Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1231
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SUSE | N/A | SUSE Linux Enterprise Micro for Rancher 5.3 | ||
| SUSE | N/A | SUSE Linux Enterprise High Performance Computing 15 SP5 | ||
| SUSE | N/A | SUSE Linux Enterprise Micro 5.3 | ||
| SUSE | N/A | SUSE Linux Enterprise Real Time 15 SP7 | ||
| SUSE | N/A | SUSE Manager Proxy 4.3 | ||
| SUSE | N/A | SUSE Linux Micro 6.1 | ||
| SUSE | N/A | SUSE Linux Enterprise High Performance Computing 12 SP5 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 12 SP5 | ||
| SUSE | N/A | SUSE Linux Enterprise High Availability Extension 15 SP4 | ||
| SUSE | N/A | SUSE Linux Enterprise Micro for Rancher 5.4 | ||
| SUSE | N/A | SUSE Linux Enterprise Live Patching 15-SP4 | ||
| SUSE | N/A | SUSE Manager Retail Branch Server 4.3 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 12 SP5 LTSS | ||
| SUSE | N/A | openSUSE Leap 15.4 | ||
| SUSE | N/A | SUSE Linux Enterprise Server for SAP Applications 15 SP4 | ||
| SUSE | N/A | SUSE Linux Enterprise Server for SAP Applications 15 SP7 | ||
| SUSE | N/A | openSUSE Leap 15.5 | ||
| SUSE | N/A | SUSE Manager Server 4.3 | ||
| SUSE | N/A | SUSE Linux Enterprise High Performance Computing 15 SP4 | ||
| SUSE | N/A | SUSE Linux Enterprise Live Patching 15-SP6 | ||
| SUSE | N/A | SUSE Linux Enterprise Server for SAP applications 16.0 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 15 SP5 | ||
| SUSE | N/A | SUSE Linux Enterprise Server for SAP Applications 15 SP5 | ||
| SUSE | N/A | SUSE Linux Enterprise Real Time 15 SP5 | ||
| SUSE | N/A | SUSE Linux Enterprise Live Patching 12-SP5 | ||
| SUSE | N/A | SUSE Linux Micro 6.2 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 15 SP7 | ||
| SUSE | N/A | SUSE Linux Enterprise Live Patching 15-SP7 | ||
| SUSE | N/A | SUSE Linux Enterprise Live Patching 15-SP5 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 15 SP4 LTSS | ||
| SUSE | N/A | SUSE Linux Enterprise Real Time 15 SP6 | ||
| SUSE | N/A | openSUSE Leap 15.6 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 15 SP4 | ||
| SUSE | N/A | SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 | ||
| SUSE | N/A | SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 | ||
| SUSE | N/A | SUSE Linux Enterprise Real Time 15 SP4 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 16.0 | ||
| SUSE | N/A | SUSE Linux Enterprise Server for SAP Applications 12 SP5 | ||
| SUSE | N/A | SUSE Linux Enterprise Micro 5.4 | ||
| SUSE | N/A | SUSE Linux Enterprise Server for SAP Applications 15 SP6 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security | ||
| SUSE | N/A | SUSE Linux Enterprise Server 15 SP6 | ||
| SUSE | N/A | SUSE Linux Enterprise Micro 5.5 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SUSE Linux Enterprise Micro for Rancher 5.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise High Performance Computing 15 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Micro 5.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Real Time 15 SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Manager Proxy 4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Micro 6.1",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise High Performance Computing 12 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 12 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise High Availability Extension 15 SP4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Micro for Rancher 5.4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Live Patching 15-SP4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Manager Retail Branch Server 4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 12 SP5 LTSS",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "openSUSE Leap 15.4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server for SAP Applications 15 SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "openSUSE Leap 15.5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Manager Server 4.3",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise High Performance Computing 15 SP4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Live Patching 15-SP6",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 15 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Real Time 15 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Live Patching 12-SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Micro 6.2",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 15 SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Live Patching 15-SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Live Patching 15-SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 15 SP4 LTSS",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Real Time 15 SP6",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "openSUSE Leap 15.6",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 15 SP4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise High Performance Computing LTSS 15 SP4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Real Time 15 SP4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Micro 5.4",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 15 SP6",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Micro 5.5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-31483",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31483"
},
{
"name": "CVE-2026-53091",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53091"
},
{
"name": "CVE-2026-53381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53381"
},
{
"name": "CVE-2026-74394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74394"
},
{
"name": "CVE-2026-68450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68450"
},
{
"name": "CVE-2026-68480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68480"
},
{
"name": "CVE-2026-74297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74297"
},
{
"name": "CVE-2026-80716",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80716"
},
{
"name": "CVE-2026-64561",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64561"
},
{
"name": "CVE-2026-64047",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64047"
},
{
"name": "CVE-2026-68138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68138"
},
{
"name": "CVE-2026-52925",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52925"
},
{
"name": "CVE-2026-74669",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74669"
},
{
"name": "CVE-2026-68141",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68141"
},
{
"name": "CVE-2026-52929",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52929"
},
{
"name": "CVE-2026-74482",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74482"
},
{
"name": "CVE-2026-64322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64322"
},
{
"name": "CVE-2026-53061",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53061"
},
{
"name": "CVE-2026-64470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64470"
},
{
"name": "CVE-2026-53374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53374"
},
{
"name": "CVE-2026-64513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64513"
},
{
"name": "CVE-2026-64512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64512"
},
{
"name": "CVE-2026-68129",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68129"
},
{
"name": "CVE-2026-64380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64380"
},
{
"name": "CVE-2026-64268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64268"
},
{
"name": "CVE-2026-68428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68428"
},
{
"name": "CVE-2026-74378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74378"
},
{
"name": "CVE-2026-74417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74417"
},
{
"name": "CVE-2026-74581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74581"
},
{
"name": "CVE-2026-68313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68313"
},
{
"name": "CVE-2026-74537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74537"
},
{
"name": "CVE-2026-68417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68417"
},
{
"name": "CVE-2026-68338",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68338"
},
{
"name": "CVE-2026-53260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53260"
},
{
"name": "CVE-2026-68277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68277"
},
{
"name": "CVE-2026-74557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74557"
},
{
"name": "CVE-2026-68410",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68410"
},
{
"name": "CVE-2026-74345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74345"
},
{
"name": "CVE-2026-80909",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80909"
},
{
"name": "CVE-2026-72083",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72083"
},
{
"name": "CVE-2026-64333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64333"
},
{
"name": "CVE-2026-68155",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68155"
},
{
"name": "CVE-2026-63928",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63928"
},
{
"name": "CVE-2026-80765",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80765"
},
{
"name": "CVE-2026-74488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74488"
},
{
"name": "CVE-2026-53220",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53220"
},
{
"name": "CVE-2026-72297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72297"
},
{
"name": "CVE-2026-53360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53360"
},
{
"name": "CVE-2026-68425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68425"
},
{
"name": "CVE-2026-63888",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63888"
},
{
"name": "CVE-2026-80534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80534"
},
{
"name": "CVE-2026-72466",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72466"
},
{
"name": "CVE-2026-64178",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64178"
},
{
"name": "CVE-2026-53163",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53163"
},
{
"name": "CVE-2026-72450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72450"
},
{
"name": "CVE-2026-80609",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80609"
},
{
"name": "CVE-2026-72339",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72339"
},
{
"name": "CVE-2026-68320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68320"
},
{
"name": "CVE-2026-31502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31502"
},
{
"name": "CVE-2026-63810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63810"
},
{
"name": "CVE-2026-64098",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64098"
},
{
"name": "CVE-2026-63801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63801"
},
{
"name": "CVE-2026-63827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63827"
},
{
"name": "CVE-2026-64304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64304"
},
{
"name": "CVE-2026-23443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23443"
},
{
"name": "CVE-2026-53309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53309"
},
{
"name": "CVE-2026-64190",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64190"
},
{
"name": "CVE-2026-64323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64323"
},
{
"name": "CVE-2026-52939",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52939"
},
{
"name": "CVE-2026-72135",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72135"
},
{
"name": "CVE-2026-80714",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80714"
},
{
"name": "CVE-2026-68093",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68093"
},
{
"name": "CVE-2026-72262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72262"
},
{
"name": "CVE-2026-63990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63990"
},
{
"name": "CVE-2026-80574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80574"
},
{
"name": "CVE-2026-74388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74388"
},
{
"name": "CVE-2026-74271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74271"
},
{
"name": "CVE-2026-64563",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64563"
},
{
"name": "CVE-2026-68405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68405"
},
{
"name": "CVE-2026-68328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68328"
},
{
"name": "CVE-2026-72164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72164"
},
{
"name": "CVE-2026-72017",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72017"
},
{
"name": "CVE-2026-74390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74390"
},
{
"name": "CVE-2026-68363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68363"
},
{
"name": "CVE-2026-68278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68278"
},
{
"name": "CVE-2026-74454",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74454"
},
{
"name": "CVE-2026-64341",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64341"
},
{
"name": "CVE-2026-72086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72086"
},
{
"name": "CVE-2026-80580",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80580"
},
{
"name": "CVE-2026-53149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53149"
},
{
"name": "CVE-2026-63892",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63892"
},
{
"name": "CVE-2026-64010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64010"
},
{
"name": "CVE-2025-40277",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40277"
},
{
"name": "CVE-2026-68160",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68160"
},
{
"name": "CVE-2026-72421",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72421"
},
{
"name": "CVE-2026-64553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64553"
},
{
"name": "CVE-2026-80819",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80819"
},
{
"name": "CVE-2026-68426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68426"
},
{
"name": "CVE-2026-68329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68329"
},
{
"name": "CVE-2026-64593",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64593"
},
{
"name": "CVE-2026-72108",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72108"
},
{
"name": "CVE-2026-80722",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80722"
},
{
"name": "CVE-2026-53219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53219"
},
{
"name": "CVE-2026-64109",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64109"
},
{
"name": "CVE-2026-74278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74278"
},
{
"name": "CVE-2026-72284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72284"
},
{
"name": "CVE-2026-63898",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63898"
},
{
"name": "CVE-2026-74341",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74341"
},
{
"name": "CVE-2026-46128",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46128"
},
{
"name": "CVE-2026-63992",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63992"
},
{
"name": "CVE-2026-72084",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72084"
},
{
"name": "CVE-2026-68197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68197"
},
{
"name": "CVE-2026-64343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64343"
},
{
"name": "CVE-2026-68315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68315"
},
{
"name": "CVE-2026-64471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64471"
},
{
"name": "CVE-2026-68357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68357"
},
{
"name": "CVE-2024-57841",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-57841"
},
{
"name": "CVE-2026-72487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72487"
},
{
"name": "CVE-2026-64551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64551"
},
{
"name": "CVE-2026-53403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53403"
},
{
"name": "CVE-2026-64048",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64048"
},
{
"name": "CVE-2026-74479",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74479"
},
{
"name": "CVE-2026-64306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64306"
},
{
"name": "CVE-2026-64313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64313"
},
{
"name": "CVE-2026-72142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72142"
},
{
"name": "CVE-2026-68159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68159"
},
{
"name": "CVE-2026-74302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74302"
},
{
"name": "CVE-2026-64541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64541"
},
{
"name": "CVE-2026-64332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64332"
},
{
"name": "CVE-2026-63920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63920"
},
{
"name": "CVE-2026-46108",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46108"
},
{
"name": "CVE-2026-68202",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68202"
},
{
"name": "CVE-2026-72389",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72389"
},
{
"name": "CVE-2026-72323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72323"
},
{
"name": "CVE-2026-68143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68143"
},
{
"name": "CVE-2026-46070",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46070"
},
{
"name": "CVE-2026-68349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68349"
},
{
"name": "CVE-2026-74496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74496"
},
{
"name": "CVE-2026-46150",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46150"
},
{
"name": "CVE-2026-72282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72282"
},
{
"name": "CVE-2026-72502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72502"
},
{
"name": "CVE-2026-68351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68351"
},
{
"name": "CVE-2026-68289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68289"
},
{
"name": "CVE-2026-64556",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64556"
},
{
"name": "CVE-2026-45941",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45941"
},
{
"name": "CVE-2026-68117",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68117"
},
{
"name": "CVE-2026-64544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64544"
},
{
"name": "CVE-2026-68111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68111"
},
{
"name": "CVE-2026-64577",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64577"
},
{
"name": "CVE-2026-64115",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64115"
},
{
"name": "CVE-2026-52946",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52946"
},
{
"name": "CVE-2026-53059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53059"
},
{
"name": "CVE-2026-74334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74334"
},
{
"name": "CVE-2026-64164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64164"
},
{
"name": "CVE-2026-63891",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63891"
},
{
"name": "CVE-2024-35973",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35973"
},
{
"name": "CVE-2026-74615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74615"
},
{
"name": "CVE-2026-80603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80603"
},
{
"name": "CVE-2026-64581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64581"
},
{
"name": "CVE-2026-74261",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74261"
},
{
"name": "CVE-2026-53228",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53228"
},
{
"name": "CVE-2026-64315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64315"
},
{
"name": "CVE-2026-68238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68238"
},
{
"name": "CVE-2026-74582",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74582"
},
{
"name": "CVE-2026-68432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68432"
},
{
"name": "CVE-2026-74519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74519"
},
{
"name": "CVE-2026-74548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74548"
},
{
"name": "CVE-2026-64001",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64001"
},
{
"name": "CVE-2026-43134",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43134"
},
{
"name": "CVE-2026-52910",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52910"
},
{
"name": "CVE-2026-74518",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74518"
},
{
"name": "CVE-2026-53388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53388"
},
{
"name": "CVE-2026-80590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80590"
},
{
"name": "CVE-2026-68398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68398"
},
{
"name": "CVE-2026-64381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64381"
},
{
"name": "CVE-2026-63887",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63887"
},
{
"name": "CVE-2026-68136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68136"
},
{
"name": "CVE-2025-39964",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39964"
},
{
"name": "CVE-2026-74416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74416"
},
{
"name": "CVE-2026-64113",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64113"
},
{
"name": "CVE-2026-68299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68299"
},
{
"name": "CVE-2026-64103",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64103"
},
{
"name": "CVE-2026-68082",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68082"
},
{
"name": "CVE-2026-74508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74508"
},
{
"name": "CVE-2026-64408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64408"
},
{
"name": "CVE-2026-68156",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68156"
},
{
"name": "CVE-2026-74695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74695"
},
{
"name": "CVE-2026-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68121"
},
{
"name": "CVE-2026-64481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64481"
},
{
"name": "CVE-2026-72036",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72036"
},
{
"name": "CVE-2026-64582",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64582"
},
{
"name": "CVE-2026-53223",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53223"
},
{
"name": "CVE-2026-64423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64423"
},
{
"name": "CVE-2026-68433",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68433"
},
{
"name": "CVE-2026-43257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43257"
},
{
"name": "CVE-2026-63868",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63868"
},
{
"name": "CVE-2026-72123",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72123"
},
{
"name": "CVE-2026-45968",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45968"
},
{
"name": "CVE-2026-72296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72296"
},
{
"name": "CVE-2026-52912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52912"
},
{
"name": "CVE-2026-72072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72072"
},
{
"name": "CVE-2026-68279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68279"
},
{
"name": "CVE-2026-68234",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68234"
},
{
"name": "CVE-2026-52920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52920"
},
{
"name": "CVE-2026-53001",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53001"
},
{
"name": "CVE-2026-74510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74510"
},
{
"name": "CVE-2023-53109",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-53109"
},
{
"name": "CVE-2026-63890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63890"
},
{
"name": "CVE-2026-74382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74382"
},
{
"name": "CVE-2026-64562",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64562"
},
{
"name": "CVE-2026-43456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43456"
},
{
"name": "CVE-2025-68214",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68214"
},
{
"name": "CVE-2026-68153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68153"
},
{
"name": "CVE-2026-53089",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53089"
},
{
"name": "CVE-2026-68188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68188"
},
{
"name": "CVE-2026-64436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64436"
},
{
"name": "CVE-2026-63962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63962"
},
{
"name": "CVE-2026-64412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64412"
},
{
"name": "CVE-2026-74556",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74556"
},
{
"name": "CVE-2026-74377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74377"
},
{
"name": "CVE-2026-74296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74296"
},
{
"name": "CVE-2026-64344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64344"
},
{
"name": "CVE-2026-53077",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53077"
},
{
"name": "CVE-2026-68397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68397"
},
{
"name": "CVE-2026-64572",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64572"
},
{
"name": "CVE-2026-64411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64411"
},
{
"name": "CVE-2026-74279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74279"
},
{
"name": "CVE-2026-74705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74705"
},
{
"name": "CVE-2026-64137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64137"
},
{
"name": "CVE-2026-43277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43277"
},
{
"name": "CVE-2026-64334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64334"
},
{
"name": "CVE-2026-74495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74495"
},
{
"name": "CVE-2026-72289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72289"
},
{
"name": "CVE-2026-72251",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72251"
},
{
"name": "CVE-2026-64005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64005"
},
{
"name": "CVE-2026-46107",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46107"
},
{
"name": "CVE-2026-23003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23003"
},
{
"name": "CVE-2026-43502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43502"
},
{
"name": "CVE-2026-74265",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74265"
},
{
"name": "CVE-2026-68300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68300"
},
{
"name": "CVE-2026-68284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68284"
},
{
"name": "CVE-2026-53264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53264"
},
{
"name": "CVE-2026-74743",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74743"
},
{
"name": "CVE-2026-64547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64547"
},
{
"name": "CVE-2026-63860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63860"
},
{
"name": "CVE-2026-68158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68158"
},
{
"name": "CVE-2026-64543",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64543"
},
{
"name": "CVE-2026-63823",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63823"
},
{
"name": "CVE-2026-68325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68325"
},
{
"name": "CVE-2026-64015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64015"
},
{
"name": "CVE-2026-43125",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43125"
},
{
"name": "CVE-2026-72138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72138"
},
{
"name": "CVE-2026-74673",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74673"
},
{
"name": "CVE-2026-68198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68198"
},
{
"name": "CVE-2026-23451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23451"
},
{
"name": "CVE-2026-68123",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68123"
},
{
"name": "CVE-2026-53238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53238"
},
{
"name": "CVE-2026-43416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43416"
},
{
"name": "CVE-2026-64118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64118"
},
{
"name": "CVE-2026-74406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74406"
},
{
"name": "CVE-2026-64312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64312"
},
{
"name": "CVE-2026-53265",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53265"
},
{
"name": "CVE-2026-74584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74584"
},
{
"name": "CVE-2026-64355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64355"
},
{
"name": "CVE-2026-72069",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72069"
},
{
"name": "CVE-2026-80737",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80737"
},
{
"name": "CVE-2026-72020",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72020"
},
{
"name": "CVE-2026-43116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43116"
},
{
"name": "CVE-2026-64340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64340"
},
{
"name": "CVE-2026-64007",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64007"
},
{
"name": "CVE-2026-64567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64567"
},
{
"name": "CVE-2026-64450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64450"
},
{
"name": "CVE-2026-64114",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64114"
},
{
"name": "CVE-2026-74255",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74255"
},
{
"name": "CVE-2026-64266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64266"
},
{
"name": "CVE-2025-40022",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40022"
},
{
"name": "CVE-2026-43363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43363"
},
{
"name": "CVE-2026-64088",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64088"
},
{
"name": "CVE-2026-74616",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74616"
},
{
"name": "CVE-2026-74550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74550"
},
{
"name": "CVE-2026-64002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64002"
},
{
"name": "CVE-2026-72288",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72288"
},
{
"name": "CVE-2026-52977",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52977"
},
{
"name": "CVE-2026-64564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64564"
},
{
"name": "CVE-2026-64011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64011"
},
{
"name": "CVE-2026-64317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64317"
},
{
"name": "CVE-2026-68154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68154"
}
],
"initial_release_date": "2026-09-25T00:00:00",
"last_revision_date": "2026-09-25T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1231",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-25T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de SUSE. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de SUSE",
"vendor_advisories": [
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20264320-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264320-1"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:23763-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623763-1"
},
{
"published_at": "2026-09-23",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20264310-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264310-1"
},
{
"published_at": "2026-09-17",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:23801-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623801-1"
},
{
"published_at": "2026-09-22",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:4284-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264284-1"
},
{
"published_at": "2026-09-23",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20264312-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264312-1"
},
{
"published_at": "2026-09-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:23797-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623797-1"
},
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:4342-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264342-1"
},
{
"published_at": "2026-09-22",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:4279-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264279-1"
},
{
"published_at": "2026-09-23",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:4315-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264315-1"
},
{
"published_at": "2026-09-17",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:4259-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264259-1"
},
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:4328-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264328-1"
},
{
"published_at": "2026-09-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:23790-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623790-1"
},
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:4340-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264340-1"
},
{
"published_at": "2026-09-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:23791-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623791-1"
},
{
"published_at": "2026-09-23",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE suse-su-20264299-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264299-1"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:23764-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623764-1"
},
{
"published_at": "2026-09-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:23789-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623789-1"
},
{
"published_at": "2026-09-22",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:4282-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264282-1"
},
{
"published_at": "2026-09-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:23798-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623798-1"
},
{
"published_at": "2026-09-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:23799-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623799-1"
},
{
"published_at": "2026-09-17",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:4258-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264258-1"
},
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:4347-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264347-1"
},
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:4344-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264344-1"
},
{
"published_at": "2026-09-24",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:4336-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20264336-1"
},
{
"published_at": "2026-09-15",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:23781-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202623781-1"
}
]
}
CVE-2026-46108 (GCVE-0-2026-46108)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-06-14 17:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipmi:si: Return state to normal if message allocation fails
There were places where nothing would get started if a message
allocation failed, so the driver needs to return to normal state.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_si_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c204fab7f76a055eac346e3b1a75c6b4bb99600e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ab48817aebe4d831f87d4da6f94f50498c130d9e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9c6ded95ac6281e390d167637ccbde6cea2ba1ae",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ce905b65e649eee378a0f37e8219f1d70efb3007",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "88881dc1da86064f479378bc9d0a4956c3d0bb12",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bc13fce9eeec88c4950924754c3347c6dc66ff4c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ba60140d4133231b49185ac8bf6e54f318d3134e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "09dd798270ff582d7309f285d4aaf5dbebae01cb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_si_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi:si: Return state to normal if message allocation fails\n\nThere were places where nothing would get started if a message\nallocation failed, so the driver needs to return to normal state."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:55:01.962Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c204fab7f76a055eac346e3b1a75c6b4bb99600e"
},
{
"url": "https://git.kernel.org/stable/c/ab48817aebe4d831f87d4da6f94f50498c130d9e"
},
{
"url": "https://git.kernel.org/stable/c/9c6ded95ac6281e390d167637ccbde6cea2ba1ae"
},
{
"url": "https://git.kernel.org/stable/c/ce905b65e649eee378a0f37e8219f1d70efb3007"
},
{
"url": "https://git.kernel.org/stable/c/88881dc1da86064f479378bc9d0a4956c3d0bb12"
},
{
"url": "https://git.kernel.org/stable/c/bc13fce9eeec88c4950924754c3347c6dc66ff4c"
},
{
"url": "https://git.kernel.org/stable/c/ba60140d4133231b49185ac8bf6e54f318d3134e"
},
{
"url": "https://git.kernel.org/stable/c/09dd798270ff582d7309f285d4aaf5dbebae01cb"
}
],
"title": "ipmi:si: Return state to normal if message allocation fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46108",
"datePublished": "2026-05-28T09:35:14.978Z",
"dateReserved": "2026-05-13T15:03:33.098Z",
"dateUpdated": "2026-06-14T17:55:01.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64581 (GCVE-0-2026-64581)
Vulnerability from cvelistv5
Published
2026-08-05 08:09
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(),
i.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with
rcu_dereference_protected(), stores NULL and dst_release()s the old dst.
That is only safe if no other thread modifies sk_dst_cache concurrently.
For a connected UDP socket that does not hold: the transmit fast path
(udp_sendmsg -> sk_dst_check -> sk_dst_reset) resets the cache locklessly
with an atomic xchg(). A per-socket policy change racing a send can make
both sides observe the same old dst and each dst_release() it, dropping
the socket's single reference twice and freeing the xfrm_dst bundle while
it is still referenced:
BUG: KASAN: slab-use-after-free in dst_release
Write of size 4 at addr ffff88801897b6c0 by task exploit/155
Call Trace:
...
dst_release (... ./include/linux/rcuref.h:109)
xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053)
do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347)
ip_setsockopt (net/ipv4/ip_sockglue.c:1417)
do_sock_setsockopt (net/socket.c:2368)
__sys_setsockopt (net/socket.c:2393)
__x64_sys_setsockopt (net/socket.c:2396)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Reachable by an unprivileged user via a user+network namespace.
