessThan": "50319efb865f72db45f191c8709511746d58ee0a",
              "status": "affected",
              "version": "40e8a766a761f7fdc8530347527b344fddf6f1a8",
              "versionType": "git"
            },
            {
              "lessThan": "abeeb1947d81610c65349db4d89c6151f270e136",
              "status": "affected",
              "version": "40e8a766a761f7fdc8530347527b344fddf6f1a8",
              "versionType": "git"
            },
            {
              "lessThan": "bb52249fbbe948875155ccd45cd8d74bf4ae747b",
              "status": "affected",
              "version": "40e8a766a761f7fdc8530347527b344fddf6f1a8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdkfd/kfd_events.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check bounds in allocate_event_notification_slot\n\nThe valid event ids go from 0 to KFD_SIGNAL_EVENT_LIMIT\n\nallocate_event_notification_slot has an option to specify\nan event id to allocate at, used by CRIU. We weren\u0027t checking\nthe bounds on that value.\n\nCheck them.\n\nv2: Lower bounds check is unecessary because of idr_alloc\nalready rejecting negative numbers. Upper bounds check should\nbe KFD_SIGNAL_EVENT_LIMIT since the signal mode mappings might\nnot yet exist\n\n(cherry picked from commit 6853f1f6cbbeb3f53ebbbd7286536aeb2c5d5f50)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:32:28.586Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6884fc142b17f456caac50c14505f509bfbcd012"
        },
        {
          "url": "https://git.kernel.org/stable/c/85eedff5f0c4aba5a66bc37a1bd6bcecd0d77b53"
        },
        {
          "url": "https://git.kernel.org/stable/c/4622214f0542f64b02c250db0f9c677eeb032d9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/50319efb865f72db45f191c8709511746d58ee0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/abeeb1947d81610c65349db4d89c6151f270e136"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb52249fbbe948875155ccd45cd8d74bf4ae747b"
        }
      ],
      "title": "drm/amdkfd: Check bounds in allocate_event_notification_slot",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68259",
    "datePublished": "2026-08-10T12:01:33.110Z",
    "dateReserved": "2026-07-30T09:28:09.378Z",
    "dateUpdated": "2026-08-19T16:32:28.586Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c",
            "drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e6e9bc0bf963662b7042048ab0281014625d4cb4",
              "status": "affected",
              "version": "caa2da34fd25a37e9fd43343b6966fb9d730a6d5",
              "versionType": "git"
            },
            {
              "lessThan": "b92e7ea408b6f1144648909c9c49a55d245d7300",
              "status": "affected",
              "version": "caa2da34fd25a37e9fd43343b6966fb9d730a6d5",
              "versionType": "git"
            },
            {
              "lessThan": "94192b0579333c3deee2441379aab8ca98fc2e6b",
              "status": "affected",
              "version": "caa2da34fd25a37e9fd43343b6966fb9d730a6d5",
              "versionType": "git"
            },
            {
              "lessThan": "4c29603498b05c049dbbbc47e882f2fbf0193cd7",
              "status": "affected",
              "version": "caa2da34fd25a37e9fd43343b6966fb9d730a6d5",
              "versionType": "git"
            },
            {
              "lessThan": "0488a0bb344fb1992853b60082acff6be8164d74",
              "status": "affected",
              "version": "caa2da34fd25a37e9fd43343b6966fb9d730a6d5",
              "versionType": "git"
            },
            {
              "lessThan": "0d9b9d7dbef976ae7f855b6358f1d703014e96ea",
              "status": "affected",
              "version": "caa2da34fd25a37e9fd43343b6966fb9d730a6d5",
              "versionType": "git"
            },
            {
              "lessThan": "c4b8c5d51632538b19ee01cf6d70cbceeefbd3ec",
              "status": "affected",
              "version": "caa2da34fd25a37e9fd43343b6966fb9d730a6d5",
              "versionType": "git"
            },
            {
              "lessThan": "9b244c242bec48b37e82b89787afd6a4c43457e1",
              "status": "affected",
              "version": "caa2da34fd25a37e9fd43343b6966fb9d730a6d5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/nic/cn20k.c",
            "drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: avoid double free of pool-\u003estack on AQ init failure\n\notx2_pool_aq_init() frees pool-\u003estack when mailbox sync or retry\nallocation fails, but leaves the pointer unchanged. Later,\notx2_sq_aura_pool_init() unwinds the partial setup through\notx2_aura_pool_free(), which frees pool-\u003estack again. The CN20K-specific\ncn20k_pool_aq_init() implementation has the same bug in\nits corresponding error path.\n\nSet pool-\u003estack to NULL immediately after the local free so the shared\ncleanup path does not free the same stack again while cleaning up\npartially initialized pool state.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still present in\nv7.1-rc3.\n\nRuntime validation was not performed because reproducing this path\nrequires OcteonTX2/CN20K hardware."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable initialization is reached through local netdevice operations such as RTM_SETLINK or ethtool reconfiguration, ultimately invoking ndo_open; received network packets do not directly reach it.\nAC:H - The attacker can fill the fixed mailbox by configuring many queues, but exploitation additionally requires an AF/NPA synchronization error or timeout. Legitimate mailbox users are serialized, so this failure is not reliably attacker-controlled.\nPR:L - CAP_NET_ADMIN is required in the device\u0027s owning network namespace. OcteonTX2 VFs can reasonably be delegated to a user-owned network namespace, where namespace-level administration suffices without initial-namespace root.\nUI:N - The attacker can initiate the interface-open or reconfiguration operation directly, without action by another user.\nS:U - The double free corrupts the kernel managing the affected PF or VF but does not inherently cross a VM, IOMMU, or separate security-authority boundary.\nC:H - The repeated release of coherent DMA pages can create overlapping allocations, while the stale qmem object can also be reclaimed and its DMA metadata influenced. This memory corruption can plausibly expose arbitrary kernel memory.\nI:H - Double-freeing DMA-backed pages can corrupt the page allocator and produce overlapping ownership, enabling arbitrary kernel-memory modification or control-flow hijacking.\nA:H - The double DMA/page release can immediately cause allocator warnings, an oops, or a kernel panic, and corrupted allocator state can crash the system later."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:40:09.522Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e6e9bc0bf963662b7042048ab0281014625d4cb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b92e7ea408b6f1144648909c9c49a55d245d7300"
        },
        {
          "url": "https://git.kernel.org/stable/c/94192b0579333c3deee2441379aab8ca98fc2e6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c29603498b05c049dbbbc47e882f2fbf0193cd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0488a0bb344fb1992853b60082acff6be8164d74"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d9b9d7dbef976ae7f855b6358f1d703014e96ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4b8c5d51632538b19ee01cf6d70cbceeefbd3ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b244c242bec48b37e82b89787afd6a4c43457e1"
        }
      ],
      "title": "octeontx2-pf: avoid double free of pool-\u003estack on AQ init failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64222",
    "datePublished": "2026-07-24T15:23:08.072Z",
    "dateReserved": "2026-07-19T15:36:31.770Z",
    "dateUpdated": "2026-08-05T12:40:09.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/lpc32xx_adc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7090c0d29708ee305022d0ea7b37612b33242fa2",
              "status": "affected",
              "version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
              "versionType": "git"
            },
            {
              "lessThan": "0e33587967b356519aa6f220b5b43c6976320397",
              "status": "affected",
              "version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
              "versionType": "git"
            },
            {
              "lessThan": "1ddf7b6ffb8ebb22b92a184a9eaa76277ef0c7cd",
              "status": "affected",
              "version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
              "versionType": "git"
            },
            {
              "lessThan": "820c4f15353efe9a9429ae86ccceeaf4e0e4e585",
              "status": "affected",
              "version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
              "versionType": "git"
            },
            {
              "lessThan": "48eccc6caed4e62c0f199ab3a3772fa969cd3b2d",
              "status": "affected",
              "version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
              "versionType": "git"
            },
            {
              "lessThan": "9e2e8b8cdfd37ae7c7a8a5c96c59e98a768731c4",
              "status": "affected",
              "version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
              "versionType": "git"
            },
            {
              "lessThan": "2f18c5551aa97ca7f39dbb151c67c9053ccadc17",
              "status": "affected",
              "version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
              "versionType": "git"
            },
            {
              "lessThan": "e561b35633f450ee607e87a6401d97f156a0cd54",
              "status": "affected",
              "version": "7901b2a1453e48c9defff2c97c67d3089bf4df7a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/adc/lpc32xx_adc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: lpc32xx: Initialize completion before requesting IRQ\n\nIn the report from Jaeyoung Chung:\n\n\"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its\ninterrupt handler with devm_request_irq() before it initializes\nst-\u003ecompletion with init_completion(). If an interrupt arrives after\ndevm_request_irq() and before init_completion(), the handler calls\ncomplete() on an uninitialized completion, causing a kernel panic.\n\nThe probe path, in lpc32xx_adc_probe():\n\n    iodev = devm_iio_device_alloc(\u0026pdev-\u003edev, sizeof(*st)); /* st kzalloc-zeroed */\n    ...\n    retval = devm_request_irq(\u0026pdev-\u003edev, irq, lpc32xx_adc_isr, 0,\n                              LPC32XXAD_NAME, st);           /* register handler */\n    ...\n    init_completion(\u0026st-\u003ecompletion);                       /* initialize completion */\n\nlpc32xx_adc_isr() calls complete():\n\n    complete(\u0026st-\u003ecompletion);\n\nIf the device raises an interrupt before init_completion() runs,\ncomplete() acquires the uninitialized wait.lock and walks the zeroed\ntask_list in swake_up_locked(). The zeroed task_list makes list_empty()\nreturn false, so swake_up_locked() dereferences a NULL list entry,\ntriggering a KASAN wild-memory-access.\"\n\nFix the chance of a spurious IRQ causing an uninitialized pointer\ndereference by moving init_completion() above devm_request_irq()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:56:49.966Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7090c0d29708ee305022d0ea7b37612b33242fa2"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e33587967b356519aa6f220b5b43c6976320397"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ddf7b6ffb8ebb22b92a184a9eaa76277ef0c7cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/820c4f15353efe9a9429ae86ccceeaf4e0e4e585"
        },
        {
          "url": "https://git.kernel.org/stable/c/48eccc6caed4e62c0f199ab3a3772fa969cd3b2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e2e8b8cdfd37ae7c7a8a5c96c59e98a768731c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f18c5551aa97ca7f39dbb151c67c9053ccadc17"
        },
        {
          "url": "https://git.kernel.org/stable/c/e561b35633f450ee607e87a6401d97f156a0cd54"
        }
      ],
      "title": "iio: adc: lpc32xx: Initialize completion before requesting IRQ",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64500",
    "datePublished": "2026-07-25T08:51:56.053Z",
    "dateReserved": "2026-07-19T15:36:31.793Z",
    "dateUpdated": "2026-08-17T04:56:49.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/st/stm32/stm32-dcmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "222a9301b086852b90d3b092fef436c3f4e927c4",
              "status": "affected",
              "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
              "versionType": "git"
            },
            {
              "lessThan": "37ff63c5d7119cbc5c6bacdcc658add6008a8e1f",
              "status": "affected",
              "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
              "versionType": "git"
            },
            {
              "lessThan": "6c6f22b7e6cbc4e8c1e359fc9b190419391c3db7",
              "status": "affected",
              "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
              "versionType": "git"
            },
            {
              "lessThan": "931abe1deb65b919d23fa203d7f6d6fbd4fccd8e",
              "status": "affected",
              "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
              "versionType": "git"
            },
            {
              "lessThan": "4b7ee504969e074725e439c949f2483e5fa5572a",
              "status": "affected",
              "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
              "versionType": "git"
            },
            {
              "lessThan": "084973ebd67b28f0945c5d45408f86c58b540110",
              "status": "affected",
              "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/st/stm32/stm32-dcmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: stm32: dcmi: unregister notifier on probe failure\n\ndcmi_graph_init() registers the async notifier before dcmi_probe() toggles\nthe reset line. If reset_control_assert() or reset_control_deassert()\nfails afterwards, probe returns through err_cleanup and the driver core\nwill not call dcmi_remove().\n\nUnregister the notifier before cleaning it up on that error path,\nmatching the successful remove path and the V4L2 async notifier lifetime\nrules.\n\n[hverkuil: added Fixes tag]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The affected code is a platform camera-interface driver probe path on STM32 SoCs; it is reached only through local device/driver binding on the machine itself, with the resulting dangling notifier consumed by in-kernel V4L2 subdev registration. No network or remote data path reaches this code.\nAC:L - Once the driver has probe-failed on the reset line, the stale notifier remains on the global v4l2 notifier_list indefinitely, and any subsequent subdev registration deterministically walks the freed object; no race or unpredictable memory layout must be won to reach the freed dereference.\nPR:L - A local user account on the device is sufficient to interact with the media/V4L2 stack and trigger subdev registration paths that walk the corrupted global notifier list; no root or administrative capability is needed to consume the dangling pointer.\nUI:N - The stale notifier is left behind automatically by the failing probe path and is dereferenced by kernel-internal V4L2 async registration; no victim action such as opening a file or mounting a filesystem is required.\nS:U - The freed memory, the corrupted list, and the resulting impact are all within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The devm-allocated stm32_dcmi object containing the notifier is freed while still linked into the global notifier_list, so reallocated heap contents are read back as notifier state and traversed as list pointers, which can be leveraged to disclose kernel memory.\nI:H - Traversal and eventual list_del of the freed notifier_entry performs writes through attacker-influenceable heap contents, giving a use-after-free list-corruption primitive that can be shaped into an arbitrary write and control-flow hijack.\nA:H - Dereferencing and unlinking a freed notifier from the global list reliably produces list corruption and an oops or panic in the V4L2 async core, taking down the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:31:34.517Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/222a9301b086852b90d3b092fef436c3f4e927c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/37ff63c5d7119cbc5c6bacdcc658add6008a8e1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c6f22b7e6cbc4e8c1e359fc9b190419391c3db7"