Use the atomic sk_dst_reset() so the cache is cleared and released with a
single xchg(): whichever side wins releases the dst once, the other sees
NULL and does nothing. Behaviour is otherwise unchanged.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 72f157be2f81910ae759bfe2e5c2256fc4625645 Version: 9e9fe58a92a46c6d154d2901735bf230d91b8507 Version: adc1ec6cdc20d430aa01b86497220709b9149466 Version: b54033eb1cfd77aba471269ddd804ed8d3e35dea Version: c9e82cb34c3c2ee895af01bc899c6ed0bc6eb04a Version: 5eef9b51114fcc65651d671add52f267f91b9451 Version: 3.16.52 ≤ Version: 4.4.163 ≤ Version: 3.18.101 ≤ Version: 4.1.52 ≤ Version: 4.4.123 ≤ Version: 4.9.89 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:43:16.753183Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:43.050Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e8686fd8d18b99f3a9038683045b2f2338a7706d",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "a9340ebdc13f8bb5063c0bc0b037ee7e640d4ae9",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "f833821e4b52ab6335d443ede5fb79c38e61d19a",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "f0ab9a71167bae308e05ab13b65e2007504a603f",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "8dd8929b71c4f06c614f8f54c2cc070453faae16",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "0ea8f06454012d9e7f9c6e6253df710949bf6294",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "96b678d08268b5f5c6fc99d4289d9b7e334fc683",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "c283e9ada7fcb7dd4b10592623086b2e6d2f9925",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"status": "affected",
"version": "72f157be2f81910ae759bfe2e5c2256fc4625645",
"versionType": "git"
},
{
"status": "affected",
"version": "9e9fe58a92a46c6d154d2901735bf230d91b8507",
"versionType": "git"
},
{
"status": "affected",
"version": "adc1ec6cdc20d430aa01b86497220709b9149466",
"versionType": "git"
},
{
"status": "affected",
"version": "b54033eb1cfd77aba471269ddd804ed8d3e35dea",
"versionType": "git"
},
{
"status": "affected",
"version": "c9e82cb34c3c2ee895af01bc899c6ed0bc6eb04a",
"versionType": "git"
},
{
"status": "affected",
"version": "5eef9b51114fcc65651d671add52f267f91b9451",
"versionType": "git"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.52",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.163",
"versionType": "semver"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.101",
"versionType": "semver"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.52",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.123",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.89",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.101",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.89",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix sk_dst_cache double-free in xfrm_user_policy()\n\nxfrm_user_policy() clears the socket dst cache with __sk_dst_reset(),\ni.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with\nrcu_dereference_protected(), stores NULL and dst_release()s the old dst.\nThat is only safe if no other thread modifies sk_dst_cache concurrently.\n\nFor a connected UDP socket that does not hold: the transmit fast path\n(udp_sendmsg -\u003e sk_dst_check -\u003e sk_dst_reset) resets the cache locklessly\nwith an atomic xchg(). A per-socket policy change racing a send can make\nboth sides observe the same old dst and each dst_release() it, dropping\nthe socket\u0027s single reference twice and freeing the xfrm_dst bundle while\nit is still referenced:\n\n BUG: KASAN: slab-use-after-free in dst_release\n Write of size 4 at addr ffff88801897b6c0 by task exploit/155\n Call Trace:\n ...\n dst_release (... ./include/linux/rcuref.h:109)\n xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053)\n do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347)\n ip_setsockopt (net/ipv4/ip_sockglue.c:1417)\n do_sock_setsockopt (net/socket.c:2368)\n __sys_setsockopt (net/socket.c:2393)\n __x64_sys_setsockopt (net/socket.c:2396)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nReachable by an unprivileged user via a user+network namespace.\n\nUse the atomic sk_dst_reset() so the cache is cleared and released with a\nsingle xchg(): whichever side wins releases the dst once, the other sees\nNULL and does nothing. Behaviour is otherwise unchanged."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Triggered via setsockopt(IP_XFRM_POLICY/IP_IPSEC_POLICY) on a local socket racing concurrent udp_sendmsg; entry is a local syscall path (do_ip_setsockopt -\u003e xfrm_user_policy), not packet processing.\nAC:L - Attacker controls both sides of the race (one thread setsockopt to clear/apply per-socket xfrm policy, another sendmsg on the same connected UDP socket) and can create the obsolete xfrm_dst precondition in their netns, retrying until the double dst_release wins.\nPR:L - Path requires CAP_NET_ADMIN checked with sockopt_ns_capable(sock_net(sk)-\u003euser_ns), which an unprivileged user obtains via user+network namespaces; the fix commit explicitly states this reachability.\nUI:N - Exploitation uses only the attacker\u0027s own socket, threads, and setsockopt/sendmsg loops; no victim action or cooperation is required.\nS:U - Double-free/UAF of the socket\u0027s dst_entry/xfrm_dst is standard local kernel memory corruption within the host kernel authority, not a VM escape or other cross-boundary impact.\nC:H - Double dst_release frees the xfrm_dst slab object while still referenced, yielding a use-after-free that can be reclaimed/sprayed to disclose kernel memory via corrupted dst contents and ops.\nI:H - The UAF targets a dst_entry with function pointers (ops/input/output) used on transmit, enabling heap reuse for arbitrary write and control-flow hijack consistent with comparable sk_dst_cache races.\nA:H - The KASAN slab-use-after-free in dst_release demonstrates kernel memory corruption that can oops/panic, and the attacker can repeat the race freely."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:44.254Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e8686fd8d18b99f3a9038683045b2f2338a7706d"
},
{
"url": "https://git.kernel.org/stable/c/a9340ebdc13f8bb5063c0bc0b037ee7e640d4ae9"
},
{
"url": "https://git.kernel.org/stable/c/f833821e4b52ab6335d443ede5fb79c38e61d19a"
},
{
"url": "https://git.kernel.org/stable/c/f0ab9a71167bae308e05ab13b65e2007504a603f"
},
{
"url": "https://git.kernel.org/stable/c/8dd8929b71c4f06c614f8f54c2cc070453faae16"
},
{
"url": "https://git.kernel.org/stable/c/0ea8f06454012d9e7f9c6e6253df710949bf6294"
},
{
"url": "https://git.kernel.org/stable/c/96b678d08268b5f5c6fc99d4289d9b7e334fc683"
},
{
"url": "https://git.kernel.org/stable/c/c283e9ada7fcb7dd4b10592623086b2e6d2f9925"
}
],
"title": "xfrm: fix sk_dst_cache double-free in xfrm_user_policy()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64581",
"datePublished": "2026-08-05T08:09:35.556Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-10-19T20:48:43.050Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53374 (GCVE-0-2026-53374)
Vulnerability from cvelistv5
Published
2026-07-19 10:01
Modified
2026-10-19 20:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: zero-initialize GART table on allocation
GART TLB is flushed after unmapping but not after mapping. Since
amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a
single PTE is written the TLB may speculatively load other uninitialized
entries from the same cacheline. Those garbage entries can appear valid,
and a subsequent write to another PTE in the same cacheline may cause the
GPU to use a stale garbage PTE from the TLB.
Fix this by calling memset_io() to zero-initialize the GART table with
gart_pte_flags immediately after allocation.
Using AMDGPU_GEM_CREATE_VRAM_CLEARED, SDMA-based clear will not work
since SDMA needs GART to be initialized to work.
(cherry picked from commit d9af8263b82b6eaa60c5718e0c6631c5037e4b24)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:29:33.338896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457 Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:07:45.100Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "40df11255d71b02e20e70579f1b12b687e396e26",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "91fbb5e635c8fb1b49e15c19da06480089ef719f",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "8ae8b9e74bab94aab1d79f1688129bcc61c8b29a",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "b17175d0a375b3ed5e81597dac4983fdb46e478d",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "791941be5da125d9a1b228582bfdc300c05d05b3",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: zero-initialize GART table on allocation\n\nGART TLB is flushed after unmapping but not after mapping. Since\namdgpu_bo_create_kernel() does not zero-initialize the buffer, when a\nsingle PTE is written the TLB may speculatively load other uninitialized\nentries from the same cacheline. Those garbage entries can appear valid,\nand a subsequent write to another PTE in the same cacheline may cause the\nGPU to use a stale garbage PTE from the TLB.\n\nFix this by calling memset_io() to zero-initialize the GART table with\ngart_pte_flags immediately after allocation.\n\nUsing AMDGPU_GEM_CREATE_VRAM_CLEARED, SDMA-based clear will not work\nsince SDMA needs GART to be initialized to work.\n\n(cherry picked from commit d9af8263b82b6eaa60c5718e0c6631c5037e4b24)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached when a local process with access to /dev/dri/renderD* issues AMDGPU DRM ioctls (GEM_CREATE, CS) that bind GTT buffers through amdgpu_ttm_backend_bind() \u2192 amdgpu_gart_bind(), writing GART PTEs without a TLB flush. This is a local GPU driver ioctl path, not a network protocol.\nAC:L - An attacker with render-node access can reliably trigger GART PTE writes by allocating and binding GTT-domain buffers via standard ioctls; they control mapping timing and concurrency. Uninitialized VRAM contents at driver init are not an attacker-uncontrollable gate for triggering the stale-TLB condition.\nPR:L - All AMDGPU GEM/CS ioctls require DRM_AUTH|DRM_RENDER_ALLOW, which is satisfied by membership in the render/video group on typical desktop, workstation, and cloud-GPU instances\u2014not real root in the init namespace.\nUI:N - Exploitation requires only programmatic ioctl and GPU command submission; no victim interaction such as opening files or mounting filesystems is needed beyond the attacker already having render-node access.\nS:C - Stale garbage GART PTEs in the GPU TLB can cause the GPU to DMA to/from arbitrary physical pages outside the driver\u0027s intended mappings, bypassing the GART/IOMMU address-translation boundary that is supposed to confine GPU memory access.\nC:H - Speculatively loaded garbage PTEs that appear valid can redirect GPU reads to unintended physical memory, including kernel and other processes\u0027 pages, constituting arbitrary memory disclosure via rogue DMA.\nI:H - Those same stale valid PTEs can redirect GPU writes to arbitrary physical addresses, enabling arbitrary memory corruption and potential code execution through DMA write primitives.\nA:H - GPU DMA through invalid or garbage PTEs to unintended physical addresses can cause IOMMU faults, machine checks, GPU hangs, or kernel oops/panic, producing full system availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:35:18.594Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/40df11255d71b02e20e70579f1b12b687e396e26"
},
{
"url": "https://git.kernel.org/stable/c/91fbb5e635c8fb1b49e15c19da06480089ef719f"
},
{
"url": "https://git.kernel.org/stable/c/8ae8b9e74bab94aab1d79f1688129bcc61c8b29a"
},
{
"url": "https://git.kernel.org/stable/c/b17175d0a375b3ed5e81597dac4983fdb46e478d"
},
{
"url": "https://git.kernel.org/stable/c/791941be5da125d9a1b228582bfdc300c05d05b3"
},
{
"url": "https://git.kernel.org/stable/c/e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741"
}
],
"title": "drm/amdgpu: zero-initialize GART table on allocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53374",
"datePublished": "2026-07-19T10:01:58.292Z",
"dateReserved": "2026-06-09T07:44:35.401Z",
"dateUpdated": "2026-10-19T20:07:45.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64562 (GCVE-0-2026-64562)
Vulnerability from cvelistv5
Published
2026-08-04 06:23
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
free_nested() frees the shadow VMCS while vmcs01 still points to it. But
because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU
might migrate before the pointer is cleared and __loaded_vmcs_clear()
may then execute VMCLEAR.
The VMCS needs to stay attached until its explicit VMCLEAR completes, but
then it can be hidden and the page safely freed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 Version: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 Version: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 Version: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 Version: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 Version: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 Version: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 Version: 355f4fb1405ec29d0fac49b4d41fcd78cbd455d5 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64562",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:52.528075Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:41.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b82c3144d8264265448292ca406f60bafeba3b6f",
"status": "affected",
"version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
"versionType": "git"
},
{
"lessThan": "4f50e6aec16f69627dbad5704d1e90a255d766a7",
"status": "affected",
"version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
"versionType": "git"
},
{
"lessThan": "dc3eecfa219ebc9d01eaf7d1abd1441efe884dab",
"status": "affected",
"version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
"versionType": "git"
},
{
"lessThan": "af56298e9d86e6098cd1d2e155cb2949b7c45412",
"status": "affected",
"version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
"versionType": "git"
},
{
"lessThan": "589419470030a89f16cf19300658b6dc644ca946",
"status": "affected",
"version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
"versionType": "git"
},
{
"lessThan": "8001d2ce9d9bd09118ce523aef595aa094573ae3",
"status": "affected",
"version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
"versionType": "git"
},
{
"lessThan": "1dabef6e206568bf9d9ade74f6e56a48ea35695d",
"status": "affected",
"version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
"versionType": "git"
},
{
"lessThan": "622ebfac01ba4f9c0060cebd41257fe46fc4a0b3",
"status": "affected",
"version": "355f4fb1405ec29d0fac49b4d41fcd78cbd455d5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/vmx/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nVMX: Hide shadow VMCS right after VMCLEAR\n\nfree_nested() frees the shadow VMCS while vmcs01 still points to it. But\nbecause it is asynchronous with respect to loaded_vmcs_clear(), the vCPU\nmight migrate before the pointer is cleared and __loaded_vmcs_clear()\nmay then execute VMCLEAR.\n\nThe VMCS needs to stay attached until its explicit VMCLEAR completes, but\nthen it can be hidden and the page safely freed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached through local KVM nested VMX: open /dev/kvm, run a nested guest, then tear down nested state (VMXOFF/handle_vmxoff or vmx_leave_nested). It is not reachable via network or adjacent-radio packets.\nAC:L - A KVM VMM attacker controls both sides of the race by driving nested teardown (VMXOFF/vcpu destroy) while forcing vCPU migration via thread affinity/scheduling so __loaded_vmcs_clear() VMCLEARs the dangling shadow VMCS pointer.\nPR:L - Exploitation needs permission to use /dev/kvm and nested VMX (commonly kvm-group or equivalent), not real init-namespace root; KVM create/run ioctls have no CAP_SYS_ADMIN gate on this path.\nUI:N - After the attacker has KVM/nested access, they trigger free_nested and migration themselves; no separate victim action is required.\nS:C - free_nested runs in host KVM while handling L1 nested VMX teardown, and the UAF corrupts host kernel memory, crossing the guest/hypervisor isolation boundary (guest-to-host escape class).\nC:H - The dangling shadow VMCS pointer lets VMCLEAR operate on a freed page that may be reused, yielding a host kernel use-after-free that can be leveraged for arbitrary information disclosure.\nI:H - VMCLEAR writes VMCS state into the freed page; with page reuse this is host heap corruption enabling write primitives and potential host code execution, consistent with UAF guidance.\nA:H - Use-after-free of the shadow VMCS page can oops/panic the host kernel when VMCLEAR or later accessors touch reallocated memory, fully denying host availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:32.954Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b82c3144d8264265448292ca406f60bafeba3b6f"
},
{
"url": "https://git.kernel.org/stable/c/4f50e6aec16f69627dbad5704d1e90a255d766a7"
},
{
"url": "https://git.kernel.org/stable/c/dc3eecfa219ebc9d01eaf7d1abd1441efe884dab"
},
{
"url": "https://git.kernel.org/stable/c/af56298e9d86e6098cd1d2e155cb2949b7c45412"
},
{
"url": "https://git.kernel.org/stable/c/589419470030a89f16cf19300658b6dc644ca946"
},
{
"url": "https://git.kernel.org/stable/c/8001d2ce9d9bd09118ce523aef595aa094573ae3"
},
{
"url": "https://git.kernel.org/stable/c/1dabef6e206568bf9d9ade74f6e56a48ea35695d"
},
{
"url": "https://git.kernel.org/stable/c/622ebfac01ba4f9c0060cebd41257fe46fc4a0b3"
}
],
"title": "KVM: nVMX: Hide shadow VMCS right after VMCLEAR",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64562",
"datePublished": "2026-08-04T06:23:21.855Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-10-19T20:48:41.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23003 (GCVE-0-2026-23003)
Vulnerability from cvelistv5
Published
2026-01-25 14:36
Modified
2026-10-19 18:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
Blamed commit did not take care of VLAN encapsulations
as spotted by syzbot [1].
Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull().
[1]
BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]
BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]
BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321
__INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]
INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]
IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321
ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729
__ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860
ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903
gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1
ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438
ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489
NF_HOOK include/linux/netfilter.h:318 [inline]
ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500
ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590
dst_input include/net/dst.h:474 [inline]
ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79
NF_HOOK include/linux/netfilter.h:318 [inline]
ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311
__netif_receive_skb_one_core net/core/dev.c:6139 [inline]
__netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252
netif_receive_skb_internal net/core/dev.c:6338 [inline]
netif_receive_skb+0x57/0x630 net/core/dev.c:6397
tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485
tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953
tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0xbe2/0x15d0 fs/read_write.c:686
ksys_write fs/read_write.c:738 [inline]
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746
x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was created at:
slab_post_alloc_hook mm/slub.c:4960 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315
kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586
__alloc_skb+0x805/0x1040 net/core/skbuff.c:690
alloc_skb include/linux/skbuff.h:1383 [inline]
alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712
sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995
tun_alloc_skb drivers/net/tun.c:1461 [inline]
tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794
tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0xbe2/0x15d0 fs/read_write.c:686
ksys_write fs/read_write.c:738 [inline]
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746
x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
CPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a9bc32879a08f23cdb80a48c738017e39aea1080 Version: af6b5c50d47ab43e5272ad61935d0ed2e264d3f0 Version: d54e4da98bbfa8c257bdca94c49652d81d18a4d8 Version: 350a6640fac4b53564ec20aa3f4a0922cb0ba5e6 Version: 8d975c15c0cd744000ca386247432d57b21f9df0 Version: 8d975c15c0cd744000ca386247432d57b21f9df0 Version: 8d975c15c0cd744000ca386247432d57b21f9df0 Version: c835df3bcc14858ae9b27315dd7de76370b94f3a Version: 5.10.210 ≤ Version: 5.15.149 ≤ Version: 6.1.77 ≤ Version: 6.6.16 ≤ Version: 6.7.4 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23003",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T20:17:50.477974Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457 Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:25:27.372Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:12:33.064Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f9c5c5b791d3850570796f9e067629474e613796",
"status": "affected",
"version": "a9bc32879a08f23cdb80a48c738017e39aea1080",
"versionType": "git"
},
{
"lessThan": "64c71d60a21a9ed0a802483dcd422b5b24eb1abe",
"status": "affected",
"version": "af6b5c50d47ab43e5272ad61935d0ed2e264d3f0",
"versionType": "git"
},
{
"lessThan": "9e1c8c2a33d0a7b1f637b5d0602fe56ed10166af",
"status": "affected",
"version": "d54e4da98bbfa8c257bdca94c49652d81d18a4d8",
"versionType": "git"
},
{
"lessThan": "2f03dafea0a8096a2eb60f551218b360e5bab9a3",
"status": "affected",
"version": "350a6640fac4b53564ec20aa3f4a0922cb0ba5e6",
"versionType": "git"
},
{
"lessThan": "df5ffde9669314500809bc498ae73d6d3d9519ac",
"status": "affected",
"version": "8d975c15c0cd744000ca386247432d57b21f9df0",
"versionType": "git"
},
{
"lessThan": "b9f915340f25cae1562f18e1eb52deafca328414",
"status": "affected",
"version": "8d975c15c0cd744000ca386247432d57b21f9df0",
"versionType": "git"
},
{
"lessThan": "81c734dae203757fb3c9eee6f9896386940776bd",
"status": "affected",
"version": "8d975c15c0cd744000ca386247432d57b21f9df0",
"versionType": "git"
},
{
"status": "affected",
"version": "c835df3bcc14858ae9b27315dd7de76370b94f3a",
"versionType": "git"
},
{
"lessThan": "5.10.249",
"status": "affected",
"version": "5.10.210",
"versionType": "semver"
},
{
"lessThan": "5.15.199",
"status": "affected",
"version": "5.15.149",
"versionType": "semver"
},
{
"lessThan": "6.1.162",
"status": "affected",
"version": "6.1.77",
"versionType": "semver"
},
{
"lessThan": "6.6.122",
"status": "affected",
"version": "6.6.16",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.249",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.199",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.162",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.122",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.67",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.249",
"versionStartIncluding": "5.10.210",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.199",
"versionStartIncluding": "5.15.149",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.162",
"versionStartIncluding": "6.1.77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.122",
"versionStartIncluding": "6.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.67",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.7",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()\n\nBlamed commit did not take care of VLAN encapsulations\nas spotted by syzbot [1].\n\nUse skb_vlan_inet_prepare() instead of pskb_inet_may_pull().\n\n[1]\n BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline]\n INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline]\n IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321\n ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729\n __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860\n ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903\n gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1\n ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438\n ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489\n NF_HOOK include/linux/netfilter.h:318 [inline]\n ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500\n ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590\n dst_input include/net/dst.h:474 [inline]\n ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79\n NF_HOOK include/linux/netfilter.h:318 [inline]\n ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311\n __netif_receive_skb_one_core net/core/dev.c:6139 [inline]\n __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252\n netif_receive_skb_internal net/core/dev.c:6338 [inline]\n netif_receive_skb+0x57/0x630 net/core/dev.c:6397\n tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485\n tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953\n tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999\n new_sync_write fs/read_write.c:593 [inline]\n vfs_write+0xbe2/0x15d0 fs/read_write.c:686\n ksys_write fs/read_write.c:738 [inline]\n __do_sys_write fs/read_write.c:749 [inline]\n __se_sys_write fs/read_write.c:746 [inline]\n __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746\n x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4960 [inline]\n slab_alloc_node mm/slub.c:5263 [inline]\n kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315\n kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586\n __alloc_skb+0x805/0x1040 net/core/skbuff.c:690\n alloc_skb include/linux/skbuff.h:1383 [inline]\n alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712\n sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995\n tun_alloc_skb drivers/net/tun.c:1461 [inline]\n tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794\n tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999\n new_sync_write fs/read_write.c:593 [inline]\n vfs_write+0xbe2/0x15d0 fs/read_write.c:686\n ksys_write fs/read_write.c:738 [inline]\n __do_sys_write fs/read_write.c:749 [inline]\n __se_sys_write fs/read_write.c:746 [inline]\n __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746\n x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - __ip6_tnl_rcv() is reached from IPv6 packet receive via registered IPv6 tunnel/GRE protocol handlers, so a remote peer can trigger it by sending crafted tunneled IPv6/GRE packets to an exposed tunnel endpoint.\nAC:L - The attacker controls the tunneled packet format, including VLAN encapsulation, and there is no race or hard-to-hit timing condition.\nPR:N - Tunnel setup is privileged, but once the affected tunnel endpoint exists, the packet receive path has no attacker credential or authentication requirement.\nUI:N - Processing occurs automatically on packet receipt and does not require any victim user action.\nS:U - The bug affects kernel packet processing within the same host security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The bug is an uninitialized value use in ECN decapsulation, but the investigated path does not expose the uninitialized kernel data to the attacker.\nI:N - The malformed packet can affect ECN/DSCP handling for that packet, but there is no evidence of arbitrary data modification or control-flow corruption.\nA:H - The reachable KMSAN BUG/oops path demonstrates that crafted packets can trigger a kernel fault condition, which is scored as high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:20:05.561Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f9c5c5b791d3850570796f9e067629474e613796"
},
{
"url": "https://git.kernel.org/stable/c/64c71d60a21a9ed0a802483dcd422b5b24eb1abe"
},
{
"url": "https://git.kernel.org/stable/c/9e1c8c2a33d0a7b1f637b5d0602fe56ed10166af"
},
{
"url": "https://git.kernel.org/stable/c/2f03dafea0a8096a2eb60f551218b360e5bab9a3"
},
{
"url": "https://git.kernel.org/stable/c/df5ffde9669314500809bc498ae73d6d3d9519ac"
},
{
"url": "https://git.kernel.org/stable/c/b9f915340f25cae1562f18e1eb52deafca328414"
},
{
"url": "https://git.kernel.org/stable/c/81c734dae203757fb3c9eee6f9896386940776bd"
}
],
"title": "ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23003",
"datePublished": "2026-01-25T14:36:17.491Z",
"dateReserved": "2026-01-13T15:37:45.939Z",
"dateUpdated": "2026-10-19T18:25:27.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72072 (GCVE-0-2026-72072)
Vulnerability from cvelistv5
Published
2026-08-15 05:52
Modified
2026-10-19 21:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed
the per-SC metadata_dst with metadata_dst_free(), which kfree()s the
object unconditionally and ignores the dst reference count. The RX
datapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under
rcu_read_lock() via xa_load(), takes a reference with dst_hold() and
attaches the dst to the skb with skb_dst_set(). A reader that already
obtained the rx_sc pointer can race with the delete path and operate on
freed memory.
Fix the owner side by dropping the reference with dst_release() instead
of freeing unconditionally, and convert the RX datapath to
dst_hold_safe() so a reader racing the SC delete cannot attach a dst
whose last reference was just dropped; only attach it when a reference
was actually taken.
mlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_alloc()
before rx_sc->md_dst was allocated and initialised, so a datapath reader
that looked the SC up by fs_id could observe rx_sc with md_dst still
NULL or, on weakly-ordered architectures, a non-NULL md_dst pointer
whose contents were not yet visible. NULL-check the xa_load() result and
md_dst on the datapath, and reorder add_rxsc() so the xa_alloc() publish
happens only after md_dst is fully initialised; the xarray RCU publish
then pairs with the rcu_read_lock()/xa_load() in the datapath.
Note: macsec_del_rxsc_ctx() also kfree()s rx_sc->sc_xarray_element
without an RCU grace period while the same datapath reads it under
rcu_read_lock(); that is a separate pre-existing issue left to a
follow-up patch.
Found by 0sec automated security-research tooling (https://0sec.ai).
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b7c9400cbc48c3713190b3bce4e0c87e924e4104 Version: b7c9400cbc48c3713190b3bce4e0c87e924e4104 Version: b7c9400cbc48c3713190b3bce4e0c87e924e4104 Version: b7c9400cbc48c3713190b3bce4e0c87e924e4104 Version: b7c9400cbc48c3713190b3bce4e0c87e924e4104 Version: b7c9400cbc48c3713190b3bce4e0c87e924e4104 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72072",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:51:23.230539Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:26.618Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b1a4d0c568bbb52c7c04f4fce3c097dae89ed6cb",
"status": "affected",
"version": "b7c9400cbc48c3713190b3bce4e0c87e924e4104",
"versionType": "git"
},
{
"lessThan": "218cc15a4c907659ad4b0e68c535c61594311205",
"status": "affected",
"version": "b7c9400cbc48c3713190b3bce4e0c87e924e4104",
"versionType": "git"
},
{
"lessThan": "4a5073b7b30243658f58b2d2d35a823da7fd34d9",
"status": "affected",
"version": "b7c9400cbc48c3713190b3bce4e0c87e924e4104",
"versionType": "git"
},
{
"lessThan": "ed3cc4218070d6b98bf5fb456dccae424fd38c4f",
"status": "affected",
"version": "b7c9400cbc48c3713190b3bce4e0c87e924e4104",
"versionType": "git"
},
{
"lessThan": "088873af13590ebde10de2ade847f57a05ec61c6",
"status": "affected",
"version": "b7c9400cbc48c3713190b3bce4e0c87e924e4104",
"versionType": "git"
},
{
"lessThan": "de74d8fd10291763d97b218f09adcc7513c975e4",
"status": "affected",
"version": "b7c9400cbc48c3713190b3bce4e0c87e924e4104",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete\n\nWhen an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed\nthe per-SC metadata_dst with metadata_dst_free(), which kfree()s the\nobject unconditionally and ignores the dst reference count. The RX\ndatapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under\nrcu_read_lock() via xa_load(), takes a reference with dst_hold() and\nattaches the dst to the skb with skb_dst_set(). A reader that already\nobtained the rx_sc pointer can race with the delete path and operate on\nfreed memory.\n\nFix the owner side by dropping the reference with dst_release() instead\nof freeing unconditionally, and convert the RX datapath to\ndst_hold_safe() so a reader racing the SC delete cannot attach a dst\nwhose last reference was just dropped; only attach it when a reference\nwas actually taken.\n\nmlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_alloc()\nbefore rx_sc-\u003emd_dst was allocated and initialised, so a datapath reader\nthat looked the SC up by fs_id could observe rx_sc with md_dst still\nNULL or, on weakly-ordered architectures, a non-NULL md_dst pointer\nwhose contents were not yet visible. NULL-check the xa_load() result and\nmd_dst on the datapath, and reorder add_rxsc() so the xa_alloc() publish\nhappens only after md_dst is fully initialised; the xarray RCU publish\nthen pairs with the rcu_read_lock()/xa_load() in the datapath.\n\nNote: macsec_del_rxsc_ctx() also kfree()s rx_sc-\u003esc_xarray_element\nwithout an RCU grace period while the same datapath reads it under\nrcu_read_lock(); that is a separate pre-existing issue left to a\nfollow-up patch.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached by racing MACSEC_CMD_DEL_RXSC/ADD_RXSC netlink configuration (GENL_ADMIN_PERM) against mlx5e MACsec RX processing; the privileged genlink/rtnl control path is required to trigger the bug, not remote packets alone.\nAC:L - An attacker with CAP_NET_ADMIN can drive both sides by looping RX SC add/delete while flooding MACsec-offloaded RX traffic on the mlx5e netdev, reliably winning the RCU race between xa_load/dst_hold and metadata_dst_free.\nPR:L - MACsec offload mutations require GENL_ADMIN_PERM (CAP_NET_ADMIN); on Mellanox ConnectX/BlueField systems this is reachable by cloud tenants with SR-IOV VFs, containers, or user/network namespaces without init-namespace root.\nUI:N - No victim user action is needed; automated concurrent netlink MACsec operations and incoming MACsec-offloaded frames on an active mlx5e interface suffice once MACsec offload is configured.\nS:U - Impact is kernel heap use-after-free and memory corruption within the host kernel on the mlx5 NIC; it enables local privilege escalation but does not by itself cross VM, IOMMU, or hypervisor security boundaries.\nC:H - The race calls dst_hold() and skb_dst_set() on a freed metadata_dst, a classic slab UAF that can disclose kernel memory through subsequent dst_entry and MACsec skb metadata handling.\nI:H - Freed metadata_dst objects can be reallocated via heap spraying while the RX datapath still references them, enabling refcount corruption and arbitrary kernel memory writes or control-flow hijack beyond a mere crash.\nA:H - Concurrent use of freed md_dst during mlx5e MACsec RX processing can cause immediate kernel oops, BUG, or panic on datacenter/cloud hosts using mlx5 hardware MACsec offload, fully denying system availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:40:03.099Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b1a4d0c568bbb52c7c04f4fce3c097dae89ed6cb"
},
{
"url": "https://git.kernel.org/stable/c/218cc15a4c907659ad4b0e68c535c61594311205"
},
{
"url": "https://git.kernel.org/stable/c/4a5073b7b30243658f58b2d2d35a823da7fd34d9"
},
{
"url": "https://git.kernel.org/stable/c/ed3cc4218070d6b98bf5fb456dccae424fd38c4f"
},
{
"url": "https://git.kernel.org/stable/c/088873af13590ebde10de2ade847f57a05ec61c6"
},
{
"url": "https://git.kernel.org/stable/c/de74d8fd10291763d97b218f09adcc7513c975e4"
}
],
"title": "net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72072",
"datePublished": "2026-08-15T05:52:23.946Z",
"dateReserved": "2026-08-09T03:40:39.904Z",
"dateUpdated": "2026-10-19T21:19:26.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72108 (GCVE-0-2026-72108)
Vulnerability from cvelistv5
Published
2026-08-15 05:52
Modified
2026-10-19 21:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm thin metadata: fix metadata snapshot consistency on commit failure
__reserve_metadata_snap() and __release_metadata_snap() modify the
superblock's held_root directly in the block_manager's buffer. If the
subsequent metadata commit fails, the held_root gets flushed to disk
through the abort_transaction path, resulting in inconsistent metadata.
Reproducer 1: __reserve_metadata_snap()
1. Create a 2 MiB metadata device and make the region after the 14th
block inaccessible, to trigger metadata commit failure in the
subsequent reserve_metadata_snap operation. The 14th block will be
the shadow destination for the index block.
dmsetup create tmeta --table "0 112 linear /dev/sdc 0
112 3984 error"
2. Create a 16 MiB thin-pool
dmsetup create tdata --table "0 32768 zero"
dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1
dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta \
/dev/mapper/tdata 128 0 1 skip_block_zeroing"
3. Take a metadata snapshot to trigger metadata commit failure and
transaction abort. However, the held_root is written to disk,
breaking metadata consistency.
dmsetup message tpool 0 "reserve_metadata_snap"
thin_check v1.2.2 result:
Bad reference count for metadata block 6. Expected 2, but space map contains 1.
Bad reference count for metadata block 7. Expected 2, but space map contains 1.
Bad reference count for metadata block 13. Expected 1, but space map contains 0.
Reproducer 2: __release_metadata_snap()
1. Create a 2 MiB metadata device and make the region after the 16th
block inaccessible, to trigger metadata commit failure in the
subsequent release_metadata_snap operation. The 16th block will be
the shadow destination for the index block.
dmsetup create tmeta --table "0 128 linear /dev/sdc 0
128 3968 error"
2. Create a 16 MiB thin-pool
dmsetup create tdata --table "0 32768 zero"
dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1
dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta \
/dev/mapper/tdata 128 0 1 skip_block_zeroing"
3. Reserve then release the metadata snapshot, to trigger metadata
commit failure and transaction abort. The held_root gets removed
from the on-disk superblock, causing inconsistent metadata.
dmsetup message tpool 0 "reserve_metadata_snap"
dmsetup message tpool 0 "release_metadata_snap"
thin_check v1.2.2 result:
Bad reference count for metadata block 6. Expected 1, but space map contains 2.
Bad reference count for metadata block 7. Expected 1, but space map contains 2.
1 metadata blocks have leaked.
Fix by deferring the held_root update to commit time.
Additionally, move the existing-snapshot check in __reserve_metadata_snap
before the shadow operation to avoid unnecessary work. In
__release_metadata_snap, clear pmd->held_root before btree deletion so
partial failure leaks blocks rather than leaving a stale reference, and
unlock the snapshot block before decrementing its refcount.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5 Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5 Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5 Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5 Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5 Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5 Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5 Version: 991d9fa02da0dd1f843dc011376965e0c8c6c9b5 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:52:16.054783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-672",
"description": "CWE-672 Operation on a Resource after Expiration or Release",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:28.563Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-thin-metadata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4af993468193cf4cd32ba5748786e7801945f7d2",
"status": "affected",
"version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
"versionType": "git"
},
{
"lessThan": "abf2fae92cbe68945028987d498cc72f8f0e23a8",
"status": "affected",
"version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
"versionType": "git"
},
{
"lessThan": "5efb1a7734ed4035fa4fdc3716bdb84621f27cf6",
"status": "affected",
"version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
"versionType": "git"
},
{
"lessThan": "3dc9ae1029320d77472c44965e572f176949cd63",
"status": "affected",
"version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
"versionType": "git"
},
{
"lessThan": "b5f9a31c51cbb374a1713c3494f8660ab070f035",
"status": "affected",
"version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
"versionType": "git"
},
{
"lessThan": "7f76245960a332f39b08cc556e675d1765dc5bbb",
"status": "affected",
"version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
"versionType": "git"
},
{
"lessThan": "9f1a0d27586ceab055e6b050e3731ce3c6b2c4f0",
"status": "affected",
"version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
"versionType": "git"
},
{
"lessThan": "5bcd4d3058ebaf46ad2e163829d87dd4870c7a45",
"status": "affected",
"version": "991d9fa02da0dd1f843dc011376965e0c8c6c9b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-thin-metadata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm thin metadata: fix metadata snapshot consistency on commit failure\n\n__reserve_metadata_snap() and __release_metadata_snap() modify the\nsuperblock\u0027s held_root directly in the block_manager\u0027s buffer. If the\nsubsequent metadata commit fails, the held_root gets flushed to disk\nthrough the abort_transaction path, resulting in inconsistent metadata.\n\nReproducer 1: __reserve_metadata_snap()\n\n1. Create a 2 MiB metadata device and make the region after the 14th\n block inaccessible, to trigger metadata commit failure in the\n subsequent reserve_metadata_snap operation. The 14th block will be\n the shadow destination for the index block.\n\ndmsetup create tmeta --table \"0 112 linear /dev/sdc 0\n112 3984 error\"\n\n2. Create a 16 MiB thin-pool\n\ndmsetup create tdata --table \"0 32768 zero\"\ndd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1\ndmsetup create tpool --table \"0 32768 thin-pool /dev/mapper/tmeta \\\n/dev/mapper/tdata 128 0 1 skip_block_zeroing\"\n\n3. Take a metadata snapshot to trigger metadata commit failure and\n transaction abort. However, the held_root is written to disk,\n breaking metadata consistency.\n\ndmsetup message tpool 0 \"reserve_metadata_snap\"\n\nthin_check v1.2.2 result:\n\nBad reference count for metadata block 6. Expected 2, but space map contains 1.\nBad reference count for metadata block 7. Expected 2, but space map contains 1.\nBad reference count for metadata block 13. Expected 1, but space map contains 0.\n\nReproducer 2: __release_metadata_snap()\n\n1. Create a 2 MiB metadata device and make the region after the 16th\n block inaccessible, to trigger metadata commit failure in the\n subsequent release_metadata_snap operation. The 16th block will be\n the shadow destination for the index block.\n\ndmsetup create tmeta --table \"0 128 linear /dev/sdc 0\n128 3968 error\"\n\n2. Create a 16 MiB thin-pool\n\ndmsetup create tdata --table \"0 32768 zero\"\ndd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1\ndmsetup create tpool --table \"0 32768 thin-pool /dev/mapper/tmeta \\\n/dev/mapper/tdata 128 0 1 skip_block_zeroing\"\n\n3. Reserve then release the metadata snapshot, to trigger metadata\n commit failure and transaction abort. The held_root gets removed\n from the on-disk superblock, causing inconsistent metadata.\n\ndmsetup message tpool 0 \"reserve_metadata_snap\"\ndmsetup message tpool 0 \"release_metadata_snap\"\n\nthin_check v1.2.2 result:\n\nBad reference count for metadata block 6. Expected 1, but space map contains 2.\nBad reference count for metadata block 7. Expected 1, but space map contains 2.\n1 metadata blocks have leaked.\n\nFix by deferring the held_root update to commit time.\n\nAdditionally, move the existing-snapshot check in __reserve_metadata_snap\nbefore the shadow operation to avoid unnecessary work. In\n__release_metadata_snap, clear pmd-\u003eheld_root before btree deletion so\npartial failure leaks blocks rather than leaving a stale reference, and\nunlock the snapshot block before decrementing its refcount."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local Device Mapper ioctls (dmsetup/LVM dm messages on /dev/mapper/control); reserve_metadata_snap and release_metadata_snap have no network, adjacent-wireless, or physical-device receive path.\nAC:L - An attacker with CAP_SYS_ADMIN who controls thin-pool creation can reliably force commit failure by mapping part of the metadata device to the dm error target (per the fix reproducer), deterministically hitting the flush-then-abort race.\nPR:L - DM ioctls require CAP_SYS_ADMIN, which is obtainable inside an unprivileged user namespace per kernel CNA guidance; thin-pool administration is commonly available to container/host admins with namespace capabilities, not only init-namespace root.\nUI:N - Exploitation requires only the attacker sending reserve_metadata_snap or release_metadata_snap via dmsetup/LVM; no separate victim user action such as opening a file or mounting a filesystem is needed.\nS:U - Corruption is confined to on-disk thin-pool metadata under the same host kernel and storage-admin security authority; it is not a KVM/Xen guest-to-host escape or cross-hypervisor boundary break.\nC:H - Persistently inconsistent btree/spacemap reference counts can mis-map logical blocks to wrong physical sectors, exposing stale or other thin volumes\u0027 data on shared LVM thin pools\u2014storage-layer disclosure beyond the attacker\u0027s intended mapping.\nI:H - The same metadata inconsistency can double-allocate physical blocks or redirect writes to incorrect sectors, corrupting or overwriting other tenants\u0027 data on multi-volume thin pools until thin_repair is performed.\nA:H - Commit failure leaves durable metadata corruption (thin_check refcount errors, leaked blocks), triggers needs_check, forces the pool into read-only/fail modes, and can render the pool unusable until offline repair."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:40:21.561Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4af993468193cf4cd32ba5748786e7801945f7d2"
},
{
"url": "https://git.kernel.org/stable/c/abf2fae92cbe68945028987d498cc72f8f0e23a8"
},
{
"url": "https://git.kernel.org/stable/c/5efb1a7734ed4035fa4fdc3716bdb84621f27cf6"
},
{
"url": "https://git.kernel.org/stable/c/3dc9ae1029320d77472c44965e572f176949cd63"
},
{
"url": "https://git.kernel.org/stable/c/b5f9a31c51cbb374a1713c3494f8660ab070f035"
},
{
"url": "https://git.kernel.org/stable/c/7f76245960a332f39b08cc556e675d1765dc5bbb"
},
{
"url": "https://git.kernel.org/stable/c/9f1a0d27586ceab055e6b050e3731ce3c6b2c4f0"
},
{
"url": "https://git.kernel.org/stable/c/5bcd4d3058ebaf46ad2e163829d87dd4870c7a45"
}
],
"title": "dm thin metadata: fix metadata snapshot consistency on commit failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72108",
"datePublished": "2026-08-15T05:52:50.321Z",
"dateReserved": "2026-08-09T03:40:39.906Z",
"dateUpdated": "2026-10-19T21:19:28.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74581 (GCVE-0-2026-74581)
Vulnerability from cvelistv5
Published
2026-08-21 16:31
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: clear suppressed fib6 rule result
fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),
but leaves res->rt6 pointing at the released rt6_info.
If no later rule supplies a replacement, fib6_rule_lookup() still sees
res.rt6 and returns that stale dst to its caller. A suppressing rule can
therefore leak a released route back to rt6_lookup(), and the next put
hits rcuref_put_slowpath() from dst_release().
Clear res->rt6 when suppressing the route so suppressed lookups fall
through to the null dst instead of reusing the released one.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 209d35ee34e25f9668c404350a1c86d914c54ffa Version: 8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383 Version: cdef485217d30382f3bf6448c54b4401648fe3f1 Version: cdef485217d30382f3bf6448c54b4401648fe3f1 Version: cdef485217d30382f3bf6448c54b4401648fe3f1 Version: cdef485217d30382f3bf6448c54b4401648fe3f1 Version: cdef485217d30382f3bf6448c54b4401648fe3f1 Version: cdef485217d30382f3bf6448c54b4401648fe3f1 Version: ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29 Version: 5.10.84 ≤ Version: 5.15.7 ≤ Version: 5.4.164 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:01:10.675016Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:58.061Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/fib6_rules.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "90c57310e266eb94e4a80d6b15a9ca131d2e82cb",
"status": "affected",
"version": "209d35ee34e25f9668c404350a1c86d914c54ffa",
"versionType": "git"
},
{
"lessThan": "5d29b286c9de0b309e94b9ed083aa1a2f429434f",
"status": "affected",
"version": "8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383",
"versionType": "git"
},
{
"lessThan": "354db6243eca59e9d187ffbf8b7955b044ce84dc",
"status": "affected",
"version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
"versionType": "git"
},
{
"lessThan": "6d98c70fe0ba8c7708bfd5b2a5174d2086775daa",
"status": "affected",
"version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
"versionType": "git"
},
{
"lessThan": "9bad152c42b37499162367fe47867411e62fffa3",
"status": "affected",
"version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
"versionType": "git"
},
{
"lessThan": "dc3ab04220667f254f4348572b2a0b3febff89fb",
"status": "affected",
"version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
"versionType": "git"
},
{
"lessThan": "a341c091ca0bfae377747b1b59a3bd8ebe18a937",
"status": "affected",
"version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
"versionType": "git"
},
{
"lessThan": "6aea62e433fe1b586202a5fee8b5807ce635e1d7",
"status": "affected",
"version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
"versionType": "git"
},
{
"status": "affected",
"version": "ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29",
"versionType": "git"
},
{
"lessThan": "5.10.265",
"status": "affected",
"version": "5.10.84",
"versionType": "semver"
},
{
"lessThan": "5.15.216",
"status": "affected",
"version": "5.15.7",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.164",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/fib6_rules.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.164",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res-\u003ert6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res-\u003ert6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - fib6_rule_suppress() runs on every IPv6 route lookup via fib6_rule_lookup(), including ip6_route_input() for received packets and icmp6/icmpv6 redirect handlers; WireGuard/VPN servers commonly deploy suppress_prefixlength rules (wg-quick), so remote IPv6 traffic to those hosts reaches the bug.\nAC:L - Once suppress_prefixlength IPv6 policy routing rules exist, any matching packet deterministically triggers fib6_rule_suppress() to release the route while leaving a stale res-\u003ert6 pointer; no race or uncontrollable memory layout is required.\nPR:N - Remote exploitation needs only the ability to send IPv6 packets through a host whose operator already configured suppress rules (e.g., wg-quick); CAP_NET_ADMIN is an admin deployment prerequisite, not attacker privilege on the target.\nUI:N - No victim action is required beyond normal delivery of attacker-generated IPv6 traffic (or ICMPv6 redirect) to a host performing policy-route lookup.\nS:U - The stale rt6_info/dst_entry UAF corrupts kernel heap memory within the same host security boundary; it is not a VM escape or cross-authority sandbox break.\nC:H - Returning a released rt6_info leaves a dangling dst_entry in ip6_dst_cache; subsequent reads through ip6_dst_idev(), dst metrics, or error paths are classic slab UAF with attacker-influencable heap reuse via sustained IPv6 traffic.\nI:H - Double-free/imbalanced rcuref put and post-free use of rt6_info fields give heap corruption primitives; UAF on dst/route cache objects is routinely leveraged for kernel write and control-flow hijack.\nA:H - Commit explicitly reports rcuref_put_slowpath() WARN from dst_release() on the freed route; UAF and refcount corruption can oops/panic the kernel, fully denying availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:07.594Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb"
},
{
"url": "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f"
},
{
"url": "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc"
},
{
"url": "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa"
},
{
"url": "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3"
},
{
"url": "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb"
},
{
"url": "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937"
},
{
"url": "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7"
}
],
"title": "net: ipv6: clear suppressed fib6 rule result",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74581",
"datePublished": "2026-08-21T16:31:54.683Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-10-16T19:05:58.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80574 (GCVE-0-2026-80574)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-10-16 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Make finger2 (and also finger1) unsigned, so that if the finger index in
the packet is 0 then subtracting 1 creates an array index which overflows
above the existing check for FOC_MAX_FINGERS, as the existing comment says
it should, instead of writing to state->fingers[-1].
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 05be1d079ec0b3691783e4384b1ada82149ff7d2 Version: 05be1d079ec0b3691783e4384b1ada82149ff7d2 Version: 05be1d079ec0b3691783e4384b1ada82149ff7d2 Version: 05be1d079ec0b3691783e4384b1ada82149ff7d2 Version: 05be1d079ec0b3691783e4384b1ada82149ff7d2 Version: 05be1d079ec0b3691783e4384b1ada82149ff7d2 Version: 05be1d079ec0b3691783e4384b1ada82149ff7d2 Version: 05be1d079ec0b3691783e4384b1ada82149ff7d2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:17:38.877243Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:27.544Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/mouse/focaltech.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "063b4c6a6f3fc01bca085c442000c9c100fdbd93",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "bb502d79acb9ac1e0a77fa8bc7b7b4729140b11f",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "ca92c98b806839c108995b2bbff7061515bdfb53",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "81b07470cb2937ceb74b00be88151582a322433b",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "6f6d5fe29efdf5001bc146fc292e6592cace93eb",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "83c265bfc084d77e2171d4b67362150ab38c935b",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "1842e47126816e56d30c4f856f9854fd7831066c",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
},
{
"lessThan": "296736076b3fd078742651c719555a488624023a",
"status": "affected",
"version": "05be1d079ec0b3691783e4384b1ada82149ff7d2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/mouse/focaltech.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: focaltech - fix array out-of-bounds in focaltech_process_rel_packet\n\nMake finger2 (and also finger1) unsigned, so that if the finger index in\nthe packet is 0 then subtracting 1 creates an array index which overflows\nabove the existing check for FOC_MAX_FINGERS, as the existing comment says\nit should, instead of writing to state-\u003efingers[-1]."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - FocalTech FOC_REL packets reach focaltech_process_rel_packet through i8042/serio hardware interrupts, ps2_interrupt, psmouse_receive_byte, and focaltech_process_byte with no syscall gate; any local user on a laptop with an integrated FocalTech PS/2 touchpad can deliver the triggering bytes by normal touchpad use.\nAC:L - When the second relative finger index is 0, a documented valid case for odd finger counts, signed underflow makes finger2 -1 pass the FOC_MAX_FINGERS bound test and causes a reliable out-of-bounds write on every such packet without races or attacker-uncontrollable memory layout.\nPR:N - No Linux account, capability, or namespace privilege is required; the integrated touchpad feeds bytes directly into the kernel interrupt handler during normal operation, including at the login screen before authentication.\nUI:N - An attacker with brief local access can trigger the corrupting multitouch gestures directly on the touchpad; exploitation does not depend on a separate victim performing an unusual action beyond touching the device.\nS:U - The vulnerability corrupts kmalloc-allocated focaltech_data within the host kernel psmouse driver; impact is standard in-kernel memory corruption rather than crossing a guest/host, VM, or IOMMU security boundary.\nC:H - Out-of-bounds += writes to fingers[-1].x and fingers[-1].y corrupt adjacent focaltech_data fields such as y_max in kernel heap memory; this class of heap corruption can be leveraged for kernel information disclosure.\nI:H - Attacker-influenced PS/2 packet bytes supply signed 8-bit deltas that repeatedly perform out-of-bounds writes immediately before fingers[0], enabling progressive corruption of neighboring driver state and potential privilege escalation.\nA:H - Corrupting kmalloc-allocated driver state via fingers[-1] can destabilize the input subsystem or adjacent heap objects, causing kernel oops, panic, or repeatable denial of service on affected laptops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:01:56.362Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/063b4c6a6f3fc01bca085c442000c9c100fdbd93"
},
{
"url": "https://git.kernel.org/stable/c/bb502d79acb9ac1e0a77fa8bc7b7b4729140b11f"
},
{
"url": "https://git.kernel.org/stable/c/ca92c98b806839c108995b2bbff7061515bdfb53"
},
{
"url": "https://git.kernel.org/stable/c/81b07470cb2937ceb74b00be88151582a322433b"
},
{
"url": "https://git.kernel.org/stable/c/6f6d5fe29efdf5001bc146fc292e6592cace93eb"
},
{
"url": "https://git.kernel.org/stable/c/83c265bfc084d77e2171d4b67362150ab38c935b"
},
{
"url": "https://git.kernel.org/stable/c/1842e47126816e56d30c4f856f9854fd7831066c"
},
{
"url": "https://git.kernel.org/stable/c/296736076b3fd078742651c719555a488624023a"
}
],
"title": "Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80574",
"datePublished": "2026-08-26T14:37:34.353Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-10-16T19:26:27.544Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46128 (GCVE-0-2026-46128)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-10-15 01:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipmi: Check event message buffer response for bad data
The event message buffer response data size got checked later when
processing, but check it right after the response comes back. It
appears some BMCs may return an empty message instead of an error
when fetching events.
There are apparently some new BMCs that make this error, so we need to
compensate.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:20:42.825Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_si_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cf1ef30c42a7079e5bad863cd01c52aa3a17c3ac",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "474e53d4397087913a5b9c9eb90fa068da4808bf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "01f8387fa5b796f13cf50014c171f6da7abc46ea",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2418e4b21fb1355504d095da5d5f0a210564a43d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7f7ada72c07a83b46045ddfeee526bd9e2e3c8f0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "42432b579a594b66ac32e5e7b7c26e6bc578ec89",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "24269264c3d59a49eb09b10af2c75b14f2931482",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "36920f30e78e69df01f9691c470b6f3ba8aebf98",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_si_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Check event message buffer response for bad data\n\nThe event message buffer response data size got checked later when\nprocessing, but check it right after the response comes back. It\nappears some BMCs may return an empty message instead of an error\nwhen fetching events.\n\nThere are apparently some new BMCs that make this error, so we need to\ncompensate."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:56:32.120Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cf1ef30c42a7079e5bad863cd01c52aa3a17c3ac"
},
{
"url": "https://git.kernel.org/stable/c/474e53d4397087913a5b9c9eb90fa068da4808bf"
},
{
"url": "https://git.kernel.org/stable/c/01f8387fa5b796f13cf50014c171f6da7abc46ea"
},
{
"url": "https://git.kernel.org/stable/c/2418e4b21fb1355504d095da5d5f0a210564a43d"
},
{
"url": "https://git.kernel.org/stable/c/7f7ada72c07a83b46045ddfeee526bd9e2e3c8f0"
},
{
"url": "https://git.kernel.org/stable/c/42432b579a594b66ac32e5e7b7c26e6bc578ec89"
},
{
"url": "https://git.kernel.org/stable/c/24269264c3d59a49eb09b10af2c75b14f2931482"
},
{
"url": "https://git.kernel.org/stable/c/36920f30e78e69df01f9691c470b6f3ba8aebf98"
}
],
"title": "ipmi: Check event message buffer response for bad data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46128",
"datePublished": "2026-05-28T09:35:43.326Z",
"dateReserved": "2026-05-13T15:03:33.099Z",
"dateUpdated": "2026-10-15T01:20:42.825Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74454 (GCVE-0-2026-74454)
Vulnerability from cvelistv5
Published
2026-08-15 12:26
Modified
2026-08-19 16:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size
vc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB
binner BO, but writes the size of the whole BO to BPOS. On every binner
out-of-memory event the PTB is therefore authorized to write tile lists
across all the other slots (which may hold the tile state, tile alloc and
overflow memory of in-flight jobs) and, for any slot but the first, past
the end of the binner BO into unrelated CMA memory.