        },
        {
          "url": "https://git.kernel.org/stable/c/931abe1deb65b919d23fa203d7f6d6fbd4fccd8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b7ee504969e074725e439c949f2483e5fa5572a"
        },
        {
          "url": "https://git.kernel.org/stable/c/084973ebd67b28f0945c5d45408f86c58b540110"
        }
      ],
      "title": "media: stm32: dcmi: unregister notifier on probe failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68210",
    "datePublished": "2026-08-10T12:00:29.515Z",
    "dateReserved": "2026-07-30T09:28:09.375Z",
    "dateUpdated": "2026-08-19T16:31:34.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/rx.c",
            "net/mac80211/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed",
              "status": "affected",
              "version": "09a740ce352e1a1d16b9984115514ba9a4f4704b",
              "versionType": "git"
            },
            {
              "lessThan": "57d503ce32eccfa7650065ca4c560f7e29a2e676",
              "status": "affected",
              "version": "09a740ce352e1a1d16b9984115514ba9a4f4704b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/rx.c",
            "net/mac80211/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: validate extension-frame layout before RX\n\nExtension frames only have the extension header at the regular 802.11\nheader offset. The generic RX path can still reach helpers and interface\ndispatch code that read regular header address fields before unsupported\nextension subtypes are dropped.\n\nmac80211 currently only handles S1G beacon extension frames. Drop other\nextension subtypes before they can reach regular-header RX processing.\nFor S1G beacons, linearize the SKB with the management-frame path and\nrequire the fixed S1G beacon header, including optional fixed fields\nindicated by frame control, before generic RX dispatch.\n\nRoute S1G beacons through the station/default-link RX path without\nregular-header station lookup. Avoid regular-header address reads in the\nmac80211 RX paths that process S1G extension beacons, including\naccept-frame, duplicate-detection, address-copy, and MLO\naddress-translation paths.\n\nAlso make ieee80211_get_bssid() length-safe before returning the S1G\nsource-address pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Malformed 802.11 extension/S1G frames reach mac80211 via the normal WiFi RX path (driver -\u003e ieee80211_rx_list -\u003e __ieee80211_rx_handle_packet); an attacker within radio range can inject frames over the air without routing through the Internet.\nAC:L - The attacker fully controls crafted extension-frame length, subtype, and frame-control flags; only 4 bytes are validated before code reads up to 24 bytes of presumed 802.11 addresses, so triggering the bug is reliable and does not depend on victim-specific timing or memory layout.\nPR:N - Exploitation requires only transmitting WiFi frames to a victim with an active mac80211 interface; no local account, capability, or association/authentication is needed because vulnerable header parsing runs before extension subtype filtering and RX handler dispatch.\nUI:N - The victim does not need to click links, join networks, or perform any deliberate action beyond having WiFi enabled; passive reception of attacker-injected extension frames on AP, STA, or mesh interfaces is sufficient to reach the vulnerable code.\nS:U - Impact is confined to kernel mac80211 RX processing on the receiving host (OOB skb reads/writes and possible crash/privilege escalation); it does not cross a VM, container, or IOMMU security boundary into another authority.\nC:H - Pre-fix code reads regular-header addr1/addr2/addr3/seq_ctrl and copies 18 bytes of addrs on extension frames whose layout differs and may be shorter than 24 bytes, causing out-of-bounds reads and disclosure of adjacent skb/heap memory via ieee80211_get_bssid(), accept-frame, duplicate detection, and MLO prep paths.\nI:H - ieee80211_prepare_and_rx_handle can perform ether_addr_copy() MLO address translation on S1G/extension frames because ieee80211_is_beacon() is false for FTYPE_EXT, writing attacker-influenced MAC bytes into wrong skb offsets and enabling memory corruption that could be developed into arbitrary kernel write/code execution.\nA:H - Out-of-bounds access while parsing short or malformed extension frames can provoke kernel oops/panic or destabilize RX processing; even failed exploitation still enables repeatable remote DoS against any reachable WiFi interface by retransmitting malicious extension frames."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:12.948Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676"
        }
      ],
      "title": "wifi: mac80211: validate extension-frame layout before RX",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68470",
    "datePublished": "2026-08-15T05:51:28.211Z",
    "dateReserved": "2026-07-30T09:28:09.396Z",
    "dateUpdated": "2026-08-17T05:39:12.948Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "a12b1575f9feabd91695a9e9d004862f7195fa25",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "888706a76286c547bd035432602571e8024b5305",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "db77b6bb6e6edb79b10b4efcce346eec5582d588",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "4e40056bb5c829f0423f0a6694a0477726d2147e",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "bd004716ba75fed6d185795c85cdc92540ebeaab",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "0c0a8ed85349dae298712d79cb276acfeb794d82",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()\n\nWhen the scatterlist ring is full or nearly full, bpf_msg_push_data()\nenters a copy fallback path and computes copy + len for the page\nallocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING\nand both are u32, a crafted len can wrap the sum to a small value,\ncausing an undersized allocation followed by an out-of-bounds memcpy.\n\n BUG: unable to handle page fault for address: ffffed104089a402\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n Call Trace:\n  __asan_memcpy (mm/kasan/shadow.c:105)\n  bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788)\n  bpf_prog_9ed8b5711920a7d7+0x2e/0x36\n  sk_psock_msg_verdict (net/core/skmsg.c:934)\n  tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584)\n  __sys_sendto (net/socket.c:2206)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd an overflow check before the allocation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable helper only runs from the sk_msg egress verdict path, reached via a local `sendmsg()`/`sendto()` syscall on a sockmap- or kTLS-attached socket (`tcp_bpf_sendmsg` \u2192 `sk_psock_msg_verdict`, `tls_sw_sendmsg`), as shown in the reported call trace. There is no remote-peer input path into `bpf_msg_push_data()`.\nAC:L - Both trigger conditions are fully attacker-controlled and deterministic: the copy-fallback path is forced by sending \u2265 MAX_SKB_FRAGS*PAGE_SIZE bytes in one sendmsg to fill the SG ring, and the wrapping `len` is a constant chosen by the sk_msg program. No race, timing window, or uncontrolled memory state is involved.\nPR:N - The act that triggers the corruption \u2014 `sendmsg()` on a socket already in the sockmap \u2014 requires no privileges whatsoever, and the same helper\u0027s prior flaw (CVE-2026-63926) was scored PR:N on this basis. `ARG_ANYTHING` means the verifier enforces no bound, so a deployed L7-proxy sk_msg program that derives `len` from message content (e.g. a signed `want - have` underflowing to a huge u32) hands the wrapping value to the kernel without any attacker privilege; where program authorship is needed, CAP_BPF+CAP_NET_ADMIN is delegable to unprivileged container users via a bpffs BPF token.\nUI:N - Exploitation is entirely driven by the attacker\u0027s own socket writes and BPF program; no victim action, mount, or file access is required.\nS:U - The undersized allocation and out-of-bounds write corrupt kernel memory within the same security authority as the vulnerable code. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The wild-offset write plus the corrupted `sg.size`/element-length/`data_end` state (huge `len` added to `sg.size` while `sg_set_page()` records the wrapped length) lets adjacent kernel memory be exposed to the BPF program and pushed out on the socket, and the write primitive is readily convertible into an arbitrary kernel read.\nI:H - `memcpy(raw + front + len, from, back)` writes up to a full SG element of attacker-supplied payload roughly 4 GiB past a single-page allocation, with the offset tunable over a ~4 MiB window and the source page groomable \u2014 an attacker-controlled write into the direct map, sufficient for control-flow hijack and privilege escalation.\nA:H - The reported reproducer is an unrecoverable oops (\"unable to handle page fault for address: ffffed104089a402\") when the wild pointer hits unmapped direct-map space, and the ~4 GiB `sk_mem_charge()`/`sg.size` accounting corruption further destabilises the socket and allocator."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:25.465Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a12b1575f9feabd91695a9e9d004862f7195fa25"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/888706a76286c547bd035432602571e8024b5305"
        },
        {
          "url": "https://git.kernel.org/stable/c/db77b6bb6e6edb79b10b4efcce346eec5582d588"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e40056bb5c829f0423f0a6694a0477726d2147e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd004716ba75fed6d185795c85cdc92540ebeaab"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c0a8ed85349dae298712d79cb276acfeb794d82"
        }
      ],
      "title": "bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64548",
    "datePublished": "2026-07-27T20:10:38.355Z",
    "dateReserved": "2026-07-19T15:36:31.795Z",
    "dateUpdated": "2026-08-17T04:57:25.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/xen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3ee59c38ae7369ad1f7b846e05633ccf0d159fab",
              "status": "affected",
              "version": "92c58965e9656dc6e682a8ffe520fac0fb256d13",
              "versionType": "git"
            },
            {
              "lessThan": "fd627ac8a5cff4d45269f164b13ddddc0726f2cc",
              "status": "affected",
              "version": "92c58965e9656dc6e682a8ffe520fac0fb256d13",
              "versionType": "git"
            },
            {
              "lessThan": "061c553c66bc1638c280739999224c8000fd4602",
              "status": "affected",
              "version": "92c58965e9656dc6e682a8ffe520fac0fb256d13",
              "versionType": "git"
            },
            {
              "lessThan": "5a53249d149f48b558368c5338b9921b76a12f8c",
              "status": "affected",
              "version": "92c58965e9656dc6e682a8ffe520fac0fb256d13",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/xen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls\n\nkvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host\nfor more than one event channel potr (nr_ports \u003e 1).\n\nAfter the kmalloc_array(), the error paths need to go through the\n\"out\" label, but the call to kvm_read_guest_virt() does not.\n\n[Adjusted commit message. - Paolo]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:28:36.841Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3ee59c38ae7369ad1f7b846e05633ccf0d159fab"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd627ac8a5cff4d45269f164b13ddddc0726f2cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/061c553c66bc1638c280739999224c8000fd4602"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a53249d149f48b558368c5338b9921b76a12f8c"
        }
      ],
      "title": "KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38469",
    "datePublished": "2025-07-28T11:21:30.992Z",
    "dateReserved": "2025-04-16T04:51:24.020Z",
    "dateUpdated": "2026-05-11T21:28:36.841Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amd/pds_core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3231aff8ab26111c54e630b1a200fc43a729dd14",
              "status": "affected",
              "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56",
              "versionType": "git"
            },
            {
              "lessThan": "10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2",
              "status": "affected",
              "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56",
              "versionType": "git"
            },
            {
              "lessThan": "784dd2bdc622ed3cc6ef8e113aa1852e252de36f",
              "status": "affected",
              "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56",
              "versionType": "git"
            },
            {
              "lessThan": "560d559324169fe0583d54c475b5329550a86f71",
              "status": "affected",
              "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56",
              "versionType": "git"
            },
            {
              "lessThan": "0e46b6635b03d29807f810c3b415c4755a3f958d",
              "status": "affected",
              "version": "45d76f492938cdc27ddadc16e1e75103f4cfbf56",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/amd/pds_core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix error handling in pdsc_devcmd_wait\n\nFix two cases where pdsc_devcmd_wait() returns stale success from\nthe completion register instead of an error:\n\n1. FW crash: If firmware stops running, the wait loop breaks early with\n   running=false. The condition \"if ((!done || timeout) \u0026\u0026 running)\" is\n   false, so error handling is bypassed and stale status is returned.\n   Check !running first and return -ENXIO.\n\n2. Timeout: If a command times out, err is set to -ETIMEDOUT but then\n   overwritten by pdsc_err_to_errno(status) which reads stale status.\n   Return -ETIMEDOUT immediately after cleaning up.\n\nBoth errors now propagate to pdsc_devcmd_locked() which queues\nhealth_work for recovery."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in the AMD/Pensando pds_core host driver for a network DPU/NIC whose firmware processes remote traffic; a remote attacker can crash or hang firmware via crafted packets, which drives kernel recovery through pdsc_devcmd_locked() during pdsc_fw_up/pdsc_setup.\nAC:L - Once the device is reachable, an attacker can reliably induce the triggering conditions (firmware crash or devcmd timeout) by sending concurrent or malformed network traffic to stress the DPU firmware, without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation does not require host credentials; an unauthenticated remote attacker who can send traffic to the Pensando DSC interface can cause firmware failure that reaches pdsc_devcmd_wait() during automatic driver recovery, independent of devlink or root-only management paths.\nUI:N - No victim interaction is required beyond normal network connectivity to the affected DPU-backed host; recovery is triggered automatically by firmware failure and the driver\u0027s health/recovery workqueue path.\nS:U - The flaw affects host kernel driver state and device recovery within the same security authority; it does not cross a VM, container, or IOMMU boundary to impact a separate security domain.\nC:N - The bug is a logic error returning stale MMIO completion status rather than a memory-safety flaw; it does not expose arbitrary kernel memory, only misinterprets bounded device register contents from prior commands.\nI:N - There is no kernel memory corruption or arbitrary write primitive; the worst case is proceeding with stale device-command completion data, which affects driver/device recovery state rather than modifying protected host data.\nA:H - Masking firmware crash or timeout as success prevents immediate health_work recovery, can leave the driver believing a failed INIT/reset succeeded, and can cause prolonged or repeated loss of DPU/network availability on internet-facing cloud servers until manual intervention or repeated recovery cycles."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:43.750Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3231aff8ab26111c54e630b1a200fc43a729dd14"