Since CMA pages are recycled into page cache and user allocations, this
is arbitrary memory corruption by GPU DMA. In practice it shows up as GPU
hangs with corrupted control list pointers, userspace heap corruption, a
GPU that stays permanently wedged after the first hang, and occasional
full system crashes, whenever a job overflows the initial binner slot.
The bug dates back to the conversion from a dedicated overflow BO (where
writing the full BO size was correct) to the slotted binner BO.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 Version: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 Version: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 Version: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 Version: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 Version: 553c942f8b2cbc7394b4d4fa2f848b23a8f07451 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_irq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb5656ae063f2711f56438cf2f1f5b613aea5f12",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "2f2291a119e9a8b696ae8bb36e86b75d272ceaea",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "0badb30871004d34df87be33e853536f0b69885f",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "6cd5acf6f87c073622bd61e38fe99c47365cda9c",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "1e33ca7f44be64beed2735bb76b86eb65ba8c05b",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
},
{
"lessThan": "6395789e4739aa5177bbec0fa0f07ccc38d249b0",
"status": "affected",
"version": "553c942f8b2cbc7394b4d4fa2f848b23a8f07451",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_irq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size\n\nvc4_overflow_mem_work() points BPOA at a 512KB slot inside the 16MB\nbinner BO, but writes the size of the whole BO to BPOS. On every binner\nout-of-memory event the PTB is therefore authorized to write tile lists\nacross all the other slots (which may hold the tile state, tile alloc and\noverflow memory of in-flight jobs) and, for any slot but the first, past\nthe end of the binner BO into unrelated CMA memory.\n\nSince CMA pages are recycled into page cache and user allocations, this\nis arbitrary memory corruption by GPU DMA. In practice it shows up as GPU\nhangs with corrupted control list pointers, userspace heap corruption, a\nGPU that stays permanently wedged after the first hang, and occasional\nfull system crashes, whenever a job overflows the initial binner slot.\n\nThe bug dates back to the conversion from a dedicated overflow BO (where\nwriting the full BO size was correct) to the slotted binner BO."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires submitting crafted GPU jobs through the VC4 DRM render node via DRM_IOCTL_VC4_SUBMIT_CL; the bug is reached in vc4_overflow_mem_work() after hardware raises V3D_INT_OUTOMEM, which is a local ioctl/syscall path, not a network protocol.\nAC:L - An attacker with render-node access can reliably trigger binner out-of-memory by submitting dense geometry that exhausts the 32-byte initial per-bin allocation, and can run concurrent jobs to force non-zero overflow slots; no race or rare layout conditions beyond attacker-controlled GPU workloads are required.\nPR:L - VC4_SUBMIT_CL is permitted on DRM render nodes (DRM_RENDER_ALLOW, no DRM_AUTH) and vc4_open() performs no extra capability checks; on Raspberry Pi and similar VC4 deployments, unprivileged users in the render/video group routinely have /dev/dri/renderD* access to reach this path.\nUI:N - No victim interaction is required when the attacker is a local unprivileged user with render-node access who directly opens /dev/dri/renderD* and submits a malicious binning command list designed to overflow the initial binner slot.\nS:U - The flaw causes GPU DMA to corrupt CMA memory used by the kernel and userspace, enabling standard local privilege escalation; it does not cross a VM, IOMMU, or hypervisor security boundary and stays within the kernel\u0027s security authority.\nC:H - On OUTOMEM, the driver programs BPOA to a 512KB slot but BPOS to the full 16MB BO, authorizing the PTB to DMA-write far beyond the slot into adjacent in-flight job data and unrelated CMA pages recycled into page cache and user allocations, enabling arbitrary kernel memory disclosure.\nI:H - The oversized BPOS grants the GPU PTB an out-of-bounds DMA write primitive across other binner slots and past the 16MB BO boundary into unrelated CMA memory, corrupting kernel structures and userspace heaps in ways suitable for arbitrary code execution and privilege escalation.\nA:H - The commit reports that triggering binner overflow causes GPU hangs with corrupted control-list pointers, permanently wedged GPUs after the first hang, userspace heap corruption, and occasional full system crashes, satisfying high availability impact from repeatable kernel/GPU failure."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:46.319Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb5656ae063f2711f56438cf2f1f5b613aea5f12"
},
{
"url": "https://git.kernel.org/stable/c/2f2291a119e9a8b696ae8bb36e86b75d272ceaea"
},
{
"url": "https://git.kernel.org/stable/c/0badb30871004d34df87be33e853536f0b69885f"
},
{
"url": "https://git.kernel.org/stable/c/6cd5acf6f87c073622bd61e38fe99c47365cda9c"
},
{
"url": "https://git.kernel.org/stable/c/1e33ca7f44be64beed2735bb76b86eb65ba8c05b"
},
{
"url": "https://git.kernel.org/stable/c/6395789e4739aa5177bbec0fa0f07ccc38d249b0"
}
],
"title": "drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74454",
"datePublished": "2026-08-15T12:26:57.565Z",
"dateReserved": "2026-08-15T05:44:03.900Z",
"dateUpdated": "2026-08-19T16:36:46.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68299 (GCVE-0-2026-68299)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets
vmxnet3_get_hdr_len() assumes gdesc->rcd.v4/v6/tcp always describe the
outer header, but for a Geneve-encapsulated packet the device can set
them based on the inner header instead, signalled by the
VMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the
function never skips the outer encapsulation, this mismatch triggers:
- BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP), because the outer
protocol is UDP (Geneve), not TCP.
- BUG_ON(hdr.eth->h_proto != ...), when the tunnel's outer and inner
IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa).
Check VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the
function cannot locate the inner header it would need to parse. Also
convert the remaining BUG_ON()s in this function to return 0
defensively.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc Version: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc Version: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc Version: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc Version: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc Version: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc Version: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc Version: 45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68299",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:46:52.382602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:04.053Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vmxnet3/vmxnet3_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ddf51fcb6dd7d55ceef38e2e1a5ab2ab7fd47b0",
"status": "affected",
"version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
"versionType": "git"
},
{
"lessThan": "fbab6b73cc086e32698c86e43d1b16bf17d24c36",
"status": "affected",
"version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
"versionType": "git"
},
{
"lessThan": "28e382646417c7e2be9c9a7079eddf627ff52b90",
"status": "affected",
"version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
"versionType": "git"
},
{
"lessThan": "667b6e52048eaf4dbcf1707ed87ffd44abb9cb38",
"status": "affected",
"version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
"versionType": "git"
},
{
"lessThan": "28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8",
"status": "affected",
"version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
"versionType": "git"
},
{
"lessThan": "4fdb0f162ccdbe9626863b10003855703253fa29",
"status": "affected",
"version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
"versionType": "git"
},
{
"lessThan": "b28596baf87e25a078789f1c05817c8a3bf71257",
"status": "affected",
"version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
"versionType": "git"
},
{
"lessThan": "34a71f5361fc3adb5b7138da78750b0d535a8252",
"status": "affected",
"version": "45dac1d6ea045ae56e4df8d9c70c92c7412bd4fc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vmxnet3/vmxnet3_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets\n\nvmxnet3_get_hdr_len() assumes gdesc-\u003ercd.v4/v6/tcp always describe the\nouter header, but for a Geneve-encapsulated packet the device can set\nthem based on the inner header instead, signalled by the\nVMXNET3_RCD_HDR_INNER_SHIFT bit in the completion descriptor. Since the\nfunction never skips the outer encapsulation, this mismatch triggers:\n\n- BUG_ON(hdr.ipv4-\u003eprotocol != IPPROTO_TCP), because the outer\n protocol is UDP (Geneve), not TCP.\n- BUG_ON(hdr.eth-\u003eh_proto != ...), when the tunnel\u0027s outer and inner\n IP versions differ (e.g. outer IPv6/inner IPv4 or vice versa).\n\nCheck VMXNET3_RCD_HDR_INNER_SHIFT up front and bail out, since the\nfunction cannot locate the inner header it would need to parse. Also\nconvert the remaining BUG_ON()s in this function to return 0\ndefensively."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is triggered purely by a received Geneve-encapsulated packet processed in the vmxnet3 RX completion path (vmxnet3_rq_rx_complete -\u003e vmxnet3_get_hdr_len); any remote host that can deliver such a frame to a VMware guest\u0027s vmxnet3 interface reaches the code, with no local access required.\nAC:L - The attacker only needs to send Geneve-encapsulated TCP traffic larger than the MTU to the target; the device then sets rcd.v4/v6/tcp from the inner header and the outer UDP protocol (or an outer/inner IP version mismatch) deterministically hits the BUG_ON, with no race or memory-layout dependency.\nPR:N - Packet reception and header-length estimation occur in the driver\u0027s NAPI RX path before any socket, credential, or authentication check, so an entirely unauthenticated remote sender triggers it.\nUI:N - The panic happens during normal NAPI RX processing of an incoming packet; no action by any local user or administrator is needed.\nS:U - The BUG_ON crashes the kernel that owns the vmxnet3 interface, and impact stays entirely within that kernel\u0027s security authority with no crossing into the hypervisor or another domain.\nC:N - The header parsing is bounded by the explicit skb_headlen()/maplen checks, so no out-of-bounds read occurs and no kernel memory contents are disclosed to the attacker before the BUG_ON aborts.\nI:N - No out-of-bounds or attacker-controlled write occurs; the mismatch is caught by the BUG_ON assertion, which halts execution rather than corrupting kernel memory or control flow.\nA:H - Hitting BUG_ON() in softirq/NAPI context oopses and panics the kernel, taking down the entire guest; a remote attacker can repeat it with a single crafted Geneve packet stream for a persistent denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:32:48.545Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ddf51fcb6dd7d55ceef38e2e1a5ab2ab7fd47b0"
},
{
"url": "https://git.kernel.org/stable/c/fbab6b73cc086e32698c86e43d1b16bf17d24c36"
},
{
"url": "https://git.kernel.org/stable/c/28e382646417c7e2be9c9a7079eddf627ff52b90"
},
{
"url": "https://git.kernel.org/stable/c/667b6e52048eaf4dbcf1707ed87ffd44abb9cb38"
},
{
"url": "https://git.kernel.org/stable/c/28cb5d8d13b4c1faf3f688f62e5df82fe7b438d8"
},
{
"url": "https://git.kernel.org/stable/c/4fdb0f162ccdbe9626863b10003855703253fa29"
},
{
"url": "https://git.kernel.org/stable/c/b28596baf87e25a078789f1c05817c8a3bf71257"
},
{
"url": "https://git.kernel.org/stable/c/34a71f5361fc3adb5b7138da78750b0d535a8252"
}
],
"title": "vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68299",
"datePublished": "2026-08-10T12:02:33.213Z",
"dateReserved": "2026-07-30T09:28:09.380Z",
"dateUpdated": "2026-10-19T21:09:04.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52929 (GCVE-0-2026-52929)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-10-19 19:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: stream: fully roll back denied add-stream state
When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and
then lowers outcnt. That leaves removed stream metadata behind, so a
later re-add can reuse a stale ext and hit a null-pointer dereference in
the scheduler get path.
Fix the rollback by tearing down the removed stream state the same way
other stream resizes do. Unschedule the current scheduler state, drop
the removed stream ext state with sctp_stream_outq_migrate(), and then
reschedule the remaining streams.
This keeps scheduler-private RR/FC/PRIO lists consistent while fully
rolling back denied outgoing stream additions.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a Version: 637784ade221a3c8a7ecd0f583eddd95d6276b9a |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:21:52.989Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52929",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:22:54.348092Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:47:07.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/stream.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "a6724b7b812ac8793514a1d5938db5d9d29ae725",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "9662eb0401518f0b4681f10e7fbf688f504f24cf",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "7dd9a42b044aad2dbe037db1c1e2943582485b44",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "39dc2b0eb5371a669ebc9ec6072b9184eac95418",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "d5ea0b3e261fcb2cfff142675516165244cab1da",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "1c6773b8c081509dcd5cd2954f2b02c50c00f151",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
},
{
"lessThan": "a5f8a90ac9f77c678a9781c0a464b635e0d63e49",
"status": "affected",
"version": "637784ade221a3c8a7ecd0f583eddd95d6276b9a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/stream.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: stream: fully roll back denied add-stream state\n\nWhen ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and\nthen lowers outcnt. That leaves removed stream metadata behind, so a\nlater re-add can reuse a stale ext and hit a null-pointer dereference in\nthe scheduler get path.\n\nFix the rollback by tearing down the removed stream state the same way\nother stream resizes do. Unschedule the current scheduler state, drop\nthe removed stream ext state with sctp_stream_outq_migrate(), and then\nreschedule the remaining streams.\n\nThis keeps scheduler-private RR/FC/PRIO lists consistent while fully\nrolling back denied outgoing stream additions."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is reached while processing an SCTP RE-CONFIG response chunk received from a remote SCTP peer on an established association. A malicious peer can send a denied ADD_OUT_STREAMS response over the network once stream reconfiguration is negotiated.\nAC:L - The packet/state sequence is protocol-controlled and reproducible: negotiate SCTP RE-CONFIG, trigger an ADD_OUT_STREAMS request, deny it, then cause later reuse of the stale stream state. Although RE-CONFIG must be enabled by the application, there is no race or condition outside the attacker\u0027s reasonable influence in a deployment using this feature.\nPR:N - A remote SCTP peer does not need local kernel privileges or authenticated OS privileges to send the denial response. The path is gated by SCTP association state, verification tag, and matching outstanding request sequence, not by credentials.\nUI:N - No human user interaction is required once the SCTP service/association is operating with stream reconfiguration. The triggering input is network protocol traffic from the peer.\nS:U - The vulnerability affects kernel SCTP state within the same host security authority. It does not cross a VM, IOMMU, or other separate authorization boundary.\nC:N - The investigated failure mode is stale SCTP stream scheduler metadata leading to a NULL pointer dereference in scheduler value retrieval. I did not find evidence of an attacker-controlled memory read or information disclosure primitive.\nI:N - The bug leaves scheduler-private stream state inconsistent but the demonstrated impact is a NULL dereference/crash, not controlled data modification or code execution. No arbitrary write primitive was evident from the rollback path.\nA:H - The stale stream extension state can lead to a kernel NULL pointer dereference/oops in the SCTP scheduler path. A remotely reachable kernel crash is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:47.863Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85"
},
{
"url": "https://git.kernel.org/stable/c/a6724b7b812ac8793514a1d5938db5d9d29ae725"
},
{
"url": "https://git.kernel.org/stable/c/9662eb0401518f0b4681f10e7fbf688f504f24cf"
},
{
"url": "https://git.kernel.org/stable/c/7dd9a42b044aad2dbe037db1c1e2943582485b44"
},
{
"url": "https://git.kernel.org/stable/c/39dc2b0eb5371a669ebc9ec6072b9184eac95418"
},
{
"url": "https://git.kernel.org/stable/c/d5ea0b3e261fcb2cfff142675516165244cab1da"
},
{
"url": "https://git.kernel.org/stable/c/1c6773b8c081509dcd5cd2954f2b02c50c00f151"
},
{
"url": "https://git.kernel.org/stable/c/a5f8a90ac9f77c678a9781c0a464b635e0d63e49"
}
],
"title": "sctp: stream: fully roll back denied add-stream state",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52929",
"datePublished": "2026-06-24T07:14:22.020Z",
"dateReserved": "2026-06-09T07:44:35.368Z",
"dateUpdated": "2026-10-19T19:47:07.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23451 (GCVE-0-2026-23451)
Vulnerability from cvelistv5
Published
2026-04-03 15:15
Modified
2026-08-05 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bonding: prevent potential infinite loop in bond_header_parse()
bond_header_parse() can loop if a stack of two bonding devices is setup,
because skb->dev always points to the hierarchy top.
Add new "const struct net_device *dev" parameter to
(struct header_ops)->parse() method to make sure the recursion
is bounded, and that the final leaf parse method is called.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firewire/net.c",
"drivers/net/bonding/bond_main.c",
"include/linux/etherdevice.h",
"include/linux/if_ether.h",
"include/linux/netdevice.h",
"net/ethernet/eth.c",
"net/ipv4/ip_gre.c",
"net/mac802154/iface.c",
"net/phonet/af_phonet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9532d0d0ad1d726c06f807e8f0f1ec93cbabb452",
"status": "affected",
"version": "5d0fb9806ab6cf2c3cfba0e1b8c701da65e25af8",
"versionType": "git"
},
{
"lessThan": "946bb6cacf0ccada7bc80f1cfa07c1ed79511c1c",
"status": "affected",
"version": "9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d",
"versionType": "git"
},
{
"lessThan": "4172a7901cf43fe1cc63ef7a2ef33735ff7b7d13",
"status": "affected",
"version": "6ac890f1d60ac3707ee8dae15a67d9a833e49956",
"versionType": "git"
},
{
"lessThan": "9b49c854f14f5e2d493e562a1e28d2e57fe37371",
"status": "affected",
"version": "95597d11dc8bddb2b9a051c9232000bfbb5e43ba",
"versionType": "git"
},
{
"lessThan": "b7405dcf7385445e10821777143f18c3ce20fa04",
"status": "affected",
"version": "950803f7254721c1c15858fbbfae3deaaeeecb11",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firewire/net.c",
"drivers/net/bonding/bond_main.c",
"include/linux/etherdevice.h",
"include/linux/if_ether.h",
"include/linux/netdevice.h",
"net/ethernet/eth.c",
"net/ipv4/ip_gre.c",
"net/mac802154/iface.c",
"net/phonet/af_phonet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.18.20",
"status": "affected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThan": "6.19.10",
"status": "affected",
"version": "6.19.9",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "6.18.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "6.19.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: prevent potential infinite loop in bond_header_parse()\n\nbond_header_parse() can loop if a stack of two bonding devices is setup,\nbecause skb-\u003edev always points to the hierarchy top.\n\nAdd new \"const struct net_device *dev\" parameter to\n(struct header_ops)-\u003eparse() method to make sure the recursion\nis bounded, and that the final leaf parse method is called."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - In a reasonable affected deployment, a remote peer can send a packet, including GRE traffic, that arrives through a stacked bonding hierarchy and triggers AF_PACKET/NFLOG/NFQUEUE hardware-address parsing on the top bond. The vulnerable code is reached from network packet receive processing, not from a physical or purely local-only interface.\nAC:L - Once the stacked bond and packet metadata consumer exist, a single matching received packet deterministically enters `dev_parse_header()` and recurses indefinitely. There is no race, timing window, heap shaping, or attacker-uncontrolled probabilistic condition needed to trigger the denial of service.\nPR:N - The network-triggered path does not require the remote attacker to authenticate or hold local privileges; they only need to send traffic to the affected interface/tunnel. Although local namespace users can also create a reproducer with CAP_NET_ADMIN/CAP_NET_RAW in their namespace, the highest reasonable scenario requires no attacker privileges.\nUI:N - No victim action is required at exploit time when the affected bond stack and packet logging/capture path are already active. The packet alone triggers the vulnerable parse path.\nS:U - The impact remains within the kernel/networking security authority of the vulnerable system. There is no VM escape, sandbox boundary crossing, or separate security scope affected.\nC:N - The bug is an unbounded recursive call caused by using the top-level `skb-\u003edev`; it does not create an information disclosure or controlled read primitive.\nI:N - The vulnerable path does not corrupt attacker-selected data or provide a write/control-flow primitive; the final lower-device parser is never reached. The observed consequence is recursion leading to denial of service.\nA:H - The infinite recursion can hang kernel packet processing and lead to stack overflow/lockdep exhaustion or kernel crash. This is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:21:51.936Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9532d0d0ad1d726c06f807e8f0f1ec93cbabb452"
},
{
"url": "https://git.kernel.org/stable/c/946bb6cacf0ccada7bc80f1cfa07c1ed79511c1c"
},
{
"url": "https://git.kernel.org/stable/c/4172a7901cf43fe1cc63ef7a2ef33735ff7b7d13"
},
{
"url": "https://git.kernel.org/stable/c/9b49c854f14f5e2d493e562a1e28d2e57fe37371"
},
{
"url": "https://git.kernel.org/stable/c/b7405dcf7385445e10821777143f18c3ce20fa04"
}
],
"title": "bonding: prevent potential infinite loop in bond_header_parse()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23451",
"datePublished": "2026-04-03T15:15:33.776Z",
"dateReserved": "2026-01-13T15:37:46.020Z",
"dateUpdated": "2026-08-05T12:21:51.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72138 (GCVE-0-2026-72138)
Vulnerability from cvelistv5
Published
2026-08-15 05:53
Modified
2026-08-17 05:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xen/gntdev: fix error handling in ioctl
When gntdev_ioctl_map_grant_ref() fails to copy the operation result
back to userspace after successfully adding the mapping to the list,
the error path returns -EFAULT without releasing the reference
acquired by gntdev_alloc_map(). The mapping remains in priv->maps
with a refcount of 1, causing a memory leak and a dangling list
entry.
Additionally, gntdev_add_map() may modify map->index to avoid overlap
with existing mappings. Therefore, the index returned to userspace
must be obtained after gntdev_add_map() completes.
Fix this by holding the mutex across gntdev_add_map(), retrieving
the correct index, and copy_to_user(). If copy_to_user() fails,
remove the mapping from the list and release the reference while
still holding the lock.
Fix these issues by properly handling all error cases.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 68b025c813c2eb41ff25628e3d4952d5185eb1a4 Version: 68b025c813c2eb41ff25628e3d4952d5185eb1a4 Version: 68b025c813c2eb41ff25628e3d4952d5185eb1a4 Version: 68b025c813c2eb41ff25628e3d4952d5185eb1a4 Version: 68b025c813c2eb41ff25628e3d4952d5185eb1a4 Version: 68b025c813c2eb41ff25628e3d4952d5185eb1a4 Version: 68b025c813c2eb41ff25628e3d4952d5185eb1a4 Version: 68b025c813c2eb41ff25628e3d4952d5185eb1a4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/xen/gntdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "52dc40ef0cfee6ae89b7524967e73f0ba37906d7",
"status": "affected",
"version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
"versionType": "git"
},
{
"lessThan": "1dd9cb98fe228e017fff9efb33862ff38c741b65",
"status": "affected",
"version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
"versionType": "git"
},
{
"lessThan": "6df926130aee6cab9b5d2e5b7862e49ccac348dc",
"status": "affected",
"version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
"versionType": "git"
},
{
"lessThan": "311011f8cc206c5af2877b03e3f627ee1b8fe024",
"status": "affected",
"version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
"versionType": "git"
},
{
"lessThan": "18a693733f7ad004e1ab0466693121ca70cd95dd",
"status": "affected",
"version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
"versionType": "git"
},
{
"lessThan": "16d3ccdabb8dee9be2cdcd6d3f9a125572ec0454",
"status": "affected",
"version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
"versionType": "git"
},
{
"lessThan": "6883269a323609f68f6faa903f8f8ff3d191cec8",
"status": "affected",
"version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
"versionType": "git"
},
{
"lessThan": "45ca1afe2fd14c04e37227e79d3f8455831d8408",
"status": "affected",
"version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/xen/gntdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.39"
},
{
"lessThan": "2.6.39",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.39",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/gntdev: fix error handling in ioctl\n\nWhen gntdev_ioctl_map_grant_ref() fails to copy the operation result\nback to userspace after successfully adding the mapping to the list,\nthe error path returns -EFAULT without releasing the reference\nacquired by gntdev_alloc_map(). The mapping remains in priv-\u003emaps\nwith a refcount of 1, causing a memory leak and a dangling list\nentry.\n\nAdditionally, gntdev_add_map() may modify map-\u003eindex to avoid overlap\nwith existing mappings. Therefore, the index returned to userspace\nmust be obtained after gntdev_add_map() completes.\n\nFix this by holding the mutex across gntdev_add_map(), retrieving\nthe correct index, and copy_to_user(). If copy_to_user() fails,\nremove the mapping from the list and release the reference while\nstill holding the lock.\n\n\nFix these issues by properly handling all error cases."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:08:56.108Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/52dc40ef0cfee6ae89b7524967e73f0ba37906d7"
},
{
"url": "https://git.kernel.org/stable/c/1dd9cb98fe228e017fff9efb33862ff38c741b65"
},
{
"url": "https://git.kernel.org/stable/c/6df926130aee6cab9b5d2e5b7862e49ccac348dc"
},
{
"url": "https://git.kernel.org/stable/c/311011f8cc206c5af2877b03e3f627ee1b8fe024"
},
{
"url": "https://git.kernel.org/stable/c/18a693733f7ad004e1ab0466693121ca70cd95dd"
},
{
"url": "https://git.kernel.org/stable/c/16d3ccdabb8dee9be2cdcd6d3f9a125572ec0454"
},
{
"url": "https://git.kernel.org/stable/c/6883269a323609f68f6faa903f8f8ff3d191cec8"
},
{
"url": "https://git.kernel.org/stable/c/45ca1afe2fd14c04e37227e79d3f8455831d8408"
}
],
"title": "xen/gntdev: fix error handling in ioctl",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72138",
"datePublished": "2026-08-15T05:53:12.549Z",
"dateReserved": "2026-08-09T03:40:39.908Z",
"dateUpdated": "2026-08-17T05:08:56.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80765 (GCVE-0-2026-80765)
Vulnerability from cvelistv5
Published
2026-09-04 15:12
Modified
2026-10-19 08:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: hyperv: validate initial device info bounds
The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO
messages that contain a HID descriptor followed by the report descriptor
bytes. mousevsc_on_receive_device_info() trusts bLength and
wDescriptorLength without checking that the received packet contains both
byte ranges.
A malformed host or backend message can therefore make the guest read
past the received VMBus packet while copying the report descriptor. Pass
the received initial-device-info size into the parser and reject
descriptor lengths that exceed the packet.
Impact: A malicious Hyper-V host or backend can crash a guest by sending
a short initial device-info message with an oversized HID report
descriptor length.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b95f5bcb811e3905b5376f87789da8d097fee682 Version: b95f5bcb811e3905b5376f87789da8d097fee682 Version: b95f5bcb811e3905b5376f87789da8d097fee682 Version: b95f5bcb811e3905b5376f87789da8d097fee682 Version: b95f5bcb811e3905b5376f87789da8d097fee682 Version: b95f5bcb811e3905b5376f87789da8d097fee682 Version: b95f5bcb811e3905b5376f87789da8d097fee682 Version: b95f5bcb811e3905b5376f87789da8d097fee682 Version: b95f5bcb811e3905b5376f87789da8d097fee682 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-hyperv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e0d5d3e45e142b7ef7525654aaa54d3e986002a6",
"status": "affected",
"version": "b95f5bcb811e3905b5376f87789da8d097fee682",
"versionType": "git"
},
{
"lessThan": "390d3d9c52a710fdc9de95a537747397c0c671d1",
"status": "affected",
"version": "b95f5bcb811e3905b5376f87789da8d097fee682",
"versionType": "git"
},
{
"lessThan": "8614c043b11cc35ffebd35542ab4da275f8f923d",
"status": "affected",
"version": "b95f5bcb811e3905b5376f87789da8d097fee682",
"versionType": "git"
},
{
"lessThan": "334271d3812ab3197c95b4593bc6745f8d189114",
"status": "affected",
"version": "b95f5bcb811e3905b5376f87789da8d097fee682",
"versionType": "git"
},
{
"lessThan": "f84d777574b748b1a488723ca7be9d87a301a872",
"status": "affected",
"version": "b95f5bcb811e3905b5376f87789da8d097fee682",
"versionType": "git"
},
{
"lessThan": "608f8fd8c0f7b6268da43509447802955f210aac",
"status": "affected",
"version": "b95f5bcb811e3905b5376f87789da8d097fee682",
"versionType": "git"
},
{
"lessThan": "2529737763cb4bcfcaf397beeea2664656c865b4",
"status": "affected",
"version": "b95f5bcb811e3905b5376f87789da8d097fee682",
"versionType": "git"
},
{
"lessThan": "c894143c508a7e063aab9f73c9e835ab40121283",
"status": "affected",
"version": "b95f5bcb811e3905b5376f87789da8d097fee682",
"versionType": "git"
},
{
"lessThan": "934b7778aa7b7c8f6bb073d2a73ba3674885bae0",
"status": "affected",
"version": "b95f5bcb811e3905b5376f87789da8d097fee682",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-hyperv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.1",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hyperv: validate initial device info bounds\n\nThe Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO\nmessages that contain a HID descriptor followed by the report descriptor\nbytes. mousevsc_on_receive_device_info() trusts bLength and\nwDescriptorLength without checking that the received packet contains both\nbyte ranges.\n\nA malformed host or backend message can therefore make the guest read\npast the received VMBus packet while copying the report descriptor. Pass\nthe received initial-device-info size into the parser and reject\ndescriptor lengths that exceed the packet.\n\nImpact: A malicious Hyper-V host or backend can crash a guest by sending\na short initial device-info message with an oversized HID report\ndescriptor length."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:43:21.769Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e0d5d3e45e142b7ef7525654aaa54d3e986002a6"
},
{
"url": "https://git.kernel.org/stable/c/390d3d9c52a710fdc9de95a537747397c0c671d1"
},
{
"url": "https://git.kernel.org/stable/c/8614c043b11cc35ffebd35542ab4da275f8f923d"
},
{
"url": "https://git.kernel.org/stable/c/334271d3812ab3197c95b4593bc6745f8d189114"
},
{
"url": "https://git.kernel.org/stable/c/f84d777574b748b1a488723ca7be9d87a301a872"
},
{
"url": "https://git.kernel.org/stable/c/608f8fd8c0f7b6268da43509447802955f210aac"
},
{
"url": "https://git.kernel.org/stable/c/2529737763cb4bcfcaf397beeea2664656c865b4"
},
{
"url": "https://git.kernel.org/stable/c/c894143c508a7e063aab9f73c9e835ab40121283"
},
{
"url": "https://git.kernel.org/stable/c/934b7778aa7b7c8f6bb073d2a73ba3674885bae0"
}
],
"title": "HID: hyperv: validate initial device info bounds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80765",
"datePublished": "2026-09-04T15:12:37.639Z",
"dateReserved": "2026-08-26T14:34:25.791Z",
"dateUpdated": "2026-10-19T08:43:21.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46107 (GCVE-0-2026-46107)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-10-19 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-thin: fix metadata refcount underflow
There's a bug in dm-thin in the function rebalance_children. If the
internal btree node has one entry, the code tries to copy all btree
entries from the node's child to the node itself and then decrement the
child's reference count.
If the child node is shared (it has reference count > 1), we won't free
it, so there would be two pointers to each of the grandchildren nodes.
But the reference counts of the grandchildren is not increased, thus the
reference count doesn't match the number of pointers that point to the
grandchildren. This results in "device mapper: space map common: unable
to decrement block" errors.
Fix this bug by incrementing reference counts on the grandchildren if the
btree node is shared.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 Version: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 Version: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 Version: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 Version: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 Version: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 Version: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 Version: 3241b1d3e0aaafbfcd320f4d71ade629728cc4f4 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:20:32.520Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46107",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:19:39.761599Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-667",
"description": "CWE-667 Improper Locking",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:26:43.751Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/persistent-data/dm-btree-remove.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b719d12cb94df345e9ad2715fd0abe9afcaeb111",
"status": "affected",
"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
"versionType": "git"
},
{
"lessThan": "f49b41c9eb7c6ff00df27cd49cea210abbadd8ad",
"status": "affected",
"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
"versionType": "git"
},
{
"lessThan": "f06f6aededd792a754cd677c02b3d3016d868c2c",
"status": "affected",
"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
"versionType": "git"
},
{
"lessThan": "12161e03d33afce781f68fa11cc6060538862fad",
"status": "affected",
"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
"versionType": "git"
},
{
"lessThan": "323d252a4a378834e4fe68298ca61cfc5dd3a460",
"status": "affected",
"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
"versionType": "git"
},
{
"lessThan": "85311a585a26640760cd0f3349ab9f2905691044",
"status": "affected",
"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
"versionType": "git"
},
{
"lessThan": "5ec0debbcfd43596e32c1239e993de06a704e04c",
"status": "affected",
"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
"versionType": "git"
},
{
"lessThan": "09a65adc7d8bbfce06392cb6d375468e2728ead5",
"status": "affected",
"version": "3241b1d3e0aaafbfcd320f4d71ade629728cc4f4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/persistent-data/dm-btree-remove.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-thin: fix metadata refcount underflow\n\nThere\u0027s a bug in dm-thin in the function rebalance_children. If the\ninternal btree node has one entry, the code tries to copy all btree\nentries from the node\u0027s child to the node itself and then decrement the\nchild\u0027s reference count.\n\nIf the child node is shared (it has reference count \u003e 1), we won\u0027t free\nit, so there would be two pointers to each of the grandchildren nodes.\nBut the reference counts of the grandchildren is not increased, thus the\nreference count doesn\u0027t match the number of pointers that point to the\ngrandchildren. This results in \"device mapper: space map common: unable\nto decrement block\" errors.\n\nFix this bug by incrementing reference counts on the grandchildren if the\nbtree node is shared."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is in the device-mapper thin-provisioning metadata layer, reached only via local block I/O (discard/TRIM) to a thin volume or local device-mapper ioctls \u2014 there is no network-facing path.\nAC:L - The bug arises during ordinary snapshot+removal workflows; an attacker controlling the operations (snapshots plus repeated removals/discards) reliably produces a single-entry internal node over a shared child, with no condition beyond their control.\nPR:L - Although pool/snapshot setup needs CAP_SYS_ADMIN, the triggering removal is reachable through discard/TRIM I/O on a snapshotted thin volume \u2014 e.g. an unprivileged user deleting files on a discard-mounted fs or a delegated volume in a multi-tenant/container deployment.\nUI:N - The attacker triggers the corruption directly through their own discard/removal operations; no action by a separate victim is required.\nS:U - The corruption stays within the kernel\u0027s storage subsystem and the affected thin pool; it does not cross into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - The refcount underflow prematurely frees still-referenced blocks that get reallocated, so reads through the surviving snapshot reference can disclose whole reallocated blocks of unrelated (potentially other tenants\u0027) data.\nI:H - Double-allocated blocks and corrupted btree/space-map metadata allow modification of data belonging to other thin volumes/snapshots and corruption of pool metadata structures.\nA:H - The underflow produces \"unable to decrement block\" errors that abort the metadata transaction and force the pool read-only/fail, and corrupted metadata can crash the kernel on subsequent validation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:40.825Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b719d12cb94df345e9ad2715fd0abe9afcaeb111"
},
{
"url": "https://git.kernel.org/stable/c/f49b41c9eb7c6ff00df27cd49cea210abbadd8ad"
},
{
"url": "https://git.kernel.org/stable/c/f06f6aededd792a754cd677c02b3d3016d868c2c"
},
{
"url": "https://git.kernel.org/stable/c/12161e03d33afce781f68fa11cc6060538862fad"
},
{
"url": "https://git.kernel.org/stable/c/323d252a4a378834e4fe68298ca61cfc5dd3a460"
},
{
"url": "https://git.kernel.org/stable/c/85311a585a26640760cd0f3349ab9f2905691044"
},
{
"url": "https://git.kernel.org/stable/c/5ec0debbcfd43596e32c1239e993de06a704e04c"
},
{
"url": "https://git.kernel.org/stable/c/09a65adc7d8bbfce06392cb6d375468e2728ead5"
}
],
"title": "dm-thin: fix metadata refcount underflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46107",
"datePublished": "2026-05-28T09:35:13.051Z",
"dateReserved": "2026-05-13T15:03:33.098Z",
"dateUpdated": "2026-10-19T19:26:43.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64001 (GCVE-0-2026-64001)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: oss: Fix setup list UAF on proc write error
snd_pcm_oss_proc_write() links a newly allocated setup entry into the
OSS setup list before duplicating the task name. If the task-name
allocation fails, the error path frees the already linked entry and
leaves setup_list pointing at freed memory.
A later OSS device open can then walk the stale list entry in
snd_pcm_oss_look_for_setup() and dereference freed memory.
Allocate the task name and initialize the setup entry before publishing
the entry on setup_list. Also fetch the initial proc read iterator only
after taking setup_mutex, so all setup_list traversal follows the same
list lifetime rules.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/oss/pcm_oss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d9df965284abde27ba6bfbdfc8407697cf6802f1",
"status": "affected",
"version": "060d77b9c04acd7aef60790398a53f731db8c8fe",
"versionType": "git"
},
{
"lessThan": "8be4efd0dc0093eb7a02ad1aac936bca2a1f04ce",
"status": "affected",
"version": "060d77b9c04acd7aef60790398a53f731db8c8fe",
"versionType": "git"
},
{
"lessThan": "e13922bb97b4e6f94f8ac02d034f2d4bd65eeb3c",
"status": "affected",
"version": "060d77b9c04acd7aef60790398a53f731db8c8fe",
"versionType": "git"
},
{
"lessThan": "be387230dc22d870afd0e5d35912b07c2bc323bd",
"status": "affected",
"version": "060d77b9c04acd7aef60790398a53f731db8c8fe",
"versionType": "git"
},
{
"lessThan": "4cc54bdd54b337e77115be5b55577d1c58608eae",
"status": "affected",
"version": "060d77b9c04acd7aef60790398a53f731db8c8fe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/oss/pcm_oss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.17"
},
{
"lessThan": "2.6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Fix setup list UAF on proc write error\n\nsnd_pcm_oss_proc_write() links a newly allocated setup entry into the\nOSS setup list before duplicating the task name. If the task-name\nallocation fails, the error path frees the already linked entry and\nleaves setup_list pointing at freed memory.\n\nA later OSS device open can then walk the stale list entry in\nsnd_pcm_oss_look_for_setup() and dereference freed memory.\n\nAllocate the task name and initialize the setup entry before publishing\nthe entry on setup_list. Also fetch the initial proc read iterator only\nafter taking setup_mutex, so all setup_list traversal follows the same\nlist lifetime rules."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:53.657Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d9df965284abde27ba6bfbdfc8407697cf6802f1"
},
{
"url": "https://git.kernel.org/stable/c/8be4efd0dc0093eb7a02ad1aac936bca2a1f04ce"
},
{
"url": "https://git.kernel.org/stable/c/e13922bb97b4e6f94f8ac02d034f2d4bd65eeb3c"
},
{
"url": "https://git.kernel.org/stable/c/be387230dc22d870afd0e5d35912b07c2bc323bd"
},
{
"url": "https://git.kernel.org/stable/c/4cc54bdd54b337e77115be5b55577d1c58608eae"
}
],
"title": "ALSA: pcm: oss: Fix setup list UAF on proc write error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64001",
"datePublished": "2026-07-19T14:56:18.816Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-10-21T12:42:53.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72251 (GCVE-0-2026-72251)
Vulnerability from cvelistv5
Published
2026-08-15 05:54
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_nat_sip: reload possible stale data pointer
quoting sashiko:
------------------------------------------------------------------------
[..] noticed a potential memory bug and header corruption involving the
SIP NAT helper.
In net/netfilter/nf_nat_sip.c:nf_nat_sip():
if (skb_ensure_writable(skb, skb->len)) {
nf_ct_helper_log(skb, ct, "cannot mangle packet");
return NF_DROP;
}
uh = (void *)skb->data + protoff;
uh->dest = ct_sip_info->forced_dport;
if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,
0, 0, NULL, 0)) {
If a cloned or fragmented SKB is reallocated by skb_ensure_writable(), the
old data buffer is freed. However, nf_nat_sip() fails to update *dptr to
point to the new buffer.
It also appears to use nf_nat_mangle_udp_packet() on what could be a TCP
packet, which would overwrite the sequence number with a checksum update.
------------------------------------------------------------------------
nf_conntrack_sip linerizes skbs, hence no fragmented skb can be seen.
But clones are possible, so rebuild dptr.
Disable nf_nat_mangle_udp_packet() branch for TCP streams.
It doesn't look like this can ever happen, else we should have received
bug reports about this, so just check the conntrack is UDP and drop
otherwise.
The calling conntrack_sip set ->forced_dport for SIP_HDR_VIA_UDP messages,
so I don't think this is ever expected to be true for a TCP stream.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7266507d89991fa1e989283e4e032c6d9357fe26 Version: 7266507d89991fa1e989283e4e032c6d9357fe26 Version: 7266507d89991fa1e989283e4e032c6d9357fe26 Version: 7266507d89991fa1e989283e4e032c6d9357fe26 Version: 7266507d89991fa1e989283e4e032c6d9357fe26 Version: 7266507d89991fa1e989283e4e032c6d9357fe26 Version: 7266507d89991fa1e989283e4e032c6d9357fe26 Version: 7266507d89991fa1e989283e4e032c6d9357fe26 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72251",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:45:12.402575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:13.187Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bded21a4bf9bf86a79148be735723a97ca9a7532",
"status": "affected",
"version": "7266507d89991fa1e989283e4e032c6d9357fe26",
"versionType": "git"
},
{
"lessThan": "dc11f26685aa850f237226f0f463647aea58ab7c",
"status": "affected",
"version": "7266507d89991fa1e989283e4e032c6d9357fe26",
"versionType": "git"
},
{
"lessThan": "e38143c9b477f2968024c47c647dd4456a40aff1",
"status": "affected",
"version": "7266507d89991fa1e989283e4e032c6d9357fe26",
"versionType": "git"
},
{
"lessThan": "57e4e29644ec054d7021d296407e7ddd844afea2",
"status": "affected",
"version": "7266507d89991fa1e989283e4e032c6d9357fe26",
"versionType": "git"
},
{
"lessThan": "eae9c6ccb5af69c713a65f8ae219f5c1aa32cd17",
"status": "affected",
"version": "7266507d89991fa1e989283e4e032c6d9357fe26",
"versionType": "git"
},
{
"lessThan": "2bcf2c5052fb5e73e255140ab43f056aef409c27",
"status": "affected",
"version": "7266507d89991fa1e989283e4e032c6d9357fe26",
"versionType": "git"
},
{
"lessThan": "0e76e3e886cc9ee027337d5ad39cb96f57b7bdc7",
"status": "affected",
"version": "7266507d89991fa1e989283e4e032c6d9357fe26",
"versionType": "git"
},
{
"lessThan": "77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68",
"status": "affected",
"version": "7266507d89991fa1e989283e4e032c6d9357fe26",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_nat_sip: reload possible stale data pointer\n\nquoting sashiko:\n ------------------------------------------------------------------------\n [..] noticed a potential memory bug and header corruption involving the\n SIP NAT helper.\n\n In net/netfilter/nf_nat_sip.c:nf_nat_sip():\n\tif (skb_ensure_writable(skb, skb-\u003elen)) {\n\t\tnf_ct_helper_log(skb, ct, \"cannot mangle packet\");\n\t\treturn NF_DROP;\n\t}\n\tuh = (void *)skb-\u003edata + protoff;\n\tuh-\u003edest = ct_sip_info-\u003eforced_dport;\n\tif (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,\n\t\t\t\t 0, 0, NULL, 0)) {\n\n If a cloned or fragmented SKB is reallocated by skb_ensure_writable(), the\n old data buffer is freed. However, nf_nat_sip() fails to update *dptr to\n point to the new buffer.\n\n It also appears to use nf_nat_mangle_udp_packet() on what could be a TCP\n packet, which would overwrite the sequence number with a checksum update.\n ------------------------------------------------------------------------\n\nnf_conntrack_sip linerizes skbs, hence no fragmented skb can be seen.\nBut clones are possible, so rebuild dptr.\n\nDisable nf_nat_mangle_udp_packet() branch for TCP streams.\nIt doesn\u0027t look like this can ever happen, else we should have received\nbug reports about this, so just check the conntrack is UDP and drop\notherwise.\n\nThe calling conntrack_sip set -\u003eforced_dport for SIP_HDR_VIA_UDP messages,\nso I don\u0027t think this is ever expected to be true for a TCP stream."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is hit in nf_nat_sip() from sip_help_udp/tcp() during nf_confirm() on POST_ROUTING/LOCAL_IN while processing attacker-supplied SIP/UDP or SIP/TCP packets traversing a netfilter NAT gateway, so exploitation is via remote network traffic rather than local syscalls or physical access.\nAC:L - Once nf_conntrack_sip and nf_nat_sip are active on a NATed SIP flow, a remote peer can set forced_dport with a crafted Via header and drive the reply-path skb_ensure_writable() reallocation on cloned skbs without races or rare layout luck.\nPR:N - Exploitation needs no privileges on the victim kernel; a remote SIP endpoint only has to send malicious SIP through an already-configured SIP conntrack/NAT helper, with no authentication or local access to the firewall or router.\nUI:N - No victim user action is required beyond normal automated packet forwarding; the SIP helper parses and NAT-rewrites attacker-supplied SIP data in softirq during connection-tracking confirmation without opening files, clicking links, or mounting filesystems.\nS:U - Impact stays within kernel netfilter/conntrack memory on the same security authority (for example a NAT firewall, SBC, or VoIP gateway). This is standard kernel memory corruption, not a VM escape, sandbox breakout, or cross-tenant boundary violation.\nC:H - skb_ensure_writable() can free the old linear buffer while *dptr still points into it; sip_help_tcp() then continues parsing with that stale pointer, giving a use-after-free read of freed skb data and enabling disclosure of adjacent kernel heap contents.\nI:H - The stale dptr UAF and, on TCP flows, mistaken nf_nat_mangle_udp_packet() header rewriting corrupt kernel packet-buffer memory; such heap corruption is exploitable with grooming for arbitrary writes, control-flow hijacking, and kernel code execution.\nA:H - Use-after-free and mis-mangled L4 headers during softirq SIP NAT processing can trigger kernel oops/panic or reliably drop or corrupt in-flight VoIP signaling, causing high availability impact on internet-facing NAT/SBC systems handling SIP."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:42:03.339Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bded21a4bf9bf86a79148be735723a97ca9a7532"
},
{
"url": "https://git.kernel.org/stable/c/dc11f26685aa850f237226f0f463647aea58ab7c"
},
{
"url": "https://git.kernel.org/stable/c/e38143c9b477f2968024c47c647dd4456a40aff1"
},
{
"url": "https://git.kernel.org/stable/c/57e4e29644ec054d7021d296407e7ddd844afea2"
},
{
"url": "https://git.kernel.org/stable/c/eae9c6ccb5af69c713a65f8ae219f5c1aa32cd17"
},
{
"url": "https://git.kernel.org/stable/c/2bcf2c5052fb5e73e255140ab43f056aef409c27"
},
{
"url": "https://git.kernel.org/stable/c/0e76e3e886cc9ee027337d5ad39cb96f57b7bdc7"
},
{
"url": "https://git.kernel.org/stable/c/77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68"
}
],
"title": "netfilter: nf_nat_sip: reload possible stale data pointer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72251",
"datePublished": "2026-08-15T05:54:39.983Z",
"dateReserved": "2026-08-09T03:40:39.915Z",
"dateUpdated": "2026-10-16T18:55:13.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64563 (GCVE-0-2026-64563)
Vulnerability from cvelistv5
Published
2026-08-04 06:23
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
rhashtable: clear stale iter->p on table restart
rhashtable_walk_start_check() has two restart paths when resuming a walk.
When iter->walker.tbl is valid, it re-validates iter->p against the table
and sets iter->p = NULL if the object is gone. When iter->walker.tbl is
NULL (table was freed during resize), it resets slot and skip but forgets
to clear iter->p.
rhashtable_walk_next() then dereferences the stale iter->p, reading
freed memory. This is a use-after-free.
Any caller that does multi-fragment rhashtable walks across
walk_stop/walk_start boundaries is affected. Concrete cases include
netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC
(tipc_nl_sk_walk in net/tipc/socket.c).
Crash stack (netlink_diag):
BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0
Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)
Call Trace:
rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)
__netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)
netlink_diag_dump+0xc2/0x240
netlink_dump+0x5bc/0x1270
netlink_recvmsg+0x7a3/0x980
sock_recvmsg+0x1bc/0x200
__sys_recvfrom+0x1d4/0x2c0
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5d240a8936f6a1d3ece06701e8c4d830a2eca8a8 Version: 5d240a8936f6a1d3ece06701e8c4d830a2eca8a8 Version: 5d240a8936f6a1d3ece06701e8c4d830a2eca8a8 Version: 5d240a8936f6a1d3ece06701e8c4d830a2eca8a8 Version: 5d240a8936f6a1d3ece06701e8c4d830a2eca8a8 Version: 5d240a8936f6a1d3ece06701e8c4d830a2eca8a8 Version: 5d240a8936f6a1d3ece06701e8c4d830a2eca8a8 Version: 5d240a8936f6a1d3ece06701e8c4d830a2eca8a8 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64563",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:55.008845Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:41.938Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"lib/rhashtable.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ba510b5e9fe396497d31162acb579f210adfe6c8",
"status": "affected",
"version": "5d240a8936f6a1d3ece06701e8c4d830a2eca8a8",
"versionType": "git"
},
{
"lessThan": "a0406c40c6638c5ae50257db6297b2fba6c9ba16",
"status": "affected",
"version": "5d240a8936f6a1d3ece06701e8c4d830a2eca8a8",
"versionType": "git"
},
{
"lessThan": "0955b65c2b47c30b439e2cf1b1e375073aa0413a",
"status": "affected",
"version": "5d240a8936f6a1d3ece06701e8c4d830a2eca8a8",
"versionType": "git"
},
{
"lessThan": "c39643ad99fea749be50615550e8f0e6d6e60694",
"status": "affected",
"version": "5d240a8936f6a1d3ece06701e8c4d830a2eca8a8",
"versionType": "git"
},
{
"lessThan": "042fda5c088015f18838e5c692659a7be60aeb26",
"status": "affected",
"version": "5d240a8936f6a1d3ece06701e8c4d830a2eca8a8",
"versionType": "git"
},
{
"lessThan": "3ff7c1dbf722cf3fa538672452ba182318e0fcc3",
"status": "affected",
"version": "5d240a8936f6a1d3ece06701e8c4d830a2eca8a8",
"versionType": "git"
},
{
"lessThan": "4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3",
"status": "affected",
"version": "5d240a8936f6a1d3ece06701e8c4d830a2eca8a8",
"versionType": "git"
},
{
"lessThan": "8173f7e2ce67e6ca1d4763f3da14e5b01ce77456",
"status": "affected",
"version": "5d240a8936f6a1d3ece06701e8c4d830a2eca8a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"lib/rhashtable.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrhashtable: clear stale iter-\u003ep on table restart\n\nrhashtable_walk_start_check() has two restart paths when resuming a walk.\nWhen iter-\u003ewalker.tbl is valid, it re-validates iter-\u003ep against the table\nand sets iter-\u003ep = NULL if the object is gone. When iter-\u003ewalker.tbl is\nNULL (table was freed during resize), it resets slot and skip but forgets\nto clear iter-\u003ep.\n\nrhashtable_walk_next() then dereferences the stale iter-\u003ep, reading\nfreed memory. This is a use-after-free.\n\nAny caller that does multi-fragment rhashtable walks across\nwalk_stop/walk_start boundaries is affected. Concrete cases include\nnetlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC\n(tipc_nl_sk_walk in net/tipc/socket.c).\n\nCrash stack (netlink_diag):\n BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0\n Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)\n Call Trace:\n rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)\n __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)\n netlink_diag_dump+0xc2/0x240\n netlink_dump+0x5bc/0x1270\n netlink_recvmsg+0x7a3/0x980\n sock_recvmsg+0x1bc/0x200\n __sys_recvfrom+0x1d4/0x2c0"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Triggered via local netlink sock_diag dumps (e.g. netlink_diag over NETLINK_SOCK_DIAG) and similar local dump walkers such as TIPC_NL_SOCK_GET; not reachable from remote packet processing.\nAC:L - Attacker controls both sides of the race by running a multi-fragment rhashtable dump while concurrently creating/destroying netlink (or TIPC) sockets to force table resize and free the walked object.\nPR:L - An unprivileged local user can open NETLINK_SOCK_DIAG and dump without CAP_NET_ADMIN; CAP_NET_ADMIN is only required for SOCK_DESTROY, and TIPC_NL_SOCK_GET likewise has no admin permission flag.\nUI:N - Exploitation requires only attacker-issued syscalls (netlink dump plus concurrent socket churn); no victim action is needed.\nS:U - Impact is memory corruption within the host kernel authority (local privilege escalation/crash), not a cross-boundary escape such as guest-to-host or IOMMU bypass.\nC:H - Use-after-free read of a freed hashed object (e.g. netlink_sock) can be reclaimed via heap spray, yielding an arbitrary read primitive through subsequent walk/diag use of the corrupted pointer.\nI:H - UAF on a reclaimable slab object enables heap spraying and fake-object injection into the walk path, which can be leveraged for arbitrary write or control-flow hijacking.\nA:H - The demonstrated KASAN slab-use-after-free in rhashtable_walk_next can oops/panic the kernel, and UAFs remain crashable even when not fully exploited."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:34.797Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ba510b5e9fe396497d31162acb579f210adfe6c8"
},
{
"url": "https://git.kernel.org/stable/c/a0406c40c6638c5ae50257db6297b2fba6c9ba16"
},
{
"url": "https://git.kernel.org/stable/c/0955b65c2b47c30b439e2cf1b1e375073aa0413a"
},
{
"url": "https://git.kernel.org/stable/c/c39643ad99fea749be50615550e8f0e6d6e60694"
},
{
"url": "https://git.kernel.org/stable/c/042fda5c088015f18838e5c692659a7be60aeb26"
},
{
"url": "https://git.kernel.org/stable/c/3ff7c1dbf722cf3fa538672452ba182318e0fcc3"
},
{
"url": "https://git.kernel.org/stable/c/4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3"
},
{
"url": "https://git.kernel.org/stable/c/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456"
}
],
"title": "rhashtable: clear stale iter-\u003ep on table restart",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64563",
"datePublished": "2026-08-04T06:23:22.601Z",
"dateReserved": "2026-07-19T15:36:31.797Z",
"dateUpdated": "2026-10-19T20:48:41.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72466 (GCVE-0-2026-72466)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xprtrdma: Fix bcall rep leak and unbounded peek
rpcrdma_is_bcall() decodes a reply's first words to decide whether
the frame is a backchannel call. Two issues in that decode path
let a short or malformed reply leak the receive buffer and drain
the Receive queue.