        },
        {
          "url": "https://git.kernel.org/stable/c/10ae3180095bbe2d378c5b1d6f2f2fd74dda3cc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/784dd2bdc622ed3cc6ef8e113aa1852e252de36f"
        },
        {
          "url": "https://git.kernel.org/stable/c/560d559324169fe0583d54c475b5329550a86f71"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e46b6635b03d29807f810c3b415c4755a3f958d"
        }
      ],
      "title": "pds_core: fix error handling in pdsc_devcmd_wait",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64148",
    "datePublished": "2026-07-19T15:40:38.816Z",
    "dateReserved": "2026-07-19T07:54:57.037Z",
    "dateUpdated": "2026-08-05T12:39:43.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/pmbus/adm1266.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fd9196aad9e5a3845cea17de3405ebc700382142",
              "status": "affected",
              "version": "d98dfad35c38c037b37c4adc99df01da571031a5",
              "versionType": "git"
            },
            {
              "lessThan": "ee4799becf7d2af3778007e22c2e55c4009a49c7",
              "status": "affected",
              "version": "d98dfad35c38c037b37c4adc99df01da571031a5",
              "versionType": "git"
            },
            {
              "lessThan": "c603b6c6840ac0c6285f5eefea0de6242710af21",
              "status": "affected",
              "version": "d98dfad35c38c037b37c4adc99df01da571031a5",
              "versionType": "git"
            },
            {
              "lessThan": "a2d1c819348b36fccbbfcf37c5fa7a50a9b4528f",
              "status": "affected",
              "version": "d98dfad35c38c037b37c4adc99df01da571031a5",
              "versionType": "git"
            },
            {
              "lessThan": "ae25cf2ea9ebd06d7ad416647dbdc7b5d0172946",
              "status": "affected",
              "version": "d98dfad35c38c037b37c4adc99df01da571031a5",
              "versionType": "git"
            },
            {
              "lessThan": "eb3cd9bb590460c6127145cb245be925d23f5232",
              "status": "affected",
              "version": "d98dfad35c38c037b37c4adc99df01da571031a5",
              "versionType": "git"
            },
            {
              "lessThan": "64fa9328948ddcc0f7f3c23ea1756c126d9dffac",
              "status": "affected",
              "version": "d98dfad35c38c037b37c4adc99df01da571031a5",
              "versionType": "git"
            },
            {
              "lessThan": "a7232f68c43ca62f545049b7f5fbfc75137b843b",
              "status": "affected",
              "version": "d98dfad35c38c037b37c4adc99df01da571031a5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/pmbus/adm1266.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors\n\nadm1266_gpio_get() and adm1266_gpio_get_multiple() both compose the\npin-status word as\n\n\tpins_status = read_buf[0] + (read_buf[1] \u003c\u003c 8);\n\nright after i2c_smbus_read_block_data(), guarding only against an\nerror return.  A well-behaved device returns 2 bytes for\nGPIO_STATUS/PDIO_STATUS, but the helper happily reports a 0- or\n1-byte response too.  If the device returns 0 bytes, both read_buf\nslots are uninitialized stack memory; if it returns 1 byte, read_buf[1]\nis.\n\nThe composed value then flows through set_bit() into the caller\u0027s\n*bits in adm1266_gpio_get_multiple(), or into the return value of\nadm1266_gpio_get(), and ends up in userspace via gpiolib (sysfs and\nthe char-dev ioctls).  That leaks a few bits of kernel stack per\nrequest on any device whose firmware glitch, bus error, or hostile\nslave produces a short block-read response.\n\nAdd the missing length check to both call sites and surface a short\nresponse as -EIO."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T15:39:54.756Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fd9196aad9e5a3845cea17de3405ebc700382142"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee4799becf7d2af3778007e22c2e55c4009a49c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c603b6c6840ac0c6285f5eefea0de6242710af21"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2d1c819348b36fccbbfcf37c5fa7a50a9b4528f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae25cf2ea9ebd06d7ad416647dbdc7b5d0172946"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb3cd9bb590460c6127145cb245be925d23f5232"
        },
        {
          "url": "https://git.kernel.org/stable/c/64fa9328948ddcc0f7f3c23ea1756c126d9dffac"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7232f68c43ca62f545049b7f5fbfc75137b843b"
        }
      ],
      "title": "hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64083",
    "datePublished": "2026-07-19T15:39:54.756Z",
    "dateReserved": "2026-07-19T07:54:57.031Z",
    "dateUpdated": "2026-07-19T15:39:54.756Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5821f9dbb8b5b24391850a13418e633edd0fb003",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "d684f4134998085702009b94c35c2003fc9e72d3",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "52af1975f0dfae990c5a0e85872cc41be0e88a68",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "901891513951bc8322ece754863909ea45af95c6",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "145f820dcbb2cced374f2532f8a61a44dce4a615",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix change notify replay double-free\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_notify_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious SMB server can return a replayable response and then force reconnect failure over the network, causing the client to free stale response state twice.\nAC:L - The peer controls both prerequisites by returning a status such as STATUS_RETRY and then disconnecting or refusing reconnection; repeated attempts make the scheduling window attacker-controllable.\nPR:N - The malicious SMB peer requires no account, capability, or other privilege on the vulnerable client; the established client session does not grant the attacker privileges on that host.\nUI:N - An ordinary automated CIFS workload can maintain an outstanding change-notify request, after which the remote peer completes the trigger without human involvement.\nS:U - Exploitation compromises the kernel and resources governed by the same host security authority, without crossing a separate virtualization or sandbox boundary.\nC:H - The double-free corrupts the CIFS response-buffer slab or mempool, permitting overlapping live objects and freelist manipulation that can support disclosure of arbitrary kernel memory.\nI:H - The heap corruption can provide attacker-influenced writes through aliased request and response buffers or freelist poisoning, potentially enabling kernel control-flow hijacking.\nA:H - Hardened allocators can immediately panic on the consecutive double-free, while unhardened allocators can crash later through freelist corruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:36.154Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5821f9dbb8b5b24391850a13418e633edd0fb003"
        },
        {
          "url": "https://git.kernel.org/stable/c/d684f4134998085702009b94c35c2003fc9e72d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/52af1975f0dfae990c5a0e85872cc41be0e88a68"
        },
        {
          "url": "https://git.kernel.org/stable/c/901891513951bc8322ece754863909ea45af95c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/145f820dcbb2cced374f2532f8a61a44dce4a615"
        }
      ],
      "title": "smb: client: fix change notify replay double-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64384",
    "datePublished": "2026-07-25T08:50:33.306Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:36.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "034b7fa1f5846d69eb51f12ce6d1c71871e83c2d",
              "status": "affected",
              "version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
              "versionType": "git"
            },
            {
              "lessThan": "42272b0f239f3a89f9c26a01cc37aee06138b1b7",
              "status": "affected",
              "version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
              "versionType": "git"
            },
            {
              "lessThan": "940950d5cd86f250dca578279ad5ca63b4e0986b",
              "status": "affected",
              "version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
              "versionType": "git"
            },
            {
              "lessThan": "6f4be73880302d5642c83a0813fdfe1f5fd4b6e3",
              "status": "affected",
              "version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
              "versionType": "git"
            },
            {
              "lessThan": "32b9f89ed9e6d7a45075d64089c254a7f6e13695",
              "status": "affected",
              "version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
              "versionType": "git"
            },
            {
              "lessThan": "ec9daa8fd1b6f45545c9839dca55bd867fad9e13",
              "status": "affected",
              "version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
              "versionType": "git"
            },
            {
              "lessThan": "43cfb20d62ffe49626d62beecfc32eb6f262191c",
              "status": "affected",
              "version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
              "versionType": "git"
            },
            {
              "lessThan": "52f2f7c30126037975389aa04d24c506a5177c35",
              "status": "affected",
              "version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Fix use-after-free on vendor module reload\n\nmmu_destroy_caches() destroys pte_list_desc_cache and\nmmu_page_header_cache, but leaves both pointers unchanged.  The pointers\nlive in kvm.ko, and therefore survive when a vendor module is unloaded\nwhile kvm.ko remains loaded.\n\nIf creation of pte_list_desc_cache fails during a subsequent vendor\nmodule load, its assignment sets pte_list_desc_cache to NULL and the\nerror path calls mmu_destroy_caches().  mmu_page_header_cache still\npoints to the cache destroyed during the preceding vendor module\nunload.  Passing that stale pointer to kmem_cache_destroy() causes a\nslab use-after-free.\n\nReproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y,\nCONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m.  A\none-shot test hook forces pte_list_desc_cache to NULL on the second\ninvocation of kvm_mmu_vendor_module_init():\n\n  1. Load kvm.ko and kvm-intel.ko, creating both caches.\n  2. Unload only kvm_intel, leaving kvm.ko loaded.\n  3. Reload kvm_intel and force initialization through the -ENOMEM path.\n\nKASAN reports:\n\n  BUG: KASAN: slab-use-after-free in\n  kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]\n  ...\n  kmem_cache_destroy+0x21/0x1d0\n  kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]\n  ...\n  Allocated by task 16817:\n  __kmem_cache_create_args+0x12c/0x3b0\n  __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm]\n  kvm_mmu_vendor_module_init+0x13b/0x170 [kvm]\n  ...\n  Freed by task 16820:\n  kmem_cache_destroy+0x117/0x1d0\n  kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]\n\nClear both pointers immediately after destroying their caches so that\nthe stored state reflects the caches\u0027 lifetime and repeated cleanup is\nsafe.\n\nWith the fix applied, the same injected vendor module reload fails with\n-ENOMEM as expected and produces no KASAN report."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:25.214Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/034b7fa1f5846d69eb51f12ce6d1c71871e83c2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/42272b0f239f3a89f9c26a01cc37aee06138b1b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/940950d5cd86f250dca578279ad5ca63b4e0986b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f4be73880302d5642c83a0813fdfe1f5fd4b6e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/32b9f89ed9e6d7a45075d64089c254a7f6e13695"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec9daa8fd1b6f45545c9839dca55bd867fad9e13"
        },
        {
          "url": "https://git.kernel.org/stable/c/43cfb20d62ffe49626d62beecfc32eb6f262191c"
        },
        {
          "url": "https://git.kernel.org/stable/c/52f2f7c30126037975389aa04d24c506a5177c35"
        }
      ],
      "title": "KVM: x86/mmu: Fix use-after-free on vendor module reload",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68428",
    "datePublished": "2026-08-10T12:04:48.905Z",
    "dateReserved": "2026-07-30T09:28:09.393Z",
    "dateUpdated": "2026-08-19T16:35:25.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a713b72ff88cdab4d5d692908ab1259ada511f4d",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            },
            {
              "lessThan": "25484c39d1ec82a0368798d956da3de5039b3fe8",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            },
            {
              "lessThan": "059525cf18e69a9313baf947d8898c6ee7ca6b65",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            },
            {
              "lessThan": "c79f8503d83d4665be461fb9e45e215d0380c67b",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            },
            {
              "lessThan": "a1aa9ef47c299c5bbc30594d3c2f0589edf908e6",
              "status": "affected",
              "version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stale offload-\u003eprog pointer after constant blinding\n\nWhen a dev-bound-only BPF program (BPF_F_XDP_DEV_BOUND_ONLY) undergoes\nJIT compilation with constant blinding enabled (bpf_jit_harden \u003e= 2),\nbpf_jit_blind_constants() clones the program. The original prog is then\nfreed in bpf_jit_prog_release_other(), which updates aux-\u003eprog to point\nto the surviving clone, but fails to update offload-\u003eprog.\n\nThis leaves offload-\u003eprog pointing to the freed original program. When\nthe network namespace is subsequently destroyed, cleanup_net() triggers\nbpf_dev_bound_netdev_unregister(), which iterates ondev-\u003eprogs and calls\n__bpf_prog_offload_destroy(offload-\u003eprog). Accessing the freed prog\ncauses a page fault:\n\nBUG: unable to handle page fault for address: ffffc900085f1038\nWorkqueue: netns cleanup_net\nRIP: 0010:__bpf_prog_offload_destroy+0xc/0x80\nCall Trace:\n__bpf_offload_dev_netdev_unregister+0x257/0x350\nbpf_dev_bound_netdev_unregister+0x4a/0x90\nunregister_netdevice_many_notify+0x2a2/0x660\n...\ncleanup_net+0x21a/0x320\n\nThe test sequence that triggers this reliably is:\n\n1. Set net.core.bpf_jit_harden=2 (echo 2 \u003e /proc/sys/net/core/bpf_jit_harden)\n2. Run xdp_metadata selftest, which creates a dev-bound-only XDP\n   program on a veth inside a netns (./test_progs -t xdp_metadata)\n3. cleanup_net -\u003e page fault in __bpf_prog_offload_destroy\n\nDev-bound-only programs are unique in that they have an offload structure\nbut go through the normal JIT path instead of bpf_prog_offload_compile().\nThis means they are subject to constant blinding\u0027s prog clone-and-replace,\nwhile also having offload-\u003eprog that must stay in sync.\n\nFix this by updating offload-\u003eprog in bpf_jit_prog_release_other(),\nalongside the existing aux-\u003eprog update. Both are back-pointers to\nthe prog that must be kept in sync when the prog is replaced."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local `bpf(BPF_PROG_LOAD)` and netlink/netns operations used to create and tear down a device-bound XDP program, not by remote packets.\nAC:L - Once the target has BPF JIT hardening set to blind constants for all users, the trigger is deterministic: load a dev-bound-only XDP program with constants, then unregister the device or destroy the netns. There is no attacker-uncontrolled race to win.\nPR:L - XDP program loading requires BPF and NET_ADMIN privileges, but these can be available in user-namespace/container deployments through BPF token delegation and namespaced capabilities. Under the required rule, this is scored as Low rather than High.\nUI:N - No victim action is required after the attacker has local execution; the attacker can perform the BPF load and netdevice/netns teardown directly.\nS:U - The bug corrupts/dereferences kernel memory within the same kernel security authority. This is standard local kernel compromise/DoS rather than a VM or hardware isolation boundary escape.\nC:H - The stale `offload-\u003eprog` is a use-after-free of a `struct bpf_prog`; if reclaimed, the cleanup path trusts attacker-shaped pointers and can be developed into kernel memory disclosure primitives. Kernel UAFs are scored High for confidentiality.\nI:H - The same UAF can drive trusted list/free/write operations through forged `prog-\u003eaux` and `offload` pointers, making arbitrary kernel memory corruption or code execution plausible. Kernel UAFs are scored High for integrity.\nA:H - The upstream report shows a reliable kernel page fault during `cleanup_net()`/netdevice unregister when the stale pointer is dereferenced. This is a kernel crash availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:20.910Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a713b72ff88cdab4d5d692908ab1259ada511f4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/25484c39d1ec82a0368798d956da3de5039b3fe8"