First, the speculative peek
p = xdr_inline_decode(xdr, 0);
/* five p++ reads follow */
asks xdr_inline_decode() for zero bytes, which returns xdr->p
without consulting xdr->end. The five subsequent __be32 reads can
then walk up to 20 bytes past the wire payload into stale regbuf
contents and misclassify the reply as a backchannel call.
Second, after the post-peek
p = xdr_inline_decode(xdr, 3 * sizeof(*p));
if (unlikely(!p))
return true;
the short-header arm returns true without calling
rpcrdma_bc_receive_call(). The contract with the caller is that a
true return transfers ownership of rep to the backchannel path:
rpcrdma_reply_handler()
if (rpcrdma_is_bcall(r_xprt, rep))
return; /* bare return, skips out_post */
...
out_post:
rpcrdma_post_recvs(r_xprt, credits + ...);
Because rpcrdma_bc_receive_call() never ran, no one took rep, but
rpcrdma_reply_handler still bare-returns past rpcrdma_rep_put()
and rpcrdma_post_recvs(). The rep, with its persistently
DMA-mapped receive buffer, is orphaned on rb_all_reps and freed
only at transport teardown. This completion reposts nothing, so
its slot is reclaimed only when a later forward-channel reply
reaches out_post and rpcrdma_post_recvs() allocates a fresh rep to
backfill; absent that traffic the Receive queue drains and the
peer's Sends draw RNR NAKs.
Fix by consulting xdr->end after the zero-length peek so the five
__be32 reads cannot run unless 20 bytes of wire payload remain. A
byte-precise comparison against xdr->end is required because a
non-4-aligned receive rounds the stream's word count up past the
true payload. Also return false from the short-header arm so the
reply falls through the normal out_norqst cleanup chain
(rpcrdma_rep_put() plus rpcrdma_post_recvs()).
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 Version: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 Version: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 Version: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 Version: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 Version: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 Version: 41c8f70f5a3db7e06179186b6525fd9ee1d7d314 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72466",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:50:23.646833Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:25.296Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/rpc_rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0cee8f9c3b14bd6dee9c4310090a7f45b89b834f",
"status": "affected",
"version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
"versionType": "git"
},
{
"lessThan": "7afc2f8d2fd9394724df9eaf22ce7a71029a5fba",
"status": "affected",
"version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
"versionType": "git"
},
{
"lessThan": "88b5346284a184a6b7d019912232a571d672d3e3",
"status": "affected",
"version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
"versionType": "git"
},
{
"lessThan": "07aa506436be7634e381e1e1f6d0efa9efc81ecc",
"status": "affected",
"version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
"versionType": "git"
},
{
"lessThan": "d7a2870dde3bb09d51d6b9c877642996ad6b92dd",
"status": "affected",
"version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
"versionType": "git"
},
{
"lessThan": "118a16a18c59f7ad8084b2d13988839b669fca10",
"status": "affected",
"version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
"versionType": "git"
},
{
"lessThan": "c7653d5cebc8492c77ec0415b5e9c0fb3e644bc6",
"status": "affected",
"version": "41c8f70f5a3db7e06179186b6525fd9ee1d7d314",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/rpc_rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Fix bcall rep leak and unbounded peek\n\nrpcrdma_is_bcall() decodes a reply\u0027s first words to decide whether\nthe frame is a backchannel call. Two issues in that decode path\nlet a short or malformed reply leak the receive buffer and drain\nthe Receive queue.\n\nFirst, the speculative peek\n\n p = xdr_inline_decode(xdr, 0);\n /* five p++ reads follow */\n\nasks xdr_inline_decode() for zero bytes, which returns xdr-\u003ep\nwithout consulting xdr-\u003eend. The five subsequent __be32 reads can\nthen walk up to 20 bytes past the wire payload into stale regbuf\ncontents and misclassify the reply as a backchannel call.\n\nSecond, after the post-peek\n\n p = xdr_inline_decode(xdr, 3 * sizeof(*p));\n if (unlikely(!p))\n return true;\n\nthe short-header arm returns true without calling\nrpcrdma_bc_receive_call(). The contract with the caller is that a\ntrue return transfers ownership of rep to the backchannel path:\n\n rpcrdma_reply_handler()\n if (rpcrdma_is_bcall(r_xprt, rep))\n return; /* bare return, skips out_post */\n ...\n out_post:\n rpcrdma_post_recvs(r_xprt, credits + ...);\n\nBecause rpcrdma_bc_receive_call() never ran, no one took rep, but\nrpcrdma_reply_handler still bare-returns past rpcrdma_rep_put()\nand rpcrdma_post_recvs(). The rep, with its persistently\nDMA-mapped receive buffer, is orphaned on rb_all_reps and freed\nonly at transport teardown. This completion reposts nothing, so\nits slot is reclaimed only when a later forward-channel reply\nreaches out_post and rpcrdma_post_recvs() allocates a fresh rep to\nbackfill; absent that traffic the Receive queue drains and the\npeer\u0027s Sends draw RNR NAKs.\n\nFix by consulting xdr-\u003eend after the zero-length peek so the five\n__be32 reads cannot run unless 20 bytes of wire payload remain. A\nbyte-precise comparison against xdr-\u003eend is required because a\nnon-4-aligned receive rounds the stream\u0027s word count up past the\ntrue payload. Also return false from the short-header arm so the\nreply falls through the normal out_norqst cleanup chain\n(rpcrdma_rep_put() plus rpcrdma_post_recvs())."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when a remote RDMA peer\u0027s inbound message completes in rpcrdma_wc_receive() and rpcrdma_reply_handler() decodes it; a malicious or compromised NFS-over-RDMA server can send crafted short rdma_msg replies over the established RPC/RDMA connection without local access.\nAC:L - On an active NFSv4.1+ RPC/RDMA session the attacker fully controls inbound replies and can repeatedly send short/malformed rdma_msg frames to hit the zero-length peek and short-header return-true paths, reliably leaking receive buffers and draining the Receive queue.\nPR:N - Exploitation requires only network reachability as the connected RDMA/RPC peer (e.g., a malicious NFS server); no local account, mount privileges, or namespaced capabilities on the victim NFS client are needed to deliver the malformed RDMA replies.\nUI:N - Once an NFS-over-RDMA mount and NFSv4.1 backchannel session exist, triggering the flaw needs no additional victim action beyond the attacker sending malicious RDMA receive payloads during normal client-server communication.\nS:U - The vulnerability and its impact remain within the NFS client\u0027s kernel SUNRPC/xprtrdma transport context; it does not cross a VM, container, or IOMMU security boundary to affect other authorities.\nC:H - xdr_inline_decode(xdr,0) permits up to five subsequent __be32 reads past the wire payload into stale receive-buffer contents, an out-of-bounds read that can misclassify replies and expose remnants of prior RPC/NFS data to unintended processing paths.\nI:H - Stale-buffer-assisted misclassification can treat a forward-channel reply as a backchannel RPC_CALL, a type confusion that routes attacker-influenced bytes into rpcrdma_bc_receive_call()/NFSv4 callback handling and can corrupt client session state.\nA:H - Each successful trigger orphans a DMA-mapped rpcrdma_rep and skips rpcrdma_post_recvs(), monotonically draining the RDMA Receive queue until the peer gets RNR NAKs and the NFS-over-RDMA connection becomes unusable, enabling sustained remote denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:44:32.887Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0cee8f9c3b14bd6dee9c4310090a7f45b89b834f"
},
{
"url": "https://git.kernel.org/stable/c/7afc2f8d2fd9394724df9eaf22ce7a71029a5fba"
},
{
"url": "https://git.kernel.org/stable/c/88b5346284a184a6b7d019912232a571d672d3e3"
},
{
"url": "https://git.kernel.org/stable/c/07aa506436be7634e381e1e1f6d0efa9efc81ecc"
},
{
"url": "https://git.kernel.org/stable/c/d7a2870dde3bb09d51d6b9c877642996ad6b92dd"
},
{
"url": "https://git.kernel.org/stable/c/118a16a18c59f7ad8084b2d13988839b669fca10"
},
{
"url": "https://git.kernel.org/stable/c/c7653d5cebc8492c77ec0415b5e9c0fb3e644bc6"
}
],
"title": "xprtrdma: Fix bcall rep leak and unbounded peek",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72466",
"datePublished": "2026-08-15T05:57:09.847Z",
"dateReserved": "2026-08-09T03:40:39.933Z",
"dateUpdated": "2026-10-16T18:55:25.296Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63810 (GCVE-0-2026-63810)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-10-15 01:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
block: Avoid mounting the bdev pseudo-filesystem in userspace
The bdev pseudo-filesystem is an internal kernel filesystem with which
userspace should not interfere. Unregister it so that userspace cannot
even attempt to mount it.
This fixes a bug [1] that occurs when attempting to access files,
because the system call move_mount() uses pointers declared in the
inode_operations structure, which for the bdev pseudo-filesystem
are always equal to 0. `inode->i_op = &empty_iops;`
[1]
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 23380067 P4D 23380067 PUD 23381067 PMD 0
Oops: 0010 [#1] PREEMPT SMP KASAN NOPTI
CPU: 2 PID: 17125 Comm: syz-executor.0 Not tainted 6.1.155-syzkaller-00350-g84221fde2681 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:0x0
Call Trace:
<TASK>
lookup_open.isra.0+0x700/0x1180 fs/namei.c:3460
open_last_lookups fs/namei.c:3550 [inline]
path_openat+0x953/0x2700 fs/namei.c:3780
do_filp_open+0x1c5/0x410 fs/namei.c:3810
do_sys_openat2+0x171/0x4d0 fs/open.c:1318
do_sys_open fs/open.c:1334 [inline]
__do_sys_openat fs/open.c:1350 [inline]
__se_sys_openat fs/open.c:1345 [inline]
__x64_sys_openat+0x13c/0x1f0 fs/open.c:1345
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:23:32.309Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/bdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d3fcf23993bb756de2f912ab631cfdcc4746554",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "99cde0a7b1e98fd3970aabef1300918e91698dd5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1a02a5028bd6dead1f8503854ef3168d651cd417",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "197971e6ffc0a6356b2ba2b22beb42bc0f7e412d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3804e6de30ae7b053d53341d9d6944356cf23b40",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "717f721eb67d2dacd3ed5f7495aef2f442e84ce4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f73aa66dffcb8e61e78f01b56163ec16a15d06d2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/bdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: Avoid mounting the bdev pseudo-filesystem in userspace\n\nThe bdev pseudo-filesystem is an internal kernel filesystem with which\nuserspace should not interfere. Unregister it so that userspace cannot\neven attempt to mount it.\n\nThis fixes a bug [1] that occurs when attempting to access files,\nbecause the system call move_mount() uses pointers declared in the\ninode_operations structure, which for the bdev pseudo-filesystem\nare always equal to 0. `inode-\u003ei_op = \u0026empty_iops;`\n\n[1]\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor instruction fetch in kernel mode\n #PF: error_code(0x0010) - not-present page\n PGD 23380067 P4D 23380067 PUD 23381067 PMD 0\n Oops: 0010 [#1] PREEMPT SMP KASAN NOPTI\n CPU: 2 PID: 17125 Comm: syz-executor.0 Not tainted 6.1.155-syzkaller-00350-g84221fde2681 #0\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\n RIP: 0010:0x0\n\n Call Trace:\n \u003cTASK\u003e\n lookup_open.isra.0+0x700/0x1180 fs/namei.c:3460\n open_last_lookups fs/namei.c:3550 [inline]\n path_openat+0x953/0x2700 fs/namei.c:3780\n do_filp_open+0x1c5/0x410 fs/namei.c:3810\n do_sys_openat2+0x171/0x4d0 fs/open.c:1318\n do_sys_open fs/open.c:1334 [inline]\n __do_sys_openat fs/open.c:1350 [inline]\n __se_sys_openat fs/open.c:1345 [inline]\n __x64_sys_openat+0x13c/0x1f0 fs/open.c:1345\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:16.632Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d3fcf23993bb756de2f912ab631cfdcc4746554"
},
{
"url": "https://git.kernel.org/stable/c/99cde0a7b1e98fd3970aabef1300918e91698dd5"
},
{
"url": "https://git.kernel.org/stable/c/1a02a5028bd6dead1f8503854ef3168d651cd417"
},
{
"url": "https://git.kernel.org/stable/c/197971e6ffc0a6356b2ba2b22beb42bc0f7e412d"
},
{
"url": "https://git.kernel.org/stable/c/3804e6de30ae7b053d53341d9d6944356cf23b40"
},
{
"url": "https://git.kernel.org/stable/c/717f721eb67d2dacd3ed5f7495aef2f442e84ce4"
},
{
"url": "https://git.kernel.org/stable/c/f73aa66dffcb8e61e78f01b56163ec16a15d06d2"
}
],
"title": "block: Avoid mounting the bdev pseudo-filesystem in userspace",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63810",
"datePublished": "2026-07-19T12:02:12.484Z",
"dateReserved": "2026-07-19T07:54:57.013Z",
"dateUpdated": "2026-10-15T01:23:32.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64556 (GCVE-0-2026-64556)
Vulnerability from cvelistv5
Published
2026-07-29 08:01
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Detach event groups during remove_on_exec
perf_event_remove_on_exec() removes events by calling
perf_event_exit_event(). For top-level events, this removes the event from
the context with DETACH_EXIT only.
This can leave inconsistent group state when a removed event is a group
leader and the group contains siblings without remove_on_exec. If the group
was active, the surviving siblings can remain active and attached to the
removed leader's sibling list, but are no longer represented by a valid
group leader on the PMU context active lists.
A later close of the removed leader uses DETACH_GROUP and can promote the
still-active siblings from this stale group state. The next schedule-in can
then add an already-linked active_list entry again, corrupting the PMU
context active list.
With DEBUG_LIST enabled, this is caught as a list_add double-add in
merge_sched_in().
Fix this by detaching group relationships when remove_on_exec removes an
event. This preserves the existing task-exit and revoke behavior, while
ensuring surviving siblings are ungrouped before the removed event leaves
the context.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:33.956439Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-662",
"description": "CWE-662 Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:40.883Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2",
"status": "affected",
"version": "2e498d0a74e5b88a6689ae1b811f247f91ff188e",
"versionType": "git"
},
{
"lessThan": "39358e856fb89e62e3c8d7389a2dc4ec33dbe90e",
"status": "affected",
"version": "2e498d0a74e5b88a6689ae1b811f247f91ff188e",
"versionType": "git"
},
{
"lessThan": "a2d5d3ee7b6e3953114726b1521e62123ab5b043",
"status": "affected",
"version": "2e498d0a74e5b88a6689ae1b811f247f91ff188e",
"versionType": "git"
},
{
"lessThan": "06ccef0434e98058ddae7bcebc901f93d22b7653",
"status": "affected",
"version": "2e498d0a74e5b88a6689ae1b811f247f91ff188e",
"versionType": "git"
},
{
"lessThan": "037a3c43edfb597665dd34457cd22b14692f2ba3",
"status": "affected",
"version": "2e498d0a74e5b88a6689ae1b811f247f91ff188e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Detach event groups during remove_on_exec\n\nperf_event_remove_on_exec() removes events by calling\nperf_event_exit_event(). For top-level events, this removes the event from\nthe context with DETACH_EXIT only.\n\nThis can leave inconsistent group state when a removed event is a group\nleader and the group contains siblings without remove_on_exec. If the group\nwas active, the surviving siblings can remain active and attached to the\nremoved leader\u0027s sibling list, but are no longer represented by a valid\ngroup leader on the PMU context active lists.\n\nA later close of the removed leader uses DETACH_GROUP and can promote the\nstill-active siblings from this stale group state. The next schedule-in can\nthen add an already-linked active_list entry again, corrupting the PMU\ncontext active list.\n\nWith DEBUG_LIST enabled, this is caught as a list_add double-add in\nmerge_sched_in().\n\nFix this by detaching group relationships when remove_on_exec removes an\nevent. This preserves the existing task-exit and revoke behavior, while\nensuring surviving siblings are ungrouped before the removed event leaves\nthe context."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is triggered entirely through local syscalls \u2014 `perf_event_open(2)` to build the event group and `execve(2)`/`close(2)` to trigger the stale-group corruption. No network or physical vector is involved.\nAC:L - The attacker controls the entire deterministic sequence: create a pinned/enabled group with a `remove_on_exec` leader plus non-`remove_on_exec` siblings, exec, then close the leader. No race the attacker cannot influence is required.\nPR:L - An unprivileged user can open perf events on their own task with `exclude_kernel=1` even at the default `perf_event_paranoid=2`, requiring no capability. Basic local user access suffices.\nUI:N - The attacking process performs every step itself (open, exec, close); no action from any other user is needed.\nS:U - The corruption stays within the kernel\u0027s own security authority (PMU context list in kernel heap); it does not cross a hypervisor/IOMMU/sandbox boundary.\nC:H - Corrupting the doubly-linked active list of `perf_event` objects yields pointer manipulation over heap-embedded list nodes, which can be leveraged to read adjacent/freed kernel memory for information disclosure.\nI:H - A double `list_add`/subsequent list operations on a corrupted list provide write-what-where-style primitives against attacker-influenceable heap objects, enabling arbitrary modification and control-flow hijack.\nA:H - The list corruption reliably produces a kernel crash/oops (caught as a list_add double-add under DEBUG_LIST, silent corruption and panic otherwise), causing denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:34.489Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2"
},
{
"url": "https://git.kernel.org/stable/c/39358e856fb89e62e3c8d7389a2dc4ec33dbe90e"
},
{
"url": "https://git.kernel.org/stable/c/a2d5d3ee7b6e3953114726b1521e62123ab5b043"
},
{
"url": "https://git.kernel.org/stable/c/06ccef0434e98058ddae7bcebc901f93d22b7653"
},
{
"url": "https://git.kernel.org/stable/c/037a3c43edfb597665dd34457cd22b14692f2ba3"
}
],
"title": "perf/core: Detach event groups during remove_on_exec",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64556",
"datePublished": "2026-07-29T08:01:46.864Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-10-19T20:48:40.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74508 (GCVE-0-2026-74508)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: HIDP: reject frames without a transaction header
hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0]
before checking that the L2CAP SDU contains a transaction header. A
connected HIDP peer can send an empty basic-mode SDU and make both paths
use an uninitialized byte from skb tailroom.
KMSAN reports the use in hidp_session_run(), with the uninitialized value
originating in __alloc_skb() through vhci_write(). The control path
produces two reports and the interrupt path produces one.
The byte can also be controlled by a malformed lower-layer packet. If an
HCI ACL packet contains an L2CAP PDU with a declared zero-length payload
followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to
the declared PDU length before dispatch. The current HIDP path nevertheless
consumes the extra byte as HIDP_TRANS_HID_CONTROL |
HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this
change, the same packet is discarded and a subsequent feature report
request succeeds.
Pull the transaction header with skb_pull_data() and discard frames that
do not contain it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74508",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:58:35.164112Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:51.205Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hidp/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "238c333bc4b3f245c626632e8bfa3c9dab97f51b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "567a2a0a633f2ea5fdccaf3517c09f22c9d860c7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "97b61241ab45bfa5b0526cb0f3978942493bc811",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2ebf63aa557a69990b4e9ea22be224d58aabce96",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "854194494a6f726a60b90b76059148bf08df023d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "47778d2c2087b5d192398f6fddf692d16a5431cf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hidp/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: reject frames without a transaction header\n\nhidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb-\u003edata[0]\nbefore checking that the L2CAP SDU contains a transaction header. A\nconnected HIDP peer can send an empty basic-mode SDU and make both paths\nuse an uninitialized byte from skb tailroom.\n\nKMSAN reports the use in hidp_session_run(), with the uninitialized value\noriginating in __alloc_skb() through vhci_write(). The control path\nproduces two reports and the interrupt path produces one.\n\nThe byte can also be controlled by a malformed lower-layer packet. If an\nHCI ACL packet contains an L2CAP PDU with a declared zero-length payload\nfollowed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb-\u003elen to\nthe declared PDU length before dispatch. The current HIDP path nevertheless\nconsumes the extra byte as HIDP_TRANS_HID_CONTROL |\nHIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this\nchange, the same packet is discarded and a subsequent feature report\nrequest succeeds.\n\nPull the transaction header with skb_pull_data() and discard frames that\ndo not contain it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Malicious or malformed Bluetooth L2CAP SDUs reach hidp_recv_ctrl_frame()/hidp_recv_intr_frame() from a radio-adjacent peer via hci_acl_packet() -\u003e l2cap_recv_acldata() -\u003e l2cap_recv_frame() -\u003e l2cap_sock_recv_cb() -\u003e hidp_session_run().\nAC:L - A connected HIDP peer reliably triggers the bug by sending empty basic-mode SDUs or zero-length L2CAP PDUs with trailing bytes; the attacker controls both sides of the malformed-packet condition without races or rare kernel configs.\nPR:N - Exploitation requires only delivering crafted Bluetooth ACL/L2CAP traffic as the connected peer; the victim attacker does not need local accounts, capabilities, or CAP_NET_ADMIN on the target host.\nUI:N - Once a normal Bluetooth HID session is active (typical paired keyboard/mouse/headset use), the attacker can send malicious frames without any additional victim interaction during exploitation.\nS:U - The flaw affects kernel Bluetooth HIDP session handling only and does not cross VM, container, or IOMMU security boundaries; impact stays within the kernel Bluetooth/HID authority.\nC:H - On zero-length SDUs, hidp_recv_*_frame() reads skb-\u003edata[0] from uninitialized skb tailroom (KMSAN via vhci_write/__alloc_skb), leaking kernel heap bytes that drive subsequent protocol parsing.\nI:H - Attacker-controlled header bytes (e.g., malformed PDU trailing 0x15 = HIDP_TRANS_HID_CONTROL|HIDP_CTRL_VIRTUAL_CABLE_UNPLUG) force hidp_process_hid_control() to tear down sessions and can misroute other transaction types through handshake/data handlers.\nA:H - Forged virtual-cable-unplug and related control-path handling forcibly terminates active HIDP sessions, completely denying Bluetooth HID input/output on phones, laptops, kiosks, and embedded systems until reconnect."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:47:28.838Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8"
},
{
"url": "https://git.kernel.org/stable/c/238c333bc4b3f245c626632e8bfa3c9dab97f51b"
},
{
"url": "https://git.kernel.org/stable/c/567a2a0a633f2ea5fdccaf3517c09f22c9d860c7"
},
{
"url": "https://git.kernel.org/stable/c/46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec"
},
{
"url": "https://git.kernel.org/stable/c/97b61241ab45bfa5b0526cb0f3978942493bc811"
},
{
"url": "https://git.kernel.org/stable/c/2ebf63aa557a69990b4e9ea22be224d58aabce96"
},
{
"url": "https://git.kernel.org/stable/c/854194494a6f726a60b90b76059148bf08df023d"
},
{
"url": "https://git.kernel.org/stable/c/47778d2c2087b5d192398f6fddf692d16a5431cf"
}
],
"title": "Bluetooth: HIDP: reject frames without a transaction header",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74508",
"datePublished": "2026-08-15T12:27:31.288Z",
"dateReserved": "2026-08-15T05:44:03.908Z",
"dateUpdated": "2026-10-16T19:05:51.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64334 (GCVE-0-2026-64334)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: digi_acceleport: fix hard lockup on disconnect
If submitting the OOB write urb fails persistently (e.g if the device is
being disconnected) the driver would loop indefinitely with interrupts
disabled.
Check for urb submission errors when sending OOB commands to avoid
hanging if, for example, open(), set_termios() or close() races with a
physical disconnect.
This is issue was flagged by Sashiko when reviewing an unrelated change
to the driver.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/digi_acceleport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6e51147c2744d15730084dc89cc99180d3de4184",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6a8592ace932081ea11aea41c460a1ca0f6344a4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5a82d842e8c35227d7227f19e5e654df1451782c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bcfeae431db9986c2b313e6a760f2ac8df61e138",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2067b3838da6e4af03bae3630414193188d754b2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2b7dc482f859f2d027db07ff0efc1c5df5b3451a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "79bc131df0e50f8f663c1fdbbe952aaf193a8d39",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5c1ea24b53bf3bfb859f0a05573997487975da23",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/digi_acceleport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: digi_acceleport: fix hard lockup on disconnect\n\nIf submitting the OOB write urb fails persistently (e.g if the device is\nbeing disconnected) the driver would loop indefinitely with interrupts\ndisabled.\n\nCheck for urb submission errors when sending OOB commands to avoid\nhanging if, for example, open(), set_termios() or close() races with a\nphysical disconnect.\n\nThis is issue was flagged by Sashiko when reviewing an unrelated change\nto the driver."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:37.202Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6e51147c2744d15730084dc89cc99180d3de4184"
},
{
"url": "https://git.kernel.org/stable/c/6a8592ace932081ea11aea41c460a1ca0f6344a4"
},
{
"url": "https://git.kernel.org/stable/c/5a82d842e8c35227d7227f19e5e654df1451782c"
},
{
"url": "https://git.kernel.org/stable/c/bcfeae431db9986c2b313e6a760f2ac8df61e138"
},
{
"url": "https://git.kernel.org/stable/c/2067b3838da6e4af03bae3630414193188d754b2"
},
{
"url": "https://git.kernel.org/stable/c/2b7dc482f859f2d027db07ff0efc1c5df5b3451a"
},
{
"url": "https://git.kernel.org/stable/c/79bc131df0e50f8f663c1fdbbe952aaf193a8d39"
},
{
"url": "https://git.kernel.org/stable/c/5c1ea24b53bf3bfb859f0a05573997487975da23"
}
],
"title": "USB: serial: digi_acceleport: fix hard lockup on disconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64334",
"datePublished": "2026-07-25T08:50:00.229Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:37.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74584 (GCVE-0-2026-74584)
Vulnerability from cvelistv5
Published
2026-08-22 14:28
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_re: zero shared page before exposing to userspace
bnxt_re_alloc_ucontext() allocates uctx->shpg via
__get_free_page(GFP_KERNEL). The buddy allocator does not zero pages
without __GFP_ZERO, so the page contains stale kernel data from
whatever object most recently freed it.
The page is then mapped into userspace via vm_insert_page() under
BNXT_RE_MMAP_SH_PAGE in bnxt_re_mmap(). The driver only ever writes
4 bytes (a u32 AVID) at offset BNXT_RE_AVID_OFFT (0x10) inside
bnxt_re_create_ah(); the remaining 4092 bytes of the page are exposed
to userspace unsanitised, leaking kernel memory contents.
Any user with access to /dev/infiniband/uverbsX on a host with a
bnxt_re device (typically rdma group membership) can read this data
via a single mmap() at pgoff 0 after IB_USER_VERBS_CMD_GET_CONTEXT.
Other shared pages in the same file already use get_zeroed_page()
correctly:
drivers/infiniband/hw/bnxt_re/ib_verbs.c
srq->uctx_srq_page = (void *)get_zeroed_page(GFP_KERNEL);
cq->uctx_cq_page = (void *)get_zeroed_page(GFP_KERNEL);
uctx->shpg is the only outlier. Bring it in line with the existing
convention by switching to get_zeroed_page().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 Version: 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 Version: 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 Version: 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 Version: 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 Version: 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 Version: 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 Version: 1ac5a404797523cedaf424a3aaa3cf8f9548dff8 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74584",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:01:20.354025Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:58.544Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/ib_verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "53c97e9882f4e747b4ac31b211317c2eba541af9",
"status": "affected",
"version": "1ac5a404797523cedaf424a3aaa3cf8f9548dff8",
"versionType": "git"
},
{
"lessThan": "9896bdfd21d918e9f26a52bc6109cc77970ee0b1",
"status": "affected",
"version": "1ac5a404797523cedaf424a3aaa3cf8f9548dff8",
"versionType": "git"
},
{
"lessThan": "9128c2411b83a64c0a69d2ff059c741bde25a9cc",
"status": "affected",
"version": "1ac5a404797523cedaf424a3aaa3cf8f9548dff8",
"versionType": "git"
},
{
"lessThan": "c19b360fa10c521c0b681875cdaa51545d45a491",
"status": "affected",
"version": "1ac5a404797523cedaf424a3aaa3cf8f9548dff8",
"versionType": "git"
},
{
"lessThan": "a3ed2daab02b2a706e882ad31b5c3c4f33cb5bb1",
"status": "affected",
"version": "1ac5a404797523cedaf424a3aaa3cf8f9548dff8",
"versionType": "git"
},
{
"lessThan": "e2b143df29003d2704b51f62e9297006953dbacb",
"status": "affected",
"version": "1ac5a404797523cedaf424a3aaa3cf8f9548dff8",
"versionType": "git"
},
{
"lessThan": "c75f8ce4baa29ae57fe615c6a2c5101f59b8b89a",
"status": "affected",
"version": "1ac5a404797523cedaf424a3aaa3cf8f9548dff8",
"versionType": "git"
},
{
"lessThan": "f6b079629becfa977f9c51fe53ad2e6dcc55ef44",
"status": "affected",
"version": "1ac5a404797523cedaf424a3aaa3cf8f9548dff8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/bnxt_re/ib_verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: zero shared page before exposing to userspace\n\nbnxt_re_alloc_ucontext() allocates uctx-\u003eshpg via\n__get_free_page(GFP_KERNEL). The buddy allocator does not zero pages\nwithout __GFP_ZERO, so the page contains stale kernel data from\nwhatever object most recently freed it.\n\nThe page is then mapped into userspace via vm_insert_page() under\nBNXT_RE_MMAP_SH_PAGE in bnxt_re_mmap(). The driver only ever writes\n4 bytes (a u32 AVID) at offset BNXT_RE_AVID_OFFT (0x10) inside\nbnxt_re_create_ah(); the remaining 4092 bytes of the page are exposed\nto userspace unsanitised, leaking kernel memory contents.\n\nAny user with access to /dev/infiniband/uverbsX on a host with a\nbnxt_re device (typically rdma group membership) can read this data\nvia a single mmap() at pgoff 0 after IB_USER_VERBS_CMD_GET_CONTEXT.\n\nOther shared pages in the same file already use get_zeroed_page()\ncorrectly:\n\n drivers/infiniband/hw/bnxt_re/ib_verbs.c\n srq-\u003euctx_srq_page = (void *)get_zeroed_page(GFP_KERNEL);\n cq-\u003euctx_cq_page = (void *)get_zeroed_page(GFP_KERNEL);\n\nuctx-\u003eshpg is the only outlier. Bring it in line with the existing\nconvention by switching to get_zeroed_page()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The leak is triggered only through local access to /dev/infiniband/uverbs* via ioctl GET_CONTEXT and mmap(pgoff 0); bnxt_re_mmap maps the shared page with vm_insert_page, and remote RoCE/IB packet handling never reaches this uverbs allocation path.\nAC:L - On a host with bnxt_re loaded, opening uverbs, issuing GET_CONTEXT, and mmap at offset 0 deterministically exposes the unstale page; the attacker controls all syscall parameters and needs no race, special memory layout, or victim-specific state.\nPR:N - Kernel uverbs character devices are created world-accessible (mode 0666) via uverbs_devnode, and ib_uverbs_open performs no capability or root check beyond netns access, so any local process can open the device and allocate a bnxt_re ucontext.\nUI:N - Exploitation requires only attacker-driven open/ioctl/mmap/read syscalls on their own uverbs file descriptor; no cooperative victim action such as mounting filesystems, opening files, or clicking links is needed.\nS:C - On HPC/cloud hosts exposing bnxt_re to tenant containers or shared RDMA workloads, mmap of unstale host-kernel buddy pages leaks host kernel memory across the container/tenant security boundary into an unprivileged workload\u0027s address space.\nC:H - __get_free_page without __GFP_ZERO leaves up to 4092 bytes of stale kernel heap/slack data readable per ucontext; repeated opens yield additional pages, disclosing kernel pointers, structures, and other sensitive material beyond a few-byte bounded leak.\nI:N - The flaw only exposes existing kernel memory contents to userspace via mmap; it does not corrupt, overwrite, or modify kernel objects, grant write primitives, or enable code execution through the shared page mapping.\nA:N - Reading the unstale mapped page does not trigger kernel oops, panic, hang, or resource exhaustion; the vulnerable path completes normally and availability is unaffected aside from normal per-context page allocation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:11.315Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/53c97e9882f4e747b4ac31b211317c2eba541af9"
},
{
"url": "https://git.kernel.org/stable/c/9896bdfd21d918e9f26a52bc6109cc77970ee0b1"
},
{
"url": "https://git.kernel.org/stable/c/9128c2411b83a64c0a69d2ff059c741bde25a9cc"
},
{
"url": "https://git.kernel.org/stable/c/c19b360fa10c521c0b681875cdaa51545d45a491"
},
{
"url": "https://git.kernel.org/stable/c/a3ed2daab02b2a706e882ad31b5c3c4f33cb5bb1"
},
{
"url": "https://git.kernel.org/stable/c/e2b143df29003d2704b51f62e9297006953dbacb"
},
{
"url": "https://git.kernel.org/stable/c/c75f8ce4baa29ae57fe615c6a2c5101f59b8b89a"
},
{
"url": "https://git.kernel.org/stable/c/f6b079629becfa977f9c51fe53ad2e6dcc55ef44"
}
],
"title": "RDMA/bnxt_re: zero shared page before exposing to userspace",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74584",
"datePublished": "2026-08-22T14:28:07.988Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-10-16T19:05:58.544Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68238 (GCVE-0-2026-68238)
Vulnerability from cvelistv5
Published
2026-08-10 12:01
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Release VFCT ACPI table reference
amdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table()
but never releases it. acpi_get_table() takes a reference on the
table (incrementing its validation_count and mapping it on the 0->1
transition); without a paired acpi_put_table() the mapping is leaked
on every call, whether or not a matching VBIOS image is found.
Route all exit paths after the table is acquired through a common
acpi_put_table(). The VBIOS image is copied out with kmemdup() before
the table is released, so it remains valid for the caller.
(cherry picked from commit ca5988682b4cba4cd125a0fa99b2de1239164ae4)
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1748043b5114ce5ee5ee874d5f821a158d70631c",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "50a75929c0c5e8ab29a3ac49dc92489873d9d261",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "312278b3091912fa56a6a587609f17dcb33465c2",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "9b7de3ee5d2c5ee2a706e5f7ca0126f4fbea4da8",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "65bff26617607c1331283232016c0e89088c5b78",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Release VFCT ACPI table reference\n\namdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table()\nbut never releases it. acpi_get_table() takes a reference on the\ntable (incrementing its validation_count and mapping it on the 0-\u003e1\ntransition); without a paired acpi_put_table() the mapping is leaked\non every call, whether or not a matching VBIOS image is found.\n\nRoute all exit paths after the table is acquired through a common\nacpi_put_table(). The VBIOS image is copied out with kmemdup() before\nthe table is released, so it remains valid for the caller.\n\n(cherry picked from commit ca5988682b4cba4cd125a0fa99b2de1239164ae4)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:35.374Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1748043b5114ce5ee5ee874d5f821a158d70631c"
},
{
"url": "https://git.kernel.org/stable/c/50a75929c0c5e8ab29a3ac49dc92489873d9d261"
},
{
"url": "https://git.kernel.org/stable/c/312278b3091912fa56a6a587609f17dcb33465c2"
},
{
"url": "https://git.kernel.org/stable/c/9b7de3ee5d2c5ee2a706e5f7ca0126f4fbea4da8"
},
{
"url": "https://git.kernel.org/stable/c/65bff26617607c1331283232016c0e89088c5b78"
}
],
"title": "drm/amdgpu: Release VFCT ACPI table reference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68238",
"datePublished": "2026-08-10T12:01:03.277Z",
"dateReserved": "2026-07-30T09:28:09.376Z",
"dateUpdated": "2026-10-21T12:43:35.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68315 (GCVE-0-2026-68315)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate stream count in sctp_process_strreset_inreq()
When processing a RESET_IN_REQUEST from a peer,
sctp_process_strreset_inreq() derives the stream count from the
parameter length but does not check whether the resulting
RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN.
The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes
larger than the IN request header (sctp_strreset_inreq, 8 bytes).
Generally, the IP payload is bounded to 65535 bytes, so the stream
list cannot be large enough to trigger the overflow. However, on
interfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a
stream list that fits within the incoming IN parameter can cause a
__u16 overflow in sctp_make_strreset_req() when computing the OUT
request size, leading to an undersized skb allocation and a kernel
BUG:
net/core/skbuff.c:207 skb_panic
net/core/skbuff.c:2625 skb_put
net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk
net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req
net/sctp/stream.c:655 sctp_process_strreset_inreq
The local setsockopt path validates the generated reset request size.
However, for an incoming-only reset, it accounts for the smaller IN
request even though the peer must generate an OUT request with the same
stream list. Such a request cannot be completed successfully by the
peer.
Reject peer IN requests whose corresponding OUT request would exceed
SCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an
IN request that would require an oversized OUT request from the peer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 Version: 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 Version: 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 Version: 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 Version: 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 Version: 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 Version: 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 Version: 7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68315",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:47:00.535274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:04.525Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/stream.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "61327d8e7cfb0259d527be17202630f556213249",
"status": "affected",
"version": "7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137",
"versionType": "git"
},
{
"lessThan": "7cf7439948e3bf639119119922c88ec190874ca3",
"status": "affected",
"version": "7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137",
"versionType": "git"
},
{
"lessThan": "60c47dea5d320d2fc706e9aad1db38a04df0a056",
"status": "affected",
"version": "7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137",
"versionType": "git"
},
{
"lessThan": "b255d8cd6cc68045ae9eecbac3b3c14e1f176c9b",
"status": "affected",
"version": "7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137",
"versionType": "git"
},
{
"lessThan": "6f0e39d180cd7cced647381b6fa14fd83d261047",
"status": "affected",
"version": "7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137",
"versionType": "git"
},
{
"lessThan": "1a10fe1aa9c01f41b389a31906a77d538637c9d9",
"status": "affected",
"version": "7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137",
"versionType": "git"
},
{
"lessThan": "00ae679cb21a035491fdad8d58dc6d79cc68b675",
"status": "affected",
"version": "7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137",
"versionType": "git"
},
{
"lessThan": "18ae07691d43183d270de8be9dc8e027906015d9",
"status": "affected",
"version": "7f9d68ac944e24ee5f9ac8d059ca00b1c1d34137",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/stream.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate stream count in sctp_process_strreset_inreq()\n\nWhen processing a RESET_IN_REQUEST from a peer,\nsctp_process_strreset_inreq() derives the stream count from the\nparameter length but does not check whether the resulting\nRESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN.\n\nThe OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes\nlarger than the IN request header (sctp_strreset_inreq, 8 bytes).\nGenerally, the IP payload is bounded to 65535 bytes, so the stream\nlist cannot be large enough to trigger the overflow. However, on\ninterfaces with MTU \u003e 65535 (e.g., loopback with IPv6 jumbograms), a\nstream list that fits within the incoming IN parameter can cause a\n__u16 overflow in sctp_make_strreset_req() when computing the OUT\nrequest size, leading to an undersized skb allocation and a kernel\nBUG:\n\n net/core/skbuff.c:207 skb_panic\n net/core/skbuff.c:2625 skb_put\n net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk\n net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req\n net/sctp/stream.c:655 sctp_process_strreset_inreq\n\nThe local setsockopt path validates the generated reset request size.\nHowever, for an incoming-only reset, it accounts for the smaller IN\nrequest even though the peer must generate an OUT request with the same\nstream list. Such a request cannot be completed successfully by the\npeer.\n\nReject peer IN requests whose corresponding OUT request would exceed\nSCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an\nIN request that would require an oversized OUT request from the peer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerability is triggered by processing an SCTP RECONF chunk (RESET_IN_REQUEST) received from a remote/loopback peer in the in-kernel SCTP stack; per kernel guidance net-stack bugs reachable via received packets are Network.\nAC:L - The attacker fully controls the stream list length in the IN request, and the required MTU\u003e65535 is the default for loopback (65536), so the panic is reliably triggerable; stream-reset must be enabled but that is a deployment condition, not an attacker-uncontrollable one.\nPR:N - Sending the RECONF chunk only requires an established SCTP association, which any peer can set up without authentication or credentials; the bug is reached during normal association-scoped packet processing.\nUI:N - No victim interaction is needed; the attacker simply sends a crafted RECONF chunk to an established association.\nS:U - The crash occurs within the kernel\u0027s own security scope with no crossing of a security boundary such as VM or IOMMU.\nC:N - The bug is a controlled BUG()/skb_over_panic that aborts before any out-of-bounds access, disclosing no memory contents.\nI:N - The panic fires before the oversized copy executes, so no memory is written or modified out of bounds.\nA:H - The undersized skb allocation causes skb_put to invoke skb_over_panic \u2192 BUG(), producing a kernel panic (denial of service)."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:33:08.206Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/61327d8e7cfb0259d527be17202630f556213249"
},
{
"url": "https://git.kernel.org/stable/c/7cf7439948e3bf639119119922c88ec190874ca3"
},
{
"url": "https://git.kernel.org/stable/c/60c47dea5d320d2fc706e9aad1db38a04df0a056"
},
{
"url": "https://git.kernel.org/stable/c/b255d8cd6cc68045ae9eecbac3b3c14e1f176c9b"
},
{
"url": "https://git.kernel.org/stable/c/6f0e39d180cd7cced647381b6fa14fd83d261047"
},
{
"url": "https://git.kernel.org/stable/c/1a10fe1aa9c01f41b389a31906a77d538637c9d9"
},
{
"url": "https://git.kernel.org/stable/c/00ae679cb21a035491fdad8d58dc6d79cc68b675"
},
{
"url": "https://git.kernel.org/stable/c/18ae07691d43183d270de8be9dc8e027906015d9"
}
],
"title": "sctp: validate stream count in sctp_process_strreset_inreq()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68315",
"datePublished": "2026-08-10T12:02:50.156Z",
"dateReserved": "2026-07-30T09:28:09.382Z",
"dateUpdated": "2026-10-19T21:09:04.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80580 (GCVE-0-2026-80580)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-10-16 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: bound mode sysfs output to the sysfs buffer
mode_string() uses snprintf() which can return a value larger than the
remaining buffer space. show_modes() accumulates the return value into i
without checking whether i has reached PAGE_SIZE, causing the offset to
advance past the sysfs buffer if the modelist is long enough.
Add a size parameter to mode_string() and use scnprintf() to return
only the bytes actually written. Add an early return when offset
already exceeds the buffer. In show_modes(), stop accumulating once
the buffer is full.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80580",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:17:49.806822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:28.187Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbsysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "873a1aa15c313263f2e18b38cf525623cc4fabf6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d15d51fb26e830af58f3f21964f1c09c239077ea",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbsysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: bound mode sysfs output to the sysfs buffer\n\nmode_string() uses snprintf() which can return a value larger than the\nremaining buffer space. show_modes() accumulates the return value into i\nwithout checking whether i has reached PAGE_SIZE, causing the offset to\nadvance past the sysfs buffer if the modelist is long enough.\n\nAdd a size parameter to mode_string() and use scnprintf() to return\nonly the bytes actually written. Add an early return when offset\nalready exceeds the buffer. In show_modes(), stop accumulating once\nthe buffer is full."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only by a local read(2) on /sys/class/graphics/fbN/modes, which flows through sysfs/kernfs into show_modes(); there is no network, adjacent-network, or physical-device packet path to this framebuffer sysfs handler.\nAC:L - Once the framebuffer modelist is long enough to fill PAGE_SIZE, snprintf\u0027s oversized return value deterministically pushes the offset past the buffer and subsequent writes use a wrapped huge size; an attacker can also grow the list via repeated FBIOPUT_VSCREENINFO or a privileged store_modes write.\nPR:L - The modes sysfs attribute is DEVICE_ATTR_RW with mode 0644, so any unprivileged local user can open and read it without capabilities; only populating an unusually long modelist may require root or membership in the video group for /dev/fb0 ioctl access.\nUI:N - Exploitation requires only the attacker reading the modes sysfs file themselves; no separate victim action such as mounting a filesystem or opening a file is needed.\nS:U - The overflow corrupts kernel heap memory within the same OS security boundary and can enable local privilege escalation, but it does not cross VM, IOMMU, or sandbox isolation boundaries.\nC:H - Writing past the PAGE_SIZE sysfs seq_file buffer is an out-of-bounds kernel heap write; once the offset exceeds PAGE_SIZE the remaining-length underflow gives snprintf an enormous size, corrupting adjacent kmalloc objects and enabling information disclosure.\nI:H - The unchecked offset advance causes repeated out-of-bounds writes into kernel heap memory beyond the sysfs buffer, a memory-corruption primitive that can be leveraged for arbitrary kernel writes or control-flow hijacking.\nA:H - Corrupting heap objects adjacent to the sysfs read buffer can trigger immediate kernel oops/panic or later crashes when those objects are used, satisfying High availability impact for kernel memory corruption."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:02:01.683Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/873a1aa15c313263f2e18b38cf525623cc4fabf6"
},
{
"url": "https://git.kernel.org/stable/c/d15d51fb26e830af58f3f21964f1c09c239077ea"
}
],
"title": "fbdev: bound mode sysfs output to the sysfs buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80580",
"datePublished": "2026-08-26T14:37:37.917Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-10-16T19:26:28.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74406 (GCVE-0-2026-74406)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().
udp_tunnel_sock_release() could set sk->sk_user_data to NULL
while vxlan_gro_prepare_receive() is running.
Let's check if rcu_dereference_sk_user_data() is NULL after
skb_gro_remcsum_init().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5602c48cf87562c2f95b831d690631935e834295 Version: 5602c48cf87562c2f95b831d690631935e834295 Version: 5602c48cf87562c2f95b831d690631935e834295 Version: 5602c48cf87562c2f95b831d690631935e834295 Version: 5602c48cf87562c2f95b831d690631935e834295 Version: 5602c48cf87562c2f95b831d690631935e834295 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74406",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:55:52.328317Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:43.336Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9c58c729d32e7cea5772cc44929c6cd61e5a31cd",
"status": "affected",
"version": "5602c48cf87562c2f95b831d690631935e834295",
"versionType": "git"
},
{
"lessThan": "f79c80f173fda9545b220c1f094b65fc06c252d0",
"status": "affected",
"version": "5602c48cf87562c2f95b831d690631935e834295",
"versionType": "git"
},
{
"lessThan": "08f40c0d23c67c3aa4224c3311e134999c721fb4",
"status": "affected",
"version": "5602c48cf87562c2f95b831d690631935e834295",
"versionType": "git"
},
{
"lessThan": "4a8cde6f7281ea2c4c290f9ad9923b3631defceb",
"status": "affected",
"version": "5602c48cf87562c2f95b831d690631935e834295",
"versionType": "git"
},
{
"lessThan": "ef44dac2a37f86eeae6b88ed10a6d60b35387dfd",
"status": "affected",
"version": "5602c48cf87562c2f95b831d690631935e834295",
"versionType": "git"
},
{
"lessThan": "30a45c0bffdd62350261e2f2689fdba426a33578",
"status": "affected",
"version": "5602c48cf87562c2f95b831d690631935e834295",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().\n\nudp_tunnel_sock_release() could set sk-\u003esk_user_data to NULL\nwhile vxlan_gro_prepare_receive() is running.\n\nLet\u0027s check if rcu_dereference_sk_user_data() is NULL after\nskb_gro_remcsum_init()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in vxlan_gro_prepare_receive() on the UDP GRO receive path; remote VXLAN/UDP packets reach it via inet_gro_receive\u2192udp4_gro_receive\u2192udp_tunnel_gro_rcv\u2192vxlan_gro_receive during NAPI processing on internet/cloud overlay endpoints.\nAC:L - An attacker can reliably trigger the race by flooding VXLAN GRO packets while concurrently tearing down the VXLAN device (e.g., via CAP_NET_ADMIN in a user namespace); repeated attempts during orchestrated interface churn also make the timing window attacker-driven rather than purely environmental.\nPR:N - Exploitation requires only the ability to send crafted VXLAN UDP traffic to a listening tunnel port; no target credentials or local account are needed, and concurrent teardown can occur from normal administrative or automation activity rather than attacker-held privileges.\nUI:N - No victim interaction is required beyond the host already running a VXLAN interface; the attacker triggers the fault purely by sending network packets timed against interface teardown.\nS:U - Impact is a kernel fault in networking softirq context on the same host; it does not cross VM, container, or IOMMU security boundaries into another authority.\nC:H - The race can leave a stale vxlan_sock pointer after udp_tunnel_sock_release() frees sk_user_data; dereferencing vs-\u003eflags is a use-after-free read that can expose kernel heap contents and is treated as arbitrary read potential under conservative scoring.\nI:H - Use-after-free on the vxlan_sock object during GRO teardown can corrupt heap metadata or adjacent objects and be leveraged for control-flow hijacking, not merely a benign NULL check failure.\nA:H - A successful trigger causes a kernel NULL pointer dereference/oops in NAPI/softirq context (documented crash at vxlan_gro_prepare_receive), typically crashing or hanging the host and denying all services."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:46:49.365Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9c58c729d32e7cea5772cc44929c6cd61e5a31cd"
},
{
"url": "https://git.kernel.org/stable/c/f79c80f173fda9545b220c1f094b65fc06c252d0"
},
{
"url": "https://git.kernel.org/stable/c/08f40c0d23c67c3aa4224c3311e134999c721fb4"
},
{
"url": "https://git.kernel.org/stable/c/4a8cde6f7281ea2c4c290f9ad9923b3631defceb"
},
{
"url": "https://git.kernel.org/stable/c/ef44dac2a37f86eeae6b88ed10a6d60b35387dfd"
},
{
"url": "https://git.kernel.org/stable/c/30a45c0bffdd62350261e2f2689fdba426a33578"
}
],
"title": "vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74406",
"datePublished": "2026-08-15T05:59:15.385Z",
"dateReserved": "2026-08-15T05:44:03.892Z",
"dateUpdated": "2026-10-16T19:05:43.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68397 (GCVE-0-2026-68397)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/iucv: take a reference on the socket found in afiucv_hs_rcv()
afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock,
drops the lock, and then passes the socket to the afiucv_hs_callback_*()
handlers without holding a reference. AF_IUCV sockets are not
RCU-protected and are freed synchronously by iucv_sock_kill() ->
sock_put(), so a concurrent close can free the socket in the window
between read_unlock() and the handler, which then dereferences freed
memory (for example sk->sk_data_ready() in afiucv_hs_callback_syn()).