        },
        {
          "url": "https://git.kernel.org/stable/c/059525cf18e69a9313baf947d8898c6ee7ca6b65"
        },
        {
          "url": "https://git.kernel.org/stable/c/c79f8503d83d4665be461fb9e45e215d0380c67b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1aa9ef47c299c5bbc30594d3c2f0589edf908e6"
        }
      ],
      "title": "bpf: Fix stale offload-\u003eprog pointer after constant blinding",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53094",
    "datePublished": "2026-06-24T16:30:32.815Z",
    "dateReserved": "2026-06-09T07:44:35.384Z",
    "dateUpdated": "2026-08-05T12:33:20.910Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1f9156714592356b4fda57beac7eab9c2a462dd3",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "5630da218a45ba80f0aba0846cbe8aa655da122b",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "1ca605cfa59377f0143fb35b5b01360f37d1b7c4",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "0e4a5a000123d81234e27a2f8187688cf608f755",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "e6aa539720c3d8def69683ed0c07cf9faea4e8be",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "be353caffa8640f5e25fb3714ce8b0cef5e410e5",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "65a1c2551f7e16085acbb54aedde1feaa559ba7a",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "b5befa80fdbe287a98480effed9564712924add5",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: re-lock request before returning from fuse_ref_folio()\n\nfuse_ref_folio() unlocks the request but does not re-lock it before\nreturning. fuse_chan_abort() can end the request and the async end\ncallback (eg fuse_writepage_free()) can free the args while the\nsubsequent copy chain logic after fuse_ref_folio() accesses them,\nleading to use-after-free issues.\n\nFix this by locking the request in fuse_ref_folio() before returning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A local attacker reaches the flaw by serving a self-created FUSE mount and invoking splice() on its associated /dev/fuse descriptor.\nAC:L - The attacker controls writeback generation, splice processing, and concurrent connection abort, allowing repeated attempts at the race without an uncontrollable prerequisite.\nPR:L - FUSE supports user-namespace mounts, and an unprivileged mount owner can operate /dev/fuse and abort their own connection without init-namespace root.\nUI:N - The attacker can create and exercise their own FUSE connection without any victim action.\nS:U - Exploitation compromises the kernel within the same operating-system security authority and does not inherently cross a virtualization boundary.\nC:H - The freed argument and folio arrays are subsequently dereferenced, permitting attacker-influenced stale folio pointers and potential arbitrary kernel-memory disclosure through pipe buffers.\nI:H - Heap reclamation can replace the freed folio pointers and loop metadata, enabling attacker-directed memory or refcount operations that may support arbitrary writes and kernel code execution.\nA:H - The repeatable use-after-free and invalid folio operations can cause an oops, panic, or other complete system failure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:20.108Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1f9156714592356b4fda57beac7eab9c2a462dd3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5630da218a45ba80f0aba0846cbe8aa655da122b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ca605cfa59377f0143fb35b5b01360f37d1b7c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e4a5a000123d81234e27a2f8187688cf608f755"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6aa539720c3d8def69683ed0c07cf9faea4e8be"
        },
        {
          "url": "https://git.kernel.org/stable/c/be353caffa8640f5e25fb3714ce8b0cef5e410e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/65a1c2551f7e16085acbb54aedde1feaa559ba7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5befa80fdbe287a98480effed9564712924add5"
        }
      ],
      "title": "fuse: re-lock request before returning from fuse_ref_folio()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64266",
    "datePublished": "2026-07-25T08:49:15.142Z",
    "dateReserved": "2026-07-19T15:36:31.775Z",
    "dateUpdated": "2026-08-17T04:52:20.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a31b6d18ded3cc32d9ee85a6ff0726d4274887b2",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "595e6537ad1a210da32cbb9a7f91aa73090915ba",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "b2e26c955f8dd7e8d3f16c858db05245ea4fa817",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "6bc89f34a4597f9f6d41f7a60c67a3153bfe8851",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "423a78ff7928c2601013f73ec6d896f5597d0df5",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "75c93cd3c421890f49ea93f0b978b9b7bb10e5e3",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "7d29f7e9dbd844cae4d3e559cf78324b9642fd6b",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: bound Read Response placement to the RREAD length\n\nIn drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each\ninbound Read Response DDP segment at sge-\u003eladdr + wqe-\u003eprocessed and then\naccumulates wqe-\u003eprocessed, but it never checks the running total against\nthe sink buffer length on continuation segments. siw_check_sge() resolves\nand validates the sink memory only on the first fragment (the if (!*mem)\nbranch), and siw_rresp_check_ntoh() compares the cumulative length against\nwqe-\u003ebytes only on the final segment (the !frx-\u003emore_ddp_segs guard).\n\nA connected siw peer that answers an outstanding RREAD with Read Response\nsegments that keep the DDP Last flag clear, carrying more total payload\nthan the RREAD requested, drives wqe-\u003eprocessed past the validated sink\nbuffer; the next siw_rx_data() call writes out of bounds at\nsge-\u003eladdr + wqe-\u003eprocessed. siw runs iWARP over ordinary routable TCP,\nso the peer is the remote end of an established RDMA connection and needs\nno local privilege.\n\nBound every segment before placement, exactly as siw_proc_send() and\nsiw_proc_write() already do for their tagged and untagged paths, and\nterminate the connection with a base-or-bounds DDP error when the\nRead Response would overrun the sink buffer.\n\nThis is the second receive-path length fix for this file. A separate\nchange rejects an MPA FPDU length that underflows the per-fragment\nremainder in the header decode; that guard does not cover this case,\nbecause here each individual segment length is self-consistent and only\nthe accumulated placement offset overruns the buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - siw carries iWARP over ordinary routable TCP, and the vulnerable receive callback processes crafted Read Response FPDUs from the remote endpoint of an established RDMA connection.\nAC:L - The peer learns the sink tag, address, and length from the RREAD and can deterministically send oversized continuation segments; no race or uncontrollable condition is required.\nPR:N - The MPA/siw data path performs no credential or capability check on the connected peer, and an unauthenticated RDMA service can accept the connection and issue attacker-induced RREADs.\nUI:N - The overflow is triggered through an automated RDMA protocol exchange and requires no human action.\nS:U - The corruption compromises resources within the affected host\u0027s kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The global DMA/KVA sink case exposes the sink address and permits attacker-controlled kernel memory corruption, which can enable control-flow hijacking and arbitrary kernel-memory disclosure.\nI:H - Attacker-chosen response bytes are written beyond the validated sink into adjacent kernel memory, providing an exploitable out-of-bounds write capable of modifying objects or achieving kernel code execution.\nA:H - The overwrite can corrupt critical kernel objects or reach invalid memory, causing an oops or panic; bounded FRWR sinks still permit connection-terminating denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:22.293Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851"
        },
        {
          "url": "https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5"
        },
        {
          "url": "https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b"
        }
      ],
      "title": "RDMA/siw: bound Read Response placement to the RREAD length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64268",
    "datePublished": "2026-07-25T08:49:16.336Z",
    "dateReserved": "2026-07-19T15:36:31.775Z",
    "dateUpdated": "2026-08-17T04:52:22.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1014b279264c0fc9f56324608754e36d33b7b5ae",
              "status": "affected",
              "version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0",
              "versionType": "git"
            },
            {
              "lessThan": "c18d46d9830c29677be5213a067daafe1ac80e43",
              "status": "affected",
              "version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0",
              "versionType": "git"
            },
            {
              "lessThan": "347bc3a6a4d968c403d2292e5ad986294d919dfc",
              "status": "affected",
              "version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0",
              "versionType": "git"
            },
            {
              "lessThan": "c0384d6872f4dc2701960048a0be1a12a8d2dc6e",
              "status": "affected",
              "version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0",
              "versionType": "git"
            },
            {
              "lessThan": "1f9c6b74e79639179e90ad0c0fbeae26e31e044b",
              "status": "affected",
              "version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0",
              "versionType": "git"
            },
            {
              "lessThan": "2d8b08844c0ecc6f2002fa68711e779aa18c8585",
              "status": "affected",
              "version": "e19233955d9e9a9ae202723b9a38ef38e755b5c0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()\n\nThe deprecated UNIVERSAL_DEV_PM_OPS() macro uses the provided callbacks\nfor both runtime PM and system sleep. This causes the DSI clocks to be\ndisabled twice: once during runtime suspend and again during system\nsuspend, resulting in a WARN message from the clock framework when\nattempting to disable already-disabled clocks.\n\n[   84.384540] clk:231:5 already disabled\n[   84.388314] WARNING: CPU: 2 PID: 531 at /drivers/clk/clk.c:1181 clk_core_disable+0xa4/0xac\n...\n[   84.579183] Call trace:\n[   84.581624]  clk_core_disable+0xa4/0xac\n[   84.585457]  clk_disable+0x30/0x4c\n[   84.588857]  cdns_dsi_suspend+0x20/0x58 [cdns_dsi]\n[   84.593651]  pm_generic_suspend+0x2c/0x44\n[   84.597661]  ti_sci_pd_suspend+0xbc/0x15c\n[   84.601670]  dpm_run_callback+0x8c/0x14c\n[   84.605588]  __device_suspend+0x1a0/0x56c\n[   84.609594]  dpm_suspend+0x17c/0x21c\n[   84.613165]  dpm_suspend_start+0xa0/0xa8\n[   84.617083]  suspend_devices_and_enter+0x12c/0x634\n[   84.621872]  pm_suspend+0x1fc/0x368\n\nTo address this issue, replace UNIVERSAL_DEV_PM_OPS() with\nRUNTIME_PM_OPS(). Bridge and panel drivers should only deal with runtime\nPM, as the DRM framework manages system-wide power transitions through\nthe bridge enable() and disable() hooks."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:17.699Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1014b279264c0fc9f56324608754e36d33b7b5ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/c18d46d9830c29677be5213a067daafe1ac80e43"
        },
        {
          "url": "https://git.kernel.org/stable/c/347bc3a6a4d968c403d2292e5ad986294d919dfc"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0384d6872f4dc2701960048a0be1a12a8d2dc6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f9c6b74e79639179e90ad0c0fbeae26e31e044b"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d8b08844c0ecc6f2002fa68711e779aa18c8585"
        }
      ],
      "title": "drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68280",
    "datePublished": "2026-08-10T12:02:11.434Z",
    "dateReserved": "2026-07-30T09:28:09.379Z",
    "dateUpdated": "2026-08-23T12:46:17.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/display/drm_dp_mst_topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "185de1d74e658e2edb723ba76fa61903f77d8a68",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "d7b9b1e33b4ed8c48d4db6e6e21c257ebbbb2586",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "c2fbda0fe0163c55ba3820ee6cea0c6b43622eda",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "22d9f7fc1aaabaf73d5f30e8b0c9aa814ecd6ed2",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "04d953f50d61e542e94a5977822cc53735f8c0ce",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "533d9e2bede4aeefdc2a0561d7071cfede95958f",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "e6ef5455b06cb4e5d181aabcd723791587c79f12",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            },
            {
              "lessThan": "1a8f537f5a1eeac941f262fe73078d6b08ba83c0",
              "status": "affected",
              "version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/display/drm_dp_mst_topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers\n\ndrm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw\nmessage and then unconditionally does:\n\n  memcpy(bytes, \u0026raw-\u003emsg[idx], num_bytes);\n\nwithout checking that idx + num_bytes \u003c= raw-\u003ecurlen. raw-\u003emsg[] is\n256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger\nthan the remaining payload, the memcpy reads past the received data\ninto whatever follows in raw-\u003emsg[].\n\ndrm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted\nwith a /* TODO check */ comment since the code was introduced).\n\nFix both functions by using a single combined check\n(idx + num_bytes \u003e curlen) before each memcpy. Since num_bytes is u8,\nit is always \u003e= 0, so this strictly subsumes the simpler idx \u003e curlen\nform and no separate step is needed.\n\n[added missing fixes tag]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:16.563Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/185de1d74e658e2edb723ba76fa61903f77d8a68"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7b9b1e33b4ed8c48d4db6e6e21c257ebbbb2586"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2fbda0fe0163c55ba3820ee6cea0c6b43622eda"
        },
        {
          "url": "https://git.kernel.org/stable/c/22d9f7fc1aaabaf73d5f30e8b0c9aa814ecd6ed2"
        },
        {
          "url": "https://git.kernel.org/stable/c/04d953f50d61e542e94a5977822cc53735f8c0ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/533d9e2bede4aeefdc2a0561d7071cfede95958f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6ef5455b06cb4e5d181aabcd723791587c79f12"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a8f537f5a1eeac941f262fe73078d6b08ba83c0"
        }
      ],
      "title": "drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68279",
    "datePublished": "2026-08-10T12:02:09.423Z",
    "dateReserved": "2026-07-30T09:28:09.379Z",
    "dateUpdated": "2026-08-23T12:46:16.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "73963a375885d5ccb7def39fd0b4f542e0f343dd",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "47110c3a9ac247b688657337f5981efcfcb240dc",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "84158c2997159df4a0d70cd9c46774512d32a522",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "131ef12057d92b77b636321b7849c69222405a97",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "66339b71f105e6f83e0da3b9583d95077534fe1d",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "eca989eab4b2599dcb02f72140a7c08f08838520",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "2fb0dc7e0099686c4e9d2732745d8a31b18c3628",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "lessThan": "285943c6e7ca309bbea84b253745154241d9788a",
              "status": "affected",
              "version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d529d6c9f7e3aaeac13c4948f79799ccb825f29d",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring\n\nWhen an sk_msg scatterlist ring wraps (sg.end \u003c sg.start),\ntls_push_record() chains the tail portion of the ring to the head\nusing sg_chain(). An extra entry in the sg array is reserved for\nthis:\n\n  struct sk_msg_sg {\n        [...]\n        /* The extra two elements:\n         * 1) used for chaining the front and sections when the list becomes\n         *    partitioned (e.g. end \u003c start). The crypto APIs require the\n         *    chaining;\n         * 2) to chain tailer SG entries after the message.\n         */\n        struct scatterlist              data[MAX_MSG_FRAGS + 2];\n\nThe current code uses MAX_SKB_FRAGS + 1 as the ring size:\n\n    sg_chain(\u0026msg_pl-\u003esg.data[msg_pl-\u003esg.start],\n             MAX_SKB_FRAGS - msg_pl-\u003esg.start + 1,\n             msg_pl-\u003esg.data);\n\nThis places the chain pointer at\n\n  sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. =\n  \u0026data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 =\n  data[start + (MAX_SKB_FRAGS - start + 1) - 1] =\n  data[MAX_SKB_FRAGS]\n\ninstead of the true last entry. This is likely due to a \"race\" of\nthe commit under Fixes landing close to\ncommit 031097d9e079 (\"bpf: sk_msg, zap ingress queue on psock down\")\n\nConvert to ARRAY_SIZE and drop the data[start] / - start (as suggested\nby Sabrina)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in kernel TLS (kTLS) software transmit encryption triggered when a TLS socket sends records; remote peers on established TLS connections drive this TX path through normal network I/O.\nAC:L - An attacker who controls connection traffic can reliably create the wrapped sk_msg ring state via BPF sockmap SK_MSG verdict helpers (push/pop/redirect) and then trigger record push on demand.\nPR:N - Exploitation requires no privileges on the target host beyond being a network peer on a kTLS socket with sockmap BPF already configured by the service; attacker capabilities are not needed on the victim system.\nUI:N - Triggering requires only automated server-side TLS transmit activity in response to network input, with no victim user action.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same kernel/host security boundary, not a cross-VM or sandbox escape by itself.\nC:H - Corrupting an active scatterlist entry causes the AEAD crypto path to follow an incorrect chain, enabling out-of-bounds kernel memory reads beyond intended plaintext buffers.\nI:H - The malformed scatterlist passed to crypto_aead_encrypt() can direct encryption I/O to wrong memory regions, providing an out-of-bounds write primitive exploitable for control-flow hijacking.\nA:H - Scatterlist corruption in the kernel crypto TX path can cause kernel oopses, panics, or fatal BUG conditions when invalid chain entries or page pointers are dereferenced."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:39.300Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/73963a375885d5ccb7def39fd0b4f542e0f343dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/47110c3a9ac247b688657337f5981efcfcb240dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/84158c2997159df4a0d70cd9c46774512d32a522"
        },
        {
          "url": "https://git.kernel.org/stable/c/131ef12057d92b77b636321b7849c69222405a97"
        },
        {
          "url": "https://git.kernel.org/stable/c/66339b71f105e6f83e0da3b9583d95077534fe1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/eca989eab4b2599dcb02f72140a7c08f08838520"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fb0dc7e0099686c4e9d2732745d8a31b18c3628"
        },
        {
          "url": "https://git.kernel.org/stable/c/285943c6e7ca309bbea84b253745154241d9788a"
        }
      ],
      "title": "net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64047",
    "datePublished": "2026-07-19T15:39:31.960Z",
    "dateReserved": "2026-07-19T07:54:57.029Z",
    "dateUpdated": "2026-08-05T12:38:39.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/bpa10x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1813add71e386f77b3040e6c8dc9b7b3ff965a6c",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "bd56c23f1f8681a2857ee924a8bd3abf87c8913b",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "7a64f39ebe1bacd9004a62eceadac0b122ec3cc2",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "f80b4afe893dffa9fabdbf80fb4d6782b24a6793",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "4b4008dda1d0c6e598d7865631ad4eda63a560f0",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "bfc9e7be289df11e8e38c98cd78019d67fdd0bd5",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "a8e169d308775039200bb9c905c7ce420db6e8c5",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "dd068ef044128db655f48323a4acfd5907e04903",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/bpa10x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()\n\nbpa10x_setup() sends the vendor command 0xfc0e and passes the response\nto bt_dev_info() and hci_set_fw_info() as a \"%s\" string starting at\nskb-\u003edata + 1, without checking the length:\n\n\tbt_dev_info(hdev, \"%s\", (char *)(skb-\u003edata + 1));\n\thci_set_fw_info(hdev, \"%s\", skb-\u003edata + 1);\n\nA device that returns a one-byte response (status only) leaves\nskb-\u003edata + 1 past the end of the data, and the %s walk reads adjacent\nslab memory until it meets a NUL. The same happens when the payload is\nnot NUL-terminated within skb-\u003elen. The out-of-bounds bytes end up in\nthe kernel log and the firmware-info debugfs file.\n\nPrint the revision string with a bounded \"%.*s\" limited to skb-\u003elen - 1\ninstead. This keeps the string readable for well-behaved devices while\nnever reading past the received data, and does not fail setup, so a\ndevice returning a short or unterminated response keeps working."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:26.570Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1813add71e386f77b3040e6c8dc9b7b3ff965a6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd56c23f1f8681a2857ee924a8bd3abf87c8913b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a64f39ebe1bacd9004a62eceadac0b122ec3cc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/f80b4afe893dffa9fabdbf80fb4d6782b24a6793"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b4008dda1d0c6e598d7865631ad4eda63a560f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfc9e7be289df11e8e38c98cd78019d67fdd0bd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8e169d308775039200bb9c905c7ce420db6e8c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd068ef044128db655f48323a4acfd5907e04903"
        }
      ],
      "title": "Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64549",
    "datePublished": "2026-07-27T20:10:38.894Z",
    "dateReserved": "2026-07-19T15:36:31.795Z",
    "dateUpdated": "2026-08-17T04:57:26.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a5de36d6cee74a92c1a21b260bc507e64bc451de",
              "status": "affected",
              "version": "f87e62d45e51b12d48d2cb46b5cde8f83b866bc4",
              "versionType": "git"
            },
            {
              "lessThan": "854cd32bc74fe573353095e90958490e4e4d641b",
              "status": "affected",
              "version": "f87e62d45e51b12d48d2cb46b5cde8f83b866bc4",
              "versionType": "git"
            },
            {
              "lessThan": "17153f154f80be2b47ebf52840f2d8f724eb2f3b",
              "status": "affected",
              "version": "f87e62d45e51b12d48d2cb46b5cde8f83b866bc4",
              "versionType": "git"
            },
            {
              "lessThan": "7bb09315f93dce6acc54bf59e5a95ba7365c2be4",
              "status": "affected",
              "version": "f87e62d45e51b12d48d2cb46b5cde8f83b866bc4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: Fix race condition in tls_sw_cancel_work_tx()\n\nThis issue was discovered during a code audit.\n\nAfter cancel_delayed_work_sync() is called from tls_sk_proto_close(),\ntx_work_handler() can still be scheduled from paths such as the\nDelayed ACK handler or ksoftirqd.\nAs a result, the tx_work_handler() worker may dereference a freed\nTLS object.\n\nThe following is a simple race scenario:\n\n          cpu0                         cpu1\n\ntls_sk_proto_close()\n  tls_sw_cancel_work_tx()\n                                 tls_write_space()\n                                   tls_sw_write_space()\n                                     if (!test_and_set_bit(BIT_TX_SCHEDULED, \u0026tx_ctx-\u003etx_bitmask))\n    set_bit(BIT_TX_SCHEDULED, \u0026ctx-\u003etx_bitmask);\n    cancel_delayed_work_sync(\u0026ctx-\u003etx_work.work);\n                                     schedule_delayed_work(\u0026tx_ctx-\u003etx_work.work, 0);\n\nTo prevent this race condition, cancel_delayed_work_sync() is\nreplaced with disable_delayed_work_sync()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The tls_write_space callback is triggered by a remote TCP peer sending ACKs, which causes tcp_data_snd_check \u2192 tcp_check_space \u2192 tcp_new_space \u2192 sk-\u003esk_write_space (tls_write_space). Any server using kTLS (nginx, HAProxy, NFS with TLS) is reachable over the network.\nAC:L - The attacker controls both sides of the race: they send TCP ACKs to trigger tls_write_space and initiate disconnect to trigger the close path. With repeated connection attempts and ACK flooding, the race window is reliably winnable.\nPR:N - No authentication or privileges are needed to establish a TCP connection and send ACKs to a kTLS-enabled server. The race is triggered during normal TCP processing before any application-level authentication occurs.\nUI:N - No user interaction is needed. The attacker connects to the server, sends ACKs, and disconnects to trigger the race. The server processes this automatically.\nS:U - The vulnerability results in kernel-level use-after-free within the same security authority (kernel space). There is no crossing of a virtualization or sandbox boundary.\nC:H - This is a use-after-free where the freed tls_sw_context_tx (freed via immediate kfree, not kfree_rcu) can be reallocated with attacker-influenced data. The UAF gives read access to reallocated memory contents, enabling arbitrary kernel memory disclosure.\nI:H - The UAF on the tls_sw_context_tx structure enables heap spraying to control the freed object\u0027s contents. The tx_work_handler then calls tls_tx_records through corrupted context pointers, enabling control flow hijacking and arbitrary code execution.\nA:H - The use-after-free on the embedded delayed_work struct causes kernel crashes when the workqueue attempts to execute the freed work item, resulting in kernel panic or oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:50.947Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a5de36d6cee74a92c1a21b260bc507e64bc451de"
        },
        {
          "url": "https://git.kernel.org/stable/c/854cd32bc74fe573353095e90958490e4e4d641b"
        },
        {
          "url": "https://git.kernel.org/stable/c/17153f154f80be2b47ebf52840f2d8f724eb2f3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bb09315f93dce6acc54bf59e5a95ba7365c2be4"
        }
      ],
      "title": "tls: Fix race condition in tls_sw_cancel_work_tx()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23240",
    "datePublished": "2026-03-10T17:28:27.371Z",
    "dateReserved": "2026-01-13T15:37:45.989Z",
    "dateUpdated": "2026-08-05T12:20:50.947Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/hsr/hsr_forward.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "09a37dca090c55ffb1a33f52d8667f1c2367ef48",
              "status": "affected",
              "version": "eafaa88b3eb7f28aecb222281655473431d3ef2e",
              "versionType": "git"
            },
            {
              "lessThan": "a4b64f3e9c7b8259f7dd251a0313420ba7c01852",
              "status": "affected",
              "version": "eafaa88b3eb7f28aecb222281655473431d3ef2e",
              "versionType": "git"
            },
            {
              "lessThan": "71c986c0ba45b7dc574fae27c83e7b6671556f37",
              "status": "affected",
              "version": "eafaa88b3eb7f28aecb222281655473431d3ef2e",
              "versionType": "git"
            },
            {
              "lessThan": "fbd0662f9c9a66e8cc3df3099cca8ed6d3837cc7",
              "status": "affected",
              "version": "eafaa88b3eb7f28aecb222281655473431d3ef2e",
              "versionType": "git"
            },
            {
              "lessThan": "78607a6854a22a2502f68092202e75a39af4865d",
              "status": "affected",
              "version": "eafaa88b3eb7f28aecb222281655473431d3ef2e",
              "versionType": "git"
            },
            {
              "lessThan": "f229426072fc865654a60978bb7fda790a051ff3",
              "status": "affected",
              "version": "eafaa88b3eb7f28aecb222281655473431d3ef2e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/hsr/hsr_forward.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: fix potential OOB access in supervision frame handling\n\nEnsure the entire TLV header is linearized before access by adding\nsizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this,\na truncated frame could cause an out-of-bounds access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is reached when the kernel processes received Ethernet frames via the netdev RX handler in net/hsr, and a remote attacker on the HSR/PRP ring can deliver a crafted supervision frame without any local access to the victim host.\nAC:L - The attacker fully controls the malformed frame content and length; a precisely truncated supervision frame reliably passes existing TLV validation and triggers the out-of-bounds read with no races or attacker-uncontrollable conditions.\nPR:N - Exploitation requires only the ability to inject L2 HSR/PRP supervision frames onto the ring segment; no local account, capabilities, or authentication on the target kernel is needed.\nUI:N - No victim user action is required beyond normal operation of an HSR/PRP-configured node; the attacker triggers the bug solely by sending a malicious frame.\nS:U - Impact is confined to kernel memory safety within the same security authority; there is no VM escape, IOMMU bypass, or cross-security-boundary scope change.\nC:H - The bug is an out-of-bounds read of supervision TLV header fields past the skb tail, which can disclose adjacent kernel heap/skb memory and is not strictly bounded to a few attacker-uncontrolled bytes.\nI:H - Out-of-bounds access in kernel packet parsing can supply attacker-influenced TLV type/length values that drive further skb_pull arithmetic and extended parsing, creating a plausible path to memory corruption and control-flow hijacking.\nA:H - Reading beyond the skb buffer boundary during softirq packet processing can cause a kernel oops/panic, and the attacker can repeatedly trigger the condition with crafted frames."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:01.596Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/09a37dca090c55ffb1a33f52d8667f1c2367ef48"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4b64f3e9c7b8259f7dd251a0313420ba7c01852"
        },
        {
          "url": "https://git.kernel.org/stable/c/71c986c0ba45b7dc574fae27c83e7b6671556f37"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbd0662f9c9a66e8cc3df3099cca8ed6d3837cc7"
        },
        {
          "url": "https://git.kernel.org/stable/c/78607a6854a22a2502f68092202e75a39af4865d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f229426072fc865654a60978bb7fda790a051ff3"
        }
      ],
      "title": "net: hsr: fix potential OOB access in supervision frame handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64000",
    "datePublished": "2026-07-19T14:56:18.116Z",
    "dateReserved": "2026-07-19T07:54:57.026Z",
    "dateUpdated": "2026-08-05T12:38:01.596Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-fsl-lpspi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad370d1c7a9a832f77b2341513cd31188c9443af",
              "status": "affected",
              "version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
              "versionType": "git"
            },
            {
              "lessThan": "cce2063404b2341e7b2bbf85eddfcd70a31a0033",
              "status": "affected",
              "version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
              "versionType": "git"
            },
            {
              "lessThan": "af39a2698f69b584d14a00cffe0f51a2caa15337",
              "status": "affected",
              "version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
              "versionType": "git"
            },
            {
              "lessThan": "e65505d91fa036a238968e4c10744244d1b968c4",
              "status": "affected",
              "version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
              "versionType": "git"
            },
            {
              "lessThan": "d5c1060218a3749c8a18b36f8169d910fce20639",
              "status": "affected",
              "version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
              "versionType": "git"
            },
            {
              "lessThan": "808033d80d5c9f8adf7e8de9317389270ce13430",
              "status": "affected",
              "version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
              "versionType": "git"
            },
            {
              "lessThan": "9d000bdd250d649a11cd7f733175686877344582",
              "status": "affected",
              "version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
              "versionType": "git"
            },
            {
              "lessThan": "01980b5da56e573d62798d0ff6c86bcaa2b22cbe",
              "status": "affected",
              "version": "09c04466ce7ea494993c0635ba5edb6d2222a806",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-fsl-lpspi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: fsl-lpspi: terminate the RX channel on TX prepare failure path\n\nWhen dmaengine_prep_slave_sg() fails for the TX channel, the error path\nterminates the TX DMA channel but leaves the RX channel running. Since\nthe RX channel was already submitted and issued prior to preparing\nthe TX descriptor, returning -EINVAL causes the SPI core to unmap the\nDMA buffers while the RX DMA engine continues writing to them, leading\nto potential memory corruption or use-after-free.\n\nTerminate the RX channel before returning on the TX prepare failure path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - In a reasonable network-facing deployment, an SPI Ethernet controller such as ENC28J60 receives an unauthenticated remote frame, raises its IRQ, and calls spi_sync(), which traverses the SPI core into the vulnerable fsl-lpspi DMA path.\nAC:L - An attacker can repeatedly drive DMA preparation and influence GFP_NOWAIT allocation pressure with packet flooding; once TX preparation fails after RX issuance, subsequent traffic deterministically exercises the stale RX descriptor without a race to win.\nPR:N - The SPI Ethernet receive IRQ path runs before protocol authentication and has no capability, device-node, or namespace privilege check, so a remote sender needs no privileges.\nUI:N - No victim action is needed after the network interface and SPI NIC are configured; attacker traffic alone invokes the affected transfer path.\nS:U - The stale DMA corrupts memory within the same host kernel security authority and does not inherently cross a VM, IOMMU, or other security scope boundary.\nC:H - The active RX DMA descriptor can write device- and packet-influenced data into unmapped, freed, and reallocated kernel memory, yielding memory corruption that can be leveraged for kernel-memory disclosure.\nI:H - The stale DEV_TO_MEM DMA operation provides attacker-influenced writes into freed or reallocated kernel memory, permitting object corruption and potentially control-flow hijacking or arbitrary kernel code execution.\nA:H - Continued DMA into invalid or repurposed memory can cause an IOMMU fault, kernel oops, panic, or hang, and unauthenticated traffic can trigger the condition repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:53:02.185Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad370d1c7a9a832f77b2341513cd31188c9443af"
        },
        {
          "url": "https://git.kernel.org/stable/c/cce2063404b2341e7b2bbf85eddfcd70a31a0033"
        },
        {
          "url": "https://git.kernel.org/stable/c/af39a2698f69b584d14a00cffe0f51a2caa15337"
        },
        {
          "url": "https://git.kernel.org/stable/c/e65505d91fa036a238968e4c10744244d1b968c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5c1060218a3749c8a18b36f8169d910fce20639"
        },
        {
          "url": "https://git.kernel.org/stable/c/808033d80d5c9f8adf7e8de9317389270ce13430"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d000bdd250d649a11cd7f733175686877344582"
        },
        {
          "url": "https://git.kernel.org/stable/c/01980b5da56e573d62798d0ff6c86bcaa2b22cbe"
        }
      ],
      "title": "spi: fsl-lpspi: terminate the RX channel on TX prepare failure path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64303",
    "datePublished": "2026-07-25T08:49:38.223Z",
    "dateReserved": "2026-07-19T15:36:31.779Z",
    "dateUpdated": "2026-08-17T04:53:02.185Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btqca.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7ee11441d71ab036a705d110a415421f5a4a898",
              "status": "affected",
              "version": "ed53949cc92e28aaa3463d246942bda1fbb7f307",
              "versionType": "git"
            },
            {
              "lessThan": "5d34e537755d2f9eba2d4e54d70126f987ef20b4",
              "status": "affected",
              "version": "1caceadfb50432dbf6d808796cb6c34ebb6d662c",
              "versionType": "git"
            },
            {
              "lessThan": "70354dbb5f72d9a76da7b031de3cbaf6c7d8fc24",
              "status": "affected",
              "version": "427281f9498ed614f9aabc80e46ec077c487da6d",
              "versionType": "git"
            },
            {
              "lessThan": "59fd2f075bca94f030c7c78e94878ea0803d7690",
              "status": "affected",
              "version": "2e4edfa1e2bd821a317e7d006517dcf2f3fac68d",
              "versionType": "git"
            },
            {
              "lessThan": "a087ed960fce54e9302796229e9d545bbc9bcd4a",
              "status": "affected",
              "version": "2e4edfa1e2bd821a317e7d006517dcf2f3fac68d",
              "versionType": "git"
            },
            {
              "lessThan": "4fcfb5b2c736785464ff9745f94c6726c5ee2d85",
              "status": "affected",
              "version": "2e4edfa1e2bd821a317e7d006517dcf2f3fac68d",
              "versionType": "git"
            },
            {
              "lessThan": "c90164ca0f7036942ba088eb7ea8d3f6c2352020",
              "status": "affected",
              "version": "2e4edfa1e2bd821a317e7d006517dcf2f3fac68d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "02f05ed44b71152d5e11d29be28aed91c0489b4e",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.216",
              "status": "affected",
              "version": "5.15.159",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.183",
              "status": "affected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.148",
              "status": "affected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/btqca.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.15.159",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "6.1.91",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "6.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: qca: fix NVM tag length underflow in TLV parser\n\nIn the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is\n\"while (idx \u003c length - sizeof(struct tlv_type_nvm))\". \"length\" is a signed\nint from the firmware TLV header and sizeof(struct tlv_type_nvm) is a\nsize_t (12), so \"length\" is converted to size_t and any firmware-supplied\n\"length\" \u003c 12 makes the subtraction wrap to a huge value. The loop body\nthen reads a 12-byte struct tlv_type_nvm past the end of the short\nvmalloc\u0027d firmware buffer (and the EDL_TAG_ID_* handlers can write past it).\n\nRewrite the bound as \"idx + sizeof(struct tlv_type_nvm) \u003c= length\"; both\noperands are non-negative, so it no longer underflows and a \"length\" too\nsmall for one record correctly skips the loop.\n\n  BUG: KASAN: vmalloc-out-of-bounds in qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421)\n  Read of size 2 at addr ffffc900000e5004 by task kworker/u9:0/52\n  Workqueue: hci0 hci_power_on\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421 drivers/bluetooth/btqca.c:617)\n   qca_uart_setup (drivers/bluetooth/btqca.c:948)\n   qca_setup (drivers/bluetooth/hci_qca.c:2029)\n   hci_uart_setup (drivers/bluetooth/hci_ldisc.c:438)\n   hci_dev_open_sync (net/bluetooth/hci_sync.c:5227)\n   hci_power_on (net/bluetooth/hci_core.c:920)\n   process_one_work (kernel/workqueue.c:3322)\n   worker_thread (kernel/workqueue.c:3486)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:52.002Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7ee11441d71ab036a705d110a415421f5a4a898"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d34e537755d2f9eba2d4e54d70126f987ef20b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/70354dbb5f72d9a76da7b031de3cbaf6c7d8fc24"
        },
        {
          "url": "https://git.kernel.org/stable/c/59fd2f075bca94f030c7c78e94878ea0803d7690"
        },
        {
          "url": "https://git.kernel.org/stable/c/a087ed960fce54e9302796229e9d545bbc9bcd4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fcfb5b2c736785464ff9745f94c6726c5ee2d85"
        },
        {
          "url": "https://git.kernel.org/stable/c/c90164ca0f7036942ba088eb7ea8d3f6c2352020"
        }
      ],
      "title": "Bluetooth: qca: fix NVM tag length underflow in TLV parser",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64573",
    "datePublished": "2026-08-05T08:08:09.669Z",
    "dateReserved": "2026-07-19T15:36:31.797Z",
    "dateUpdated": "2026-08-19T16:28:52.002Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c",
            "drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c",
            "drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b0fd6d3bb06182f19f3b59a53f57b5098b99048a",
              "status": "affected",
              "version": "cef35af34d6dc3792333075115c7deb7062b6e18",
              "versionType": "git"
            },
            {
              "lessThan": "24c77044cdfcf5b8b2e9f3b620d8b9aa392d9add",
              "status": "affected",
              "version": "cef35af34d6dc3792333075115c7deb7062b6e18",
              "versionType": "git"
            },
            {
              "lessThan": "e8fc3304cb67fb1d7d11ff9ef9abd5fb64e7e1d5",
              "status": "affected",
              "version": "cef35af34d6dc3792333075115c7deb7062b6e18",
              "versionType": "git"
            },
            {
              "lessThan": "60fddda7207d81fea71463abd403f0b10f74f2e1",
              "status": "affected",
              "version": "cef35af34d6dc3792333075115c7deb7062b6e18",
              "versionType": "git"
            },
            {
              "lessThan": "f5677797b094c3ec5fb350eb8ea7710b88a3d018",
              "status": "affected",
              "version": "cef35af34d6dc3792333075115c7deb7062b6e18",
              "versionType": "git"
            },
            {
              "lessThan": "89b25b5f46f488ea3b29b3444864c76944c9075b",
              "status": "affected",
              "version": "cef35af34d6dc3792333075115c7deb7062b6e18",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c",
            "drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.c",
            "drivers/net/ethernet/mellanox/mlx5/core/lib/hv_vhca.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix HV VHCA stats agent registration race\n\nmlx5e_hv_vhca_stats_create() registers the stats agent through\nmlx5_hv_vhca_agent_create(). The helper publishes the agent in\nhv_vhca-\u003eagents[type] under agents_lock and immediately schedules an\nasynchronous control invalidation on the HV VHCA workqueue before\nreturning to mlx5e.\n\nThe asynchronous invalidation invokes the control agent\u0027s invalidate\ncallback, which reads the hypervisor control block and forwards the\ncommand to mlx5e_hv_vhca_stats_control(). That callback may either:\n\n  - call cancel_delayed_work_sync(\u0026priv-\u003estats_agent.work), or\n  - call queue_delayed_work(priv-\u003ewq, \u0026sagent-\u003ework, sagent-\u003edelay).\n\nHowever, the delayed_work and priv-\u003estats_agent.agent are only\ninitialized after mlx5_hv_vhca_agent_create() returns to mlx5e:\n\n    agent = mlx5_hv_vhca_agent_create(...);   /* publish + invalidate */\n    ...\n    priv-\u003estats_agent.agent = agent;          /* too late */\n    INIT_DELAYED_WORK(\u0026priv-\u003estats_agent.work, ...); /* too late */\n\nIf the asynchronous control path runs before the two assignments\nabove, it can:\n\n  - Operate on an uninitialized delayed_work whose timer.function is\n    NULL. queue_delayed_work() calls add_timer() unconditionally, so\n    when the timer expires the timer softirq invokes a NULL function\n    pointer.\n  - Re-initialize the timer later through INIT_DELAYED_WORK() while\n    the timer is already enqueued in the timer wheel, corrupting the\n    hlist (entry.pprev cleared while the previous bucket node still\n    points at this entry).\n  - When the worker eventually runs, mlx5e_hv_vhca_stats_work() reads\n    sagent-\u003eagent (NULL) and dereferences it inside\n    mlx5_hv_vhca_agent_write().\n\nFix this by:\n\n  - Initializing priv-\u003estats_agent.work before invoking\n    mlx5_hv_vhca_agent_create(), so the work is always in a valid\n    state when the control callback observes it.\n  - Adding a struct mlx5_hv_vhca_agent **ctx_update out-parameter\n    to mlx5_hv_vhca_agent_create(). The helper writes the agent\n    pointer to *ctx_update before publishing into hv_vhca-\u003eagents[]\n    and triggering the agents_update flow, so any callback\n    subsequently invoked from that flow already sees a valid\n    priv-\u003estats_agent.agent. This avoids having the control\n    callback participate in agent initialization.\n\nWhile at it, access priv-\u003estats_agent.agent with\nREAD_ONCE()/WRITE_ONCE() for the cross-CPU access with the worker, and\nclear priv-\u003estats_agent.buf on the agent_create() failure path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in mlx5e HV VHCA stats agent registration during mlx5e driver attach on Hyper-V/Azure mlx5 NICs; it is reached via the VMBus PCI config back-channel and driver init, not via remote network packet handling.\nAC:L - mlx5_hv_vhca_agent_create() always queues asynchronous control invalidation before returning; on SMP hosts the workqueue races unfinished delayed_work/agent setup, and the path can be re-triggered via devlink reload or driver reattach.\nPR:N - No guest privileges are required: the race opens during normal mlx5e attach at boot/resume on CONFIG_PCI_HYPERV_INTERFACE systems, and the hypervisor can drive the control callback via the VHCA control block without guest credentials.\nUI:N - No user or administrator action is needed beyond normal VM boot and mlx5 driver initialization; exploitation does not depend on a victim opening files, mounting filesystems, or other interactive steps.\nS:U - Memory corruption and kernel crashes are confined to the guest kernel running mlx5e; the bug does not cross VM/host, IOMMU, or other security boundaries into a separate authority.\nC:H - The race can corrupt the kernel timer wheel hlist, invoke a NULL timer callback, or dereference a NULL agent during mlx5_hv_vhca_agent_write(), providing serious kernel memory corruption or disclosure primitives.\nI:H - Timer wheel hlist corruption and operating on uninitialized delayed_work structures are exploitable memory corruption that can be leveraged for arbitrary kernel writes or control-flow hijacking, not merely a bounded fault.\nA:H - Exploitation causes kernel oops/panic from NULL function-pointer timer callbacks, corrupted timer lists, or NULL agent dereferences, reliably denying availability of the affected system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:00.745Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b0fd6d3bb06182f19f3b59a53f57b5098b99048a"
        },
        {
          "url": "https://git.kernel.org/stable/c/24c77044cdfcf5b8b2e9f3b620d8b9aa392d9add"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8fc3304cb67fb1d7d11ff9ef9abd5fb64e7e1d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/60fddda7207d81fea71463abd403f0b10f74f2e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5677797b094c3ec5fb350eb8ea7710b88a3d018"
        },
        {
          "url": "https://git.kernel.org/stable/c/89b25b5f46f488ea3b29b3444864c76944c9075b"
        }
      ],
      "title": "net/mlx5e: Fix HV VHCA stats agent registration race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72342",
    "datePublished": "2026-08-15T05:55:48.412Z",
    "dateReserved": "2026-08-09T03:40:39.920Z",
    "dateUpdated": "2026-08-17T05:43:00.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ncsi/ncsi-netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e60afa01d35f8b2671b27ca93309921427144cce",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "67c72b8ef63d9d9a610546fda30b116638f39745",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "4489b4a17892750131e4bef4bc1d3d703c8fb5ba",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "43c7d0a6917751ea898ae584d00f24f5deac46d4",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "b5231ad0b376b801ab8cf2962b182cc29deaedb3",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "02226af69362758046822840fc6a497f5de33f00",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "3a60b5af75abe8e3494ccd074fb4ae6e601a3e55",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            },
            {
              "lessThan": "afa58b7384913c8773d837acdb07b035690ec5d2",
              "status": "affected",
              "version": "9771b8ccdfa6dcb1ac5128ca7fe8649f3092d392",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ncsi/ncsi-netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length\n\nncsi_send_cmd_nl() takes the number of bytes to copy from the\nattacker-controlled ncsi_pkt_hdr.length field of the in-band packet\nheader, while the source buffer is the NCSI_ATTR_DATA netlink\nattribute whose readable size is nla_len() - sizeof(ncsi_pkt_hdr).\nThe two length sources are never cross-checked: only\nnla_len() \u003e= sizeof(struct ncsi_pkt_hdr) is enforced.\n\nWith hdr-\u003elength set larger than the attribute payload (up to 65535\nagainst at most 2032 readable bytes), ncsi_cmd_handler_oem() copies\npast the end of the netlink attribute buffer with unsafe_memcpy(),\nleaking up to ~64KB of kernel heap memory into the transmitted NCSI\ncommand packet. The destination skb is sized by the declared payload,\nso the write side does not overflow - this is a pure OOB read /\ninformation leak, reachable with CAP_NET_ADMIN on systems with a\nregistered NCSI device (e.g. OpenBMC on Aspeed BMC SoCs, where\nNET_NCSI=y is standard).\n\nReject commands whose declared payload extends past the end of the\ndata attribute.\n\nThe issue was found by the autokbug dynamic kernel fuzzer at Tencent\nYunding Lab."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:57.113Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e60afa01d35f8b2671b27ca93309921427144cce"
        },
        {
          "url": "https://git.kernel.org/stable/c/67c72b8ef63d9d9a610546fda30b116638f39745"
        },
        {
          "url": "https://git.kernel.org/stable/c/4489b4a17892750131e4bef4bc1d3d703c8fb5ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/43c7d0a6917751ea898ae584d00f24f5deac46d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5231ad0b376b801ab8cf2962b182cc29deaedb3"
        },
        {
          "url": "https://git.kernel.org/stable/c/02226af69362758046822840fc6a497f5de33f00"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a60b5af75abe8e3494ccd074fb4ae6e601a3e55"
        },
        {
          "url": "https://git.kernel.org/stable/c/afa58b7384913c8773d837acdb07b035690ec5d2"
        }
      ],
      "title": "net/ncsi: fix heap OOB read in NCSI_CMD_SEND_CMD payload length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74694",
    "datePublished": "2026-08-22T15:32:57.113Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-22T15:32:57.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/pci/ice1712/aureon.c",
            "sound/pci/ice1712/ice1712.c",
            "sound/pci/ice1712/ice1724.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "57d59be545b309d4bb54ac472b15d1e67f254d95",
              "status": "affected",
              "version": "0df0097ea2d52401c31e550389ac758c90e6a1eb",
              "versionType": "git"
            },
            {
              "lessThan": "69bf1dfa3215524c4ae255bb9dce0770875abbeb",
              "status": "affected",
              "version": "b9a4efd61b6b9f62f83752959e75a5dae20624fa",
              "versionType": "git"
            },
            {
              "lessThan": "d34ad480b8896d2b486e2cf29ce1790326cad205",
              "status": "affected",
              "version": "b9a4efd61b6b9f62f83752959e75a5dae20624fa",
              "versionType": "git"
            },
            {
              "lessThan": "71b87108ad93d433cdb20704a8dc8852304cf2c2",
              "status": "affected",
              "version": "b9a4efd61b6b9f62f83752959e75a5dae20624fa",
              "versionType": "git"
            },
            {
              "lessThan": "38a7cc46370a57122fb29c4bfe48a851c0c64459",
              "status": "affected",
              "version": "b9a4efd61b6b9f62f83752959e75a5dae20624fa",
              "versionType": "git"
            },
            {
              "lessThan": "2b929b91b0f3bc6de8a844370049cd99ee8e31ff",
              "status": "affected",
              "version": "b9a4efd61b6b9f62f83752959e75a5dae20624fa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "286e17a1c3baeb1b1cd36b63ee16e8a6e63d558e",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.34",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/pci/ice1712/aureon.c",
            "sound/pci/ice1712/ice1712.c",
            "sound/pci/ice1712/ice1724.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ice1712: check snd_ctl_new1() return value\n\nsnd_ctl_new1() can return NULL when memory allocation fails. The\nice1712 driver calls snd_ctl_new1() without checking the return value\nbefore dereferencing the pointer in multiple places (ice1712.c,\nice1724.c, aureon.c), which can lead to NULL pointer dereferences.\n\nAdd NULL checks after snd_ctl_new1() calls and return -ENOMEM if any\nfails."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:56:26.964Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/57d59be545b309d4bb54ac472b15d1e67f254d95"
        },
        {
          "url": "https://git.kernel.org/stable/c/69bf1dfa3215524c4ae255bb9dce0770875abbeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/d34ad480b8896d2b486e2cf29ce1790326cad205"
        },
        {
          "url": "https://git.kernel.org/stable/c/71b87108ad93d433cdb20704a8dc8852304cf2c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/38a7cc46370a57122fb29c4bfe48a851c0c64459"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b929b91b0f3bc6de8a844370049cd99ee8e31ff"
        }
      ],
      "title": "ALSA: ice1712: check snd_ctl_new1() return value",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64480",
    "datePublished": "2026-07-25T08:51:41.691Z",
    "dateReserved": "2026-07-19T15:36:31.791Z",
    "dateUpdated": "2026-08-17T04:56:26.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2fd24407457a6b181ba827705678da70e528dcd0",
              "status": "affected",
              "version": "c1420a5dd4dd2a1ffc86965ad1c6f439afb130bc",
              "versionType": "git"
            },
            {
              "lessThan": "962d684b5dc0741dcd93485d41b450de402d5592",
              "status": "affected",
              "version": "c1420a5dd4dd2a1ffc86965ad1c6f439afb130bc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix amdgpu_hmm_range_get_pages\n\nThe notifier sequence must only be read once or otherwise we could work\nwith invalid pages.\n\nWhile at it also fix the coding style, e.g. drop the pre-initialized\nreturn value and use the common define for 2G range.\n\n(cherry picked from commit c08972f555945cda57b0adb72272a37910153390)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local AMDGPU DRM ioctls (e.g., AMDGPU_GEM_USERPTR, AMDGPU_CS) and KFD ioctls on /dev/kfd that call amdgpu_hmm_range_get_pages(); there is no network-facing entry point.\nAC:L - Exploitation requires a \u003e2GB userptr/SVM mapping and a concurrent munmap/remap during the multi-chunk HMM walk, but the attacker controls both the ioctl thread and the address-space manipulation, so the race is attacker-driven rather than dependent on uncontrollable conditions.\nPR:L - Any unprivileged local user with access to the AMDGPU render node or /dev/kfd (typically render/video group membership) can create large userptr buffers and submit GPU work that triggers the vulnerable HMM path; root or init-namespace capabilities are not required.\nUI:N - Exploitation is fully attacker-driven through GPU memory registration and command submission ioctls and does not require any action from another user or administrator.\nS:U - The flaw corrupts or misuses kernel-tracked page metadata and enables standard local kernel memory safety impact and privilege escalation within the same kernel security domain, not a VM escape or IOMMU boundary bypass.\nC:H - Re-reading the MMU notifier sequence per 2GB chunk lets later validation pass while earlier PFNs may reference unmapped or freed pages, giving the GPU (and kernel DMA helpers) a stale-page/use-after-free primitive that can disclose arbitrary physical memory contents.\nI:H - Stale PFNs from invalidated mappings can be DMA-mapped and written by GPU operations, enabling arbitrary memory corruption and potential control-flow hijacking via repurposed physical pages rather than a bounded or crash-only effect.\nA:H - Operating on invalid struct page pointers during pinning/DMA mapping can trigger kernel oopses or panics, and the underlying use-after-free class of bug inherently threatens system availability even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:49.976Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2fd24407457a6b181ba827705678da70e528dcd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/962d684b5dc0741dcd93485d41b450de402d5592"
        }
      ],
      "title": "drm/amdgpu: fix amdgpu_hmm_range_get_pages",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63879",
    "datePublished": "2026-07-19T14:54:51.698Z",
    "dateReserved": "2026-07-19T07:54:57.018Z",
    "dateUpdated": "2026-08-05T12:36:49.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/cortina/gemini.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "27856d533eca3804008695f61c1e4d5ff984196b",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "b6b22824b30e48ce1df3a2e80990f4b8505deb50",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "6bba24e9ebe6f1c0b356cd471e36bdc7fa434897",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "3b249988d774dacf13b203817e971934a42243c4",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "72158ea185b27afae163949b0e86164cb6b64e55",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "cfd62907f3cdbc3b6da8f49ba907c0390018fe5e",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "67a35e7da7ef9d2f000aa758552a128324c604a0",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            },
            {
              "lessThan": "06937db21ee311ed07eba47954447245041a982d",
              "status": "affected",
              "version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/cortina/gemini.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: cortina: Make RX SKB per-port\n\nThe SKB used to assemble packets from fragments in gmac_rx()\nis static local, but the Gemini has two ethernet ports, meaning\nthere can be races between the ports on a bad day if a device\nis using both.\n\nMake the RX SKB a per-port variable and carry it over between\ninvocations in the port struct instead.\n\nZero the pointer once we call napi_gro_frags(), on error (after\ncalling napi_free_frags()) or if the port is stopped.\n\nZero it in some place where not strictly necessary just to\nemphasize what is going on.\n\nThis was found by Sashiko during normal patch review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code runs in the netdev RX path (gmac_irq \u2192 napi_schedule \u2192 gmac_napi_poll \u2192 gmac_rx) when Ethernet frames are DMA\u0027d from the wire, so any remote host that can send packets to a reachable Gemini GMAC interface can trigger it.\nAC:L - An attacker controls both sides of the race by flooding one or both GMAC ports with multi-descriptor/jumbo frames to keep skb assembly in progress while concurrent NAPI polls run on the independent per-port IRQ handlers without serialization on the shared static skb pointer.\nPR:N - Exploitation requires only the ability to deliver Ethernet frames to an active interface; there are no authentication gates, capability checks, or local syscalls on the RX path from hardware interrupt through gmac_rx().\nUI:N - Triggering the race requires only crafted or high-volume network traffic; no victim interaction such as mounting a filesystem or opening a file is needed.\nS:U - The corruption is confined to kernel networking state (shared skb assembly between the two GMAC ports on the same host); impact does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - Concurrent corruption of a shared skb and mismatched napi_get_frags/napi_gro_frags/napi_free_frags usage across ports can cause use-after-free and skb metadata corruption that enables arbitrary kernel memory disclosure.\nI:H - Cross-port skb corruption via concurrent skb_fill_page_desc and len updates, plus orphaned or double-freed skb/page state, provides memory corruption primitives that can be leveraged for arbitrary kernel writes or code execution.\nA:H - The race can cause kernel oopses or panics from slab/list corruption, invalid page refcount handling, or crashes inside napi_gro_frags when skb state is corrupted across the two ports."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:45.763Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/27856d533eca3804008695f61c1e4d5ff984196b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6b22824b30e48ce1df3a2e80990f4b8505deb50"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bba24e9ebe6f1c0b356cd471e36bdc7fa434897"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b249988d774dacf13b203817e971934a42243c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/72158ea185b27afae163949b0e86164cb6b64e55"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfd62907f3cdbc3b6da8f49ba907c0390018fe5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/67a35e7da7ef9d2f000aa758552a128324c604a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/06937db21ee311ed07eba47954447245041a982d"
        }
      ],
      "title": "net: ethernet: cortina: Make RX SKB per-port",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64056",
    "datePublished": "2026-07-19T15:39:37.673Z",
    "dateReserved": "2026-07-19T07:54:57.030Z",
    "dateUpdated": "2026-08-05T12:38:45.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:50:28.908Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/netfilter/ebtables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c046ca4e35a83ea32f6e748f54139f5fe2a1d01",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ab63ccefb9c71627f957a0724c2b9ebc869c6f20",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c6f539311e58e76aa96feef0f1572b13a564f8a2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2664f537ca5bcb2ef3fac2683dcca602e51fad24",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7436da6c1bc44654b7f11a17e746f6999fd37250",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b6183b1b88a722b6d8ea0cecc99eba168a15e0be",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a622d2e9608c9dff47fc2e5759ac7aa3a836b45d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/netfilter/ebtables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: terminate table name before find_table_lock()\n\nupdate_counters() and compat_update_counters() forward a user-supplied\n32-byte table name to find_table_lock() without NUL-terminating it. On a\nlookup miss, find_inlist_lock() calls try_then_request_module(..., \"%s%s\",\n\"ebtable_\", name), and vsnprintf() reads past the name field and the\nstack object until it hits a zero byte.\n\n  BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n  Read of size 1 at addr ffff8880119dfb20 by task exploit/147\n  Call Trace:\n  ...\n   string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n   vsnprintf (lib/vsprintf.c:2945)\n   __request_module (kernel/module/kmod.c:150)\n   do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)\n   update_counters (net/bridge/netfilter/ebtables.c:1440)\n   do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)\n   nf_setsockopt (net/netfilter/nf_sockopt.c:101)\n   ip_setsockopt (net/ipv4/ip_sockglue.c:1424)\n   raw_setsockopt (net/ipv4/raw.c:847)\n   __sys_setsockopt (net/socket.c:2393)\n  ...\n\ncompat_do_replace() shares the same unterminated name via\ncompat_copy_ebt_replace_from_user(); terminate it there too so all\nfind_table_lock() callers behave alike. The other callers already\nterminate the name after the copy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through a local setsockopt() call into the legacy ebtables interface, not through received network traffic.\nAC:L - The attacker directly supplies a nonterminated table name and guarantees a lookup miss without racing or relying on conditions outside their control.\nPR:L - The path requires CAP_NET_ADMIN in the socket\u0027s network namespace, which an unprivileged user can obtain using a new user and network namespace.\nUI:N - No action by another user is required after the attacker invokes the crafted setsockopt() operation.\nS:U - The over-read affects the same host kernel security authority and does not cross a virtualization or comparable security boundary.\nC:H - The unbounded source read can copy kernel-stack contents into the generated module name, potentially exposing sensitive kernel data.\nI:N - The flaw performs an out-of-bounds read only; the destination formatting is bounded and no attacker-controlled write or memory corruption occurs.\nA:H - The unbounded scan can reach an unmapped stack boundary and cause an oops or panic, as supported by the demonstrated KASAN stack-out-of-bounds failure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:10.076Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c046ca4e35a83ea32f6e748f54139f5fe2a1d01"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab63ccefb9c71627f957a0724c2b9ebc869c6f20"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6f539311e58e76aa96feef0f1572b13a564f8a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/2664f537ca5bcb2ef3fac2683dcca602e51fad24"
        },
        {
          "url": "https://git.kernel.org/stable/c/7436da6c1bc44654b7f11a17e746f6999fd37250"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6183b1b88a722b6d8ea0cecc99eba168a15e0be"
        },
        {
          "url": "https://git.kernel.org/stable/c/a622d2e9608c9dff47fc2e5759ac7aa3a836b45d"
        }
      ],
      "title": "netfilter: ebtables: terminate table name before find_table_lock()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64411",
    "datePublished": "2026-07-25T08:50:52.143Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-09-08T08:50:28.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/sock_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2271276ac5279d2d204be7739a1a28d4ef6cf608",
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "versionType": "git"
            },
            {
              "lessThan": "7ffe529e7127411806c8692fb1490f552c629dc2",
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "versionType": "git"
            },
            {
              "lessThan": "17b7ef6b86112a4e61cee1e9009a4b318e3225c5",
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "versionType": "git"
            },
            {
              "lessThan": "250474c69bc3fc48a5fc21d7c349f279caad947a",
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "versionType": "git"
            },
            {
              "lessThan": "8692655da369961128658cf8539334b6a960ecb0",
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "versionType": "git"
            },
            {
              "lessThan": "66efd3368ae10d05e08fbe6425b50fdec7186ac7",
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/sock_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Reject unhashed UDP sockets on sockmap update\n\nUDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means\nsk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.\n\nBecause sockmap accepts unbound UDP sockets, a BPF program can increment a\nsocket\u0027s refcount via lookup. If the socket is subsequently bound, the\ntransition from unbound to bound causes bpf_sk_release() to skip the\ndecrement of the refcount, causing a memory leak.\n\nunreferenced object 0xffff88810bc2eb40 (size 1984):\n  comm \"test_progs\", pid 2451, jiffies 4295320596\n  hex dump (first 32 bytes):\n    7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00  ................\n    02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............\n  backtrace (crc bdee079d):\n    kmem_cache_alloc_noprof+0x557/0x660\n    sk_prot_alloc+0x69/0x240\n    sk_alloc+0x30/0x460\n    inet_create+0x2ce/0xf80\n    __sock_create+0x25b/0x5c0\n    __sys_socket+0x119/0x1d0\n    __x64_sys_socket+0x72/0xd0\n    do_syscall_64+0xa1/0x5f0\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nInstead of special-casing for refcounted sockets, reject unhashed UDP\nsockets during sockmap updates, as there is no benefit to supporting those.\nThis effectively reverts the commit under Fixes, with two exceptions:\n\n1. sock_map_sk_state_allowed() maintains a fall-through `return true`.\n2. In the spirit of commit b8b8315e39ff (\"bpf, sockmap: Remove unhash\n   handler for BPF sockmap usage\"), the proto::unhash BPF handler is not\n   reintroduced.\n\nHistorical note: this issue is related to commit 67312adc96b5 (\"bpf: reject\nunhashed sockets in bpf_sk_assign\")."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:34:40.363Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2271276ac5279d2d204be7739a1a28d4ef6cf608"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ffe529e7127411806c8692fb1490f552c629dc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/17b7ef6b86112a4e61cee1e9009a4b318e3225c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/250474c69bc3fc48a5fc21d7c349f279caad947a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8692655da369961128658cf8539334b6a960ecb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/66efd3368ae10d05e08fbe6425b50fdec7186ac7"
        }
      ],
      "title": "bpf, sockmap: Reject unhashed UDP sockets on sockmap update",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68386",
    "datePublished": "2026-08-10T12:04:05.306Z",
    "dateReserved": "2026-07-30T09:28:09.388Z",
    "dateUpdated": "2026-08-19T16:34:40.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0",
              "status": "affected",
              "version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
              "versionType": "git"
            },
            {
              "lessThan": "ee41ea49c4ab0e4015919f52ad23ec251d3b39d3",
              "status": "affected",
              "version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
              "versionType": "git"
            },
            {
              "lessThan": "04599570c3a18f9ae7aad36825eb46f3dcd2c4e3",
              "status": "affected",
              "version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
              "versionType": "git"
            },
            {
              "lessThan": "9a416f000285a94c1b723877547981dec8132434",
              "status": "affected",
              "version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
              "versionType": "git"
            },
            {
              "lessThan": "b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb",
              "status": "affected",
              "version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
              "versionType": "git"
            },
            {
              "lessThan": "80094352bd40ba54a33731f9c22872493983ed6d",
              "status": "affected",
              "version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
              "versionType": "git"
            },
            {
              "lessThan": "4aafa600d93e9551c1f24e785d57cbd4adf021d5",
              "status": "affected",
              "version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
              "versionType": "git"
            },
            {
              "lessThan": "af39eb111ce6b5eba9c08513b62c4868eb7e7fd5",
              "status": "affected",
              "version": "fd1483fe1f9fd45fe312adffb0faffa57446690d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fw_tracer, return NULL on create error\n\nTracer creation can fail by returning either NULL or ERR_PTR.\nThe return value is stored without a check on the device, and users\ntreat ERR_PTR and NULL the same way.\nThis also causes a crash in the core dump logic, which is missing the\nERR_PTR check and ends up dereferencing it, as shown in the trace below.\n\nSwitch tracer creation to return NULL on failure only, so callers only\nneed a single NULL check.\n\n  Internal error: Oops: 0000000096000006 [#1]  SMP\n  Modules linked in: mlx5_ib ib_uverbs ib_core ipv6 mlx5_core\n  CPU: 1 UID: 0 PID: 12 Comm: kworker/u16:0 Not tainted 6.19.7 #1 PREEMPT(none)\n  Workqueue: mlx5_health0001:01:00.0 mlx5_fw_reporter_err_work [mlx5_core]\n  pstate: a3400009 (NzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n  pc : mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core]\n  lr : mlx5_fw_tracer_trigger_core_dump_general+0x40/0xe0 [mlx5_core]\n  sp : ffff800081cf3c40\n  x29: ffff800081cf3c90 x28: 0000000000000000 x27: 0000000000000000\n  x26: ffff000080018828 x25: 0000000000000000 x24: ffff000080304a05\n  x23: ffff800081cf3d80 x22: ffff0000847e01a0 x21: 0000000000000000\n  x20: ffff0000847e01a0 x19: ffffffffffffffa1 x18: ffff80008310bbf0\n  x17: ffff800080119650 x16: ffff80008010df54 x15: ffff80008010d4ac\n  x14: ffff800079c202e4 x13: ffff80008002fe60 x12: ffff800080119650\n  x11: ffff80008010df54 x10: ffff80008010d4ac x9 : ffff800079c203d8\n  x8 : ffff800081cf3c88 x7 : 0000000000000000 x6 : 0000000000000000\n  x5 : 0000000000000000 x4 : 0000000000000008 x3 : 0000000000000030\n  x2 : 0000000000000008 x1 : 0000000000000000 x0 : 00000000c5c4000e\n  Call trace:\n   mlx5_fw_tracer_trigger_core_dump_general+0x58/0xe0 [mlx5_core] (P)\n   mlx5_fw_reporter_dump+0x30/0x2e0 [mlx5_core]\n   devlink_health_do_dump+0x9c/0x160\n   devlink_health_report+0x1c0/0x288\n   mlx5_fw_reporter_err_work+0xac/0xc0 [mlx5_core]\n   process_one_work+0x15c/0x3d8\n   worker_thread+0x18c/0x320\n   kthread+0x148/0x228\n   ret_from_fork+0x10/0x20\n  Code: b9400000 5ac00800 7a401800 540003ca (3940a260)\n  ---[ end trace 0000000000000000 ]---\n  Kernel panic - not syncing: Oops: Fatal exception\n  SMP: stopping secondary CPUs\n  Kernel Offset: disabled\n  CPU features: 0x000000,00078031,75fce5a1,35fffe67\n  Memory Limit: none\n  ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On internet-facing cloud/HPC hosts with mlx5 PF NICs, a remote attacker can induce ConnectX firmware syndrome via crafted network/RDMA traffic; the kernel health poller then auto-invokes mlx5_fw_reporter_dump without any local syscall.\nAC:L - On affected hardware, mlx5_fw_tracer_create leaves ERR_PTR in dev-\u003etracer at probe (e.g. -EOPNOTSUPP when trace_to_memory is unset); once present, any FW syndrome or health miss counter event reliably queues the dump workqueue that dereferences the bad pointer.\nPR:N - The crash path shown in the fix oops is triggered automatically by mlx5_fw_reporter_err_work from the health poller with no userspace action; inducing FW syndrome over the network requires no host credentials, unlike the optional devlink dump path that needs CAP_NET_ADMIN.\nUI:N - Exploitation requires no victim interaction; the devlink health auto_dump fires from kernel workqueues when firmware reports a syndrome or miss-count threshold, independent of user actions such as mounts or file opens.\nS:U - Impact is confined to kernel crash/panic on the host running mlx5_core; there is no VM escape, IOMMU bypass, or crossing from guest VF context into a separate security authority beyond standard host kernel failure.\nC:N - The bug is an ERR_PTR mishandled as a valid mlx5_fw_tracer pointer; mlx5_fw_tracer_trigger_core_dump_general dereferences tracer-\u003eowner and faults immediately, producing an oops with no out-of-bounds read, UAF, or information disclosure primitive.\nI:N - Faulting on an ERR_PTR-encoded address does not corrupt adjacent memory or provide a controllable write primitive; the only outcome is an unrecoverable kernel oops/panic, not arbitrary modification or code execution.\nA:H - The fix commit documents a fatal kernel Oops in mlx5_fw_tracer_trigger_core_dump_general followed by \u0027Kernel panic - not syncing\u0027, causing complete loss of host availability on affected mlx5 PF systems when the FW reporter dump path runs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:59.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/47fe0d2571e5b446a0f0b0c1d6b99f55e51f5cc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee41ea49c4ab0e4015919f52ad23ec251d3b39d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/04599570c3a18f9ae7aad36825eb46f3dcd2c4e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a416f000285a94c1b723877547981dec8132434"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1d6375b9a63c9dc7e5e780d3ea9b126fe30d6cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/80094352bd40ba54a33731f9c22872493983ed6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4aafa600d93e9551c1f24e785d57cbd4adf021d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/af39eb111ce6b5eba9c08513b62c4868eb7e7fd5"
        }
      ],
      "title": "net/mlx5: fw_tracer, return NULL on create error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74717",
    "datePublished": "2026-08-22T15:33:11.488Z",
    "dateReserved": "2026-08-15T05:44:03.928Z",
    "dateUpdated": "2026-08-25T05:41:59.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}