Take a reference with sock_hold() while the socket is still on the list
and release it with sock_put() once the handler has run.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68397",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:06.325018Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:08.287Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/iucv/af_iucv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5739be5c19495d709d902a2912c9102ce78740d5",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "bc6c6e546ffff8865daaeb622ef348c2d481e80f",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "e3e0679fc950191aff8f27fa78abcfc2462cff4a",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "4dc0e63abf8bc7ba8892e617c1fb8b204361e022",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "1801cb20a5025a787d6853e19c38db138344b4b4",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "c75a950e77356e526672cba4584080c6c8b793b6",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "5595ea59cdf29182cf6a270cacc1426c57b603de",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "4fa349156043dc119721d067329714179f501749",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/iucv/af_iucv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: take a reference on the socket found in afiucv_hs_rcv()\n\nafiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock,\ndrops the lock, and then passes the socket to the afiucv_hs_callback_*()\nhandlers without holding a reference. AF_IUCV sockets are not\nRCU-protected and are freed synchronously by iucv_sock_kill() -\u003e\nsock_put(), so a concurrent close can free the socket in the window\nbetween read_unlock() and the handler, which then dereferences freed\nmemory (for example sk-\u003esk_data_ready() in afiucv_hs_callback_syn()).\n\nTake a reference with sock_hold() while the socket is still on the list\nand release it with sock_put() once the handler has run."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable handler is registered via dev_add_pack() for ethertype ETH_P_AF_IUCV (0xFBFB) on every netdevice, so any peer LPAR/guest on the same HiperSockets internal LAN or any host on an attached Ethernet segment can drive afiucv_hs_rcv() with crafted frames; the frames are raw L2 and cannot be routed across an IP hop, so the vector is adjacent rather than network.\nAC:L - The attacker controls the packet side of the race outright (flooding 0xFBFB frames) and can drive the freeing side too, since SYN frames make a listener spawn and enqueue child sockets while FIN/SYN|FIN frames push sockets to IUCV_DISCONN and wake the application into close(), so the read_unlock()-to-handler window can be retried indefinitely until won.\nPR:N - afiucv_hs_rcv() runs from the netif RX softirq and processes any matching frame with no authentication, credential check, or capability test anywhere on the path; the attacker needs no account or privilege on the target s390 system.\nUI:N - No victim action is required: the attacker\u0027s own frames both create the AF_IUCV child sockets and trigger the state changes that lead to their teardown, and the packet handler runs unconditionally in softirq context.\nS:U - The freed struct sock and the resulting corruption stay inside the kernel of the affected LPAR or z/VM guest; no hypervisor, IOMMU, or container boundary is crossed.\nC:H - This is a use-after-free on a socket allocated from a generic kmalloc cache (iucv_proto is registered without its own slab), so an attacker who reclaims the object has the kernel read attacker-influenced or stale heap contents through sk fields, sk_filter()\u0027s BPF program pointer, and the iucv backlog queues, yielding kernel memory disclosure.\nI:H - After the free the handlers perform indirect calls through the freed object (sk-\u003esk_data_ready(), sk-\u003esk_state_change(), sk_filter()) and writes into it (sk_state, atomic_sub on iucv-\u003emsg_sent, skb_queue_tail() list-pointer updates), giving control-flow hijack and write primitives once the slab object is reclaimed with attacker-controlled data.\nA:H - Dereferencing the freed socket from softirq context reliably produces an oops or \"Fatal exception in interrupt\" panic, and the attacker can repeat the frame flood at will, causing complete loss of availability of the IBM Z LPAR or guest."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:34:47.433Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5739be5c19495d709d902a2912c9102ce78740d5"
},
{
"url": "https://git.kernel.org/stable/c/bc6c6e546ffff8865daaeb622ef348c2d481e80f"
},
{
"url": "https://git.kernel.org/stable/c/e3e0679fc950191aff8f27fa78abcfc2462cff4a"
},
{
"url": "https://git.kernel.org/stable/c/4dc0e63abf8bc7ba8892e617c1fb8b204361e022"
},
{
"url": "https://git.kernel.org/stable/c/1801cb20a5025a787d6853e19c38db138344b4b4"
},
{
"url": "https://git.kernel.org/stable/c/c75a950e77356e526672cba4584080c6c8b793b6"
},
{
"url": "https://git.kernel.org/stable/c/5595ea59cdf29182cf6a270cacc1426c57b603de"
},
{
"url": "https://git.kernel.org/stable/c/4fa349156043dc119721d067329714179f501749"
}
],
"title": "net/iucv: take a reference on the socket found in afiucv_hs_rcv()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68397",
"datePublished": "2026-08-10T12:04:16.772Z",
"dateReserved": "2026-07-30T09:28:09.389Z",
"dateUpdated": "2026-10-19T21:09:08.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53228 (GCVE-0-2026-53228)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-19 19:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sit: reload inner IPv6 header after GSO offloads
ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function
entry and continues using it after iptunnel_handle_offloads().
For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().
When the skb header is cloned, skb_header_unclone() can call
pskb_expand_head(), which may move the skb head. The pskb_expand_head()
contract requires pointers into the skb header to be reloaded after the
call.
If the later skb_realloc_headroom() branch is not taken, SIT uses the
stale iph6 pointer to read the inner hop limit and DS field. That can
read from a freed skb head after the old head's remaining clone is
released.
Reload iph6 after the offload helper succeeds and before subsequent
reads from the inner IPv6 header. Keep the existing reload after
skb_realloc_headroom(), since that branch can also replace the skb.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab Version: 14909664e4e192f4c6f6fcdccd9919af7cf783ab |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:22:51.790Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53228",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:27:17.714387Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:57:30.192Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/sit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fddd41445a0537b093e6b3f6232c9933cad1e48b",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "1132e5edc2866c3530be17622153a597095f0e43",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "9c67b44edb3598d234efae6e44649eb993c03da5",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "59f80c919713250fe5d25a4d9aea4e49580fa1d4",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "2fa49b2715e1bad12ce3b0fa64e234d9582c8193",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
},
{
"lessThan": "f0e42f0c4337b1f220de1ddd63f47197c7dee4de",
"status": "affected",
"version": "14909664e4e192f4c6f6fcdccd9919af7cf783ab",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/sit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sit: reload inner IPv6 header after GSO offloads\n\nipip6_tunnel_xmit() caches the inner IPv6 header pointer at function\nentry and continues using it after iptunnel_handle_offloads().\n\nFor GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone().\nWhen the skb header is cloned, skb_header_unclone() can call\npskb_expand_head(), which may move the skb head. The pskb_expand_head()\ncontract requires pointers into the skb header to be reloaded after the\ncall.\n\nIf the later skb_realloc_headroom() branch is not taken, SIT uses the\nstale iph6 pointer to read the inner hop limit and DS field. That can\nread from a freed skb head after the old head\u0027s remaining clone is\nreleased.\n\nReload iph6 after the offload helper succeeds and before subsequent\nreads from the inner IPv6 header. Keep the existing reload after\nskb_realloc_headroom(), since that branch can also replace the skb."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable SIT transmit path can be reached by network-triggered IPv6 traffic in a reasonable deployment where a public service or router sends large TCP/GSO packets through a configured SIT tunnel.\nAC:L - There is no race or fragile timing requirement; GSO and header-cloned TCP skbs are normal for large TCP transmissions, and the attacker can repeatedly trigger them with network traffic.\nPR:N - In the network-triggered scenario, the attacker does not need local privileges or authentication; the required SIT configuration is an environmental precondition on the victim.\nUI:N - No victim user action is required beyond the system processing network traffic through the configured SIT tunnel.\nS:U - The impact remains within the kernel and its networking security authority, with no VM, IOMMU, or separate security-scope boundary crossed.\nC:H - The stale inner IPv6 header pointer can read from freed skb head memory after `skb_header_unclone()`/`pskb_expand_head()`, making this a kernel use-after-free read. Per kernel CVSS guidance, use-after-free conditions are scored with high confidentiality impact.\nI:H - Although the immediate stale access feeds header fields, it is a kernel use-after-free in attacker-triggerable networking memory, and kernel UAFs are treated as potentially exploitable for heap manipulation and integrity compromise.\nA:H - Use-after-free in the kernel networking transmit path can lead to oops, panic, or repeated crash conditions, especially under memory debugging or unfavorable heap reuse."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:20.273Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fddd41445a0537b093e6b3f6232c9933cad1e48b"
},
{
"url": "https://git.kernel.org/stable/c/1132e5edc2866c3530be17622153a597095f0e43"
},
{
"url": "https://git.kernel.org/stable/c/9c67b44edb3598d234efae6e44649eb993c03da5"
},
{
"url": "https://git.kernel.org/stable/c/0bfa7bba1f41aaf5f0604dc712bb4701493e3aa0"
},
{
"url": "https://git.kernel.org/stable/c/59f80c919713250fe5d25a4d9aea4e49580fa1d4"
},
{
"url": "https://git.kernel.org/stable/c/2fa49b2715e1bad12ce3b0fa64e234d9582c8193"
},
{
"url": "https://git.kernel.org/stable/c/cb658c2f5f7977c2a1c77c9f239f4bc8196edb5c"
},
{
"url": "https://git.kernel.org/stable/c/f0e42f0c4337b1f220de1ddd63f47197c7dee4de"
}
],
"title": "ipv6: sit: reload inner IPv6 header after GSO offloads",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53228",
"datePublished": "2026-06-25T08:39:27.893Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-10-19T19:57:30.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72020 (GCVE-0-2026-72020)
Vulnerability from cvelistv5
Published
2026-08-15 05:51
Modified
2026-10-19 21:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in
ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn
object with kmem_cache_alloc(). The function then initializes many
fields explicitly, but only resets in_seq.delta and out_seq.delta in the
two struct ip_vs_seq members.
That leaves init_seq and previous_delta uninitialized. This is normally
harmless while the corresponding IP_VS_CONN_F_IN_SEQ or
IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync
message, however, ip_vs_proc_conn() preserves those flags from
IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits
IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with
SEQ flags set but with the rest of in_seq/out_seq still containing stale
slab data.
When a packet for such a connection is later handled by an IPVS
application helper, vs_fix_seq() and vs_fix_ack_seq() use
previous_delta and init_seq to rewrite TCP sequence numbers. A malformed
sync message can therefore make forwarded packets carry stale slab bytes
in their TCP seq/ack numbers, and can also corrupt the forwarded TCP
flow.
Reset both struct ip_vs_seq members completely before publishing the
connection. This matches the existing "reset struct ip_vs_seq" comment
and keeps the sequence-adjustment gates inactive unless valid sequence
data is installed later.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9a05475cebdd6341884b5901e53870be26e65158 Version: 9a05475cebdd6341884b5901e53870be26e65158 Version: 9a05475cebdd6341884b5901e53870be26e65158 Version: 9a05475cebdd6341884b5901e53870be26e65158 Version: 9a05475cebdd6341884b5901e53870be26e65158 Version: 9a05475cebdd6341884b5901e53870be26e65158 Version: 9a05475cebdd6341884b5901e53870be26e65158 Version: 9a05475cebdd6341884b5901e53870be26e65158 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72020",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:50:08.361059Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-457",
"description": "CWE-457 Use of Uninitialized Variable",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:23.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3bf9a260188b2a5449cbddc032a749ab433fe328",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "6378c5cb360eb1750f88839d7c3613ea92ac1816",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "32c299e28b8eea6cbbd23b97dc61401e9ef9c445",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "9e36602cbec552286f7e691cfd366525c565ee74",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "d0eed7177e822cab83141e5c44b2aa345c7fd379",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "83fb4c2c5344f02eac929f66de3c9d1adfcde04c",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "6335ab62d5fc9ed875279238233fba3462c168f5",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
},
{
"lessThan": "2975324d164c552b028632f107b567302863b7f6",
"status": "affected",
"version": "9a05475cebdd6341884b5901e53870be26e65158",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: reset full ip_vs_seq structs in ip_vs_conn_new\n\nCommit 9a05475cebdd (\"ipvs: avoid kmem_cache_zalloc in\nip_vs_conn_new\") changed ip_vs_conn_new() to allocate an ip_vs_conn\nobject with kmem_cache_alloc(). The function then initializes many\nfields explicitly, but only resets in_seq.delta and out_seq.delta in the\ntwo struct ip_vs_seq members.\n\nThat leaves init_seq and previous_delta uninitialized. This is normally\nharmless while the corresponding IP_VS_CONN_F_IN_SEQ or\nIP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync\nmessage, however, ip_vs_proc_conn() preserves those flags from\nIP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits\nIPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with\nSEQ flags set but with the rest of in_seq/out_seq still containing stale\nslab data.\n\nWhen a packet for such a connection is later handled by an IPVS\napplication helper, vs_fix_seq() and vs_fix_ack_seq() use\nprevious_delta and init_seq to rewrite TCP sequence numbers. A malformed\nsync message can therefore make forwarded packets carry stale slab bytes\nin their TCP seq/ack numbers, and can also corrupt the forwarded TCP\nflow.\n\nReset both struct ip_vs_seq members completely before publishing the\nconnection. This matches the existing \"reset struct ip_vs_seq\" comment\nand keeps the sequence-adjustment gates inactive unless valid sequence\ndata is installed later."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when a host running the IPVS backup sync receiver processes forged UDP sync datagrams (default multicast 224.0.0.81:8848) in ip_vs_process_message(), which is a network packet receive path rather than a local-only ioctl/netlink interface.\nAC:L - Once IPVS backup sync is enabled, an attacker can reliably send IPVS v1 messages that set IP_VS_CONN_F_IN_SEQ/OUT_SEQ while omitting IPVS_OPT_SEQ_DATA; no race, heap grooming, or victim-specific state beyond matching syncid (often 0) is required.\nPR:N - The backup sync socket accepts unauthenticated UDP input with no capability checks; only an optional syncid filter (frequently left at 0) may drop messages, so the attacker needs no Linux privileges to inject the malformed sync records.\nUI:N - No end-user or administrator interaction is required at exploit time; the attacker directly delivers crafted sync messages to the listening backup daemon without victims opening files, clicking links, or changing settings.\nS:U - Exploitation stays within the IPVS load balancer kernel/network authority and affects connections it forwards; it does not constitute a VM escape, sandbox breakout, or cross-security-authority boundary such as guest-to-host.\nC:H - Uninitialized ip_vs_seq init_seq and previous_delta fields retain stale slab data that vs_fix_seq()/vs_fix_ack_seq() apply when rewriting forwarded TCP seq/ack numbers, leaking kernel heap bytes onto the network to clients or backend servers.\nI:H - Those same uninitialized sequence-adjustment fields cause incorrect TCP sequence/ack rewriting in NAT/application-helper paths (ip_vs_app_pkt_in/out), corrupting load-balanced TCP flows and enabling attacker-driven manipulation of forwarded traffic integrity.\nA:H - Corrupted TCP sequence handling breaks or resets connections on the virtual service and can be triggered repeatedly via additional forged sync messages, causing sustained denial of service to load-balanced traffic on the affected backup node."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:39:30.496Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3bf9a260188b2a5449cbddc032a749ab433fe328"
},
{
"url": "https://git.kernel.org/stable/c/6378c5cb360eb1750f88839d7c3613ea92ac1816"
},
{
"url": "https://git.kernel.org/stable/c/32c299e28b8eea6cbbd23b97dc61401e9ef9c445"
},
{
"url": "https://git.kernel.org/stable/c/9e36602cbec552286f7e691cfd366525c565ee74"
},
{
"url": "https://git.kernel.org/stable/c/d0eed7177e822cab83141e5c44b2aa345c7fd379"
},
{
"url": "https://git.kernel.org/stable/c/83fb4c2c5344f02eac929f66de3c9d1adfcde04c"
},
{
"url": "https://git.kernel.org/stable/c/6335ab62d5fc9ed875279238233fba3462c168f5"
},
{
"url": "https://git.kernel.org/stable/c/2975324d164c552b028632f107b567302863b7f6"
}
],
"title": "ipvs: reset full ip_vs_seq structs in ip_vs_conn_new",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72020",
"datePublished": "2026-08-15T05:51:46.675Z",
"dateReserved": "2026-08-09T03:40:39.900Z",
"dateUpdated": "2026-10-19T21:19:23.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74341 (GCVE-0-2026-74341)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-08-17 05:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: wcn36xx: fix heap overflow from oversized firmware HAL response
The firmware response dispatcher copies all synchronous HAL responses
into the 4096-byte hal_buf without validating the response length. A
response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow
with firmware-controlled content.
Add a bounds check on the response length.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8e84c25821698bdef73c0329fb2022a4673b7adc Version: 8e84c25821698bdef73c0329fb2022a4673b7adc Version: 8e84c25821698bdef73c0329fb2022a4673b7adc Version: 8e84c25821698bdef73c0329fb2022a4673b7adc Version: 8e84c25821698bdef73c0329fb2022a4673b7adc Version: 8e84c25821698bdef73c0329fb2022a4673b7adc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/wcn36xx/smd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dae9cadf0925f1cbfb71306d60490890df3870a6",
"status": "affected",
"version": "8e84c25821698bdef73c0329fb2022a4673b7adc",
"versionType": "git"
},
{
"lessThan": "cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92",
"status": "affected",
"version": "8e84c25821698bdef73c0329fb2022a4673b7adc",
"versionType": "git"
},
{
"lessThan": "15545ee71301e82d26d9a31b407ed0019eb62a60",
"status": "affected",
"version": "8e84c25821698bdef73c0329fb2022a4673b7adc",
"versionType": "git"
},
{
"lessThan": "1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18",
"status": "affected",
"version": "8e84c25821698bdef73c0329fb2022a4673b7adc",
"versionType": "git"
},
{
"lessThan": "18813b90032bfaafb225906a4d2b51be4dfc02c3",
"status": "affected",
"version": "8e84c25821698bdef73c0329fb2022a4673b7adc",
"versionType": "git"
},
{
"lessThan": "88a240d86d3d64521f9194abe185ac71cc74d0bd",
"status": "affected",
"version": "8e84c25821698bdef73c0329fb2022a4673b7adc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/wcn36xx/smd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wcn36xx: fix heap overflow from oversized firmware HAL response\n\nThe firmware response dispatcher copies all synchronous HAL responses\ninto the 4096-byte hal_buf without validating the response length. A\nresponse exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow\nwith firmware-controlled content.\n\nAdd a bounds check on the response length."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is in wcn36xx_smd_rsp_process when copying synchronous HAL replies from WCN3660/3680 firmware over WLAN_CTRL rpmsg; crafted 802.11 traffic can cause the firmware to return oversized responses during normal scan/association on nearby Qualcomm Android devices.\nAC:L - The driver copies the full rpmsg length into a 4096-byte hal_buf with no validation; an adjacent attacker can repeatedly send malicious WiFi frames during background scanning to reliably elicit an oversized synchronous HAL response while the host awaits completion.\nPR:N - No local account or kernel privileges are required on the victim; exploitation only needs radio proximity to a device running the wcn36xx driver with WiFi active, a typical scenario for phones and tablets in public spaces.\nUI:N - No specific victim interaction is required beyond routine WiFi operation; devices continuously scan and associate automatically, allowing an adjacent attacker to deliver malicious frames passively or via a rogue access point.\nS:U - Heap corruption occurs in the wcn36xx kernel driver during firmware response handling, enabling standard kernel privilege escalation rather than crossing a VM, IOMMU, or other separate security authority boundary.\nC:H - The unchecked memcpy writes firmware-controlled bytes past the 4096-byte hal_buf kmalloc allocation, corrupting adjacent heap objects and providing primitives for arbitrary kernel memory disclosure during exploitation.\nI:H - This is a heap buffer overflow with attacker-controlled overflow content that can overwrite adjacent kernel heap metadata and objects, enabling control-flow hijacking and arbitrary kernel code execution.\nA:H - Synchronous heap corruption in the rpmsg receive path can immediately cause kernel oops or panic during the memcpy or subsequent allocator use, resulting in complete loss of system and wireless availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:46:07.295Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dae9cadf0925f1cbfb71306d60490890df3870a6"
},
{
"url": "https://git.kernel.org/stable/c/cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92"
},
{
"url": "https://git.kernel.org/stable/c/15545ee71301e82d26d9a31b407ed0019eb62a60"
},
{
"url": "https://git.kernel.org/stable/c/1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18"
},
{
"url": "https://git.kernel.org/stable/c/18813b90032bfaafb225906a4d2b51be4dfc02c3"
},
{
"url": "https://git.kernel.org/stable/c/88a240d86d3d64521f9194abe185ac71cc74d0bd"
}
],
"title": "wifi: wcn36xx: fix heap overflow from oversized firmware HAL response",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74341",
"datePublished": "2026-08-15T05:58:31.238Z",
"dateReserved": "2026-08-15T05:44:03.886Z",
"dateUpdated": "2026-08-17T05:46:07.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80737 (GCVE-0-2026-80737)
Vulnerability from cvelistv5
Published
2026-09-03 08:21
Modified
2026-10-16 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
serial: amba-pl011: synchronize DMA teardown
dmaengine_terminate_all() does not wait for a running callback, so the TX
callback can still touch the TX buffer after it is freed. The RX poll
timer reads the RX buffers without the port lock.
Switch to dmaengine_terminate_sync() and delete the RX timer before
freeing the buffers.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ead76f329f777c7301e0a5456a0a1c7a081570bd Version: ead76f329f777c7301e0a5456a0a1c7a081570bd Version: ead76f329f777c7301e0a5456a0a1c7a081570bd Version: ead76f329f777c7301e0a5456a0a1c7a081570bd Version: ead76f329f777c7301e0a5456a0a1c7a081570bd Version: ead76f329f777c7301e0a5456a0a1c7a081570bd Version: ead76f329f777c7301e0a5456a0a1c7a081570bd Version: ead76f329f777c7301e0a5456a0a1c7a081570bd |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80737",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:21:17.321670Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:36.178Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/amba-pl011.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a38fae9d212e2d3ed5e9ec0ef773f8c0a27fb76e",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "44bd0ecc3444882d08ecfbc2b2418d2f463d3186",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "f70c9d4fba46463a5b1c7b3ee9ee3b40c90dac03",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "c8c8e895f65fbf71ea6224e27cf8dab91b776e0d",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "9f6989e477f03a4721d34bb4b09b17accd40283e",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "5974cb66681eac367107b05924744d7e3b49d41c",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "fdfb46c387241b4eddd36d746793764413285913",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
},
{
"lessThan": "440915499231e9db1c361aa45bb702e8fd3b4a32",
"status": "affected",
"version": "ead76f329f777c7301e0a5456a0a1c7a081570bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/amba-pl011.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.39"
},
{
"lessThan": "2.6.39",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.39",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: amba-pl011: synchronize DMA teardown\n\ndmaengine_terminate_all() does not wait for a running callback, so the TX\ncallback can still touch the TX buffer after it is freed. The RX poll\ntimer reads the RX buffers without the port lock.\n\nSwitch to dmaengine_terminate_sync() and delete the RX timer before\nfreeing the buffers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Local tty device access via open/write/close on /dev/ttyAMA* or similar; PL011 DMA teardown runs in pl011_shutdown from uart_close/hangup/suspend, not via network protocols.\nAC:L - Attacker with tty fd controls DMA load (large writes for TX DMA, active RX) and teardown timing via close/hangup; they can repeatedly race shutdown against in-flight DMA callbacks/timers without uncontrollable conditions.\nPR:L - Requires open/write/close on the UART tty node, typically granted via dialout group on embedded ARM systems with PL011 DMA; not via user namespaces alone, but no root required on auxiliary serial ports.\nUI:N - Attacker performs all steps themselves (open port, queue DMA traffic, close); no separate victim action needed.\nS:U - Kernel heap/coherent-buffer UAF during UART driver teardown affects only local kernel resources; no VM escape, IOMMU bypass, or cross-security-authority boundary.\nC:H - TX DMA callback or RX poll timer can access freed TX kmalloc buffer or RX dma coherent pages, yielding UAF read primitives over kernel memory and potential information disclosure.\nI:H - Post-free access via pl011_dma_tx_refill/dma_map or pl011_dma_rx_poll writing into tty flip buffers enables heap corruption and potential kernel code execution or privilege escalation.\nA:H - UAF during DMA teardown can provoke kernel oops/panic from concurrent access to freed buffers, and repeated triggering can deny UART service or crash the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T04:58:22.813Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a38fae9d212e2d3ed5e9ec0ef773f8c0a27fb76e"
},
{
"url": "https://git.kernel.org/stable/c/44bd0ecc3444882d08ecfbc2b2418d2f463d3186"
},
{
"url": "https://git.kernel.org/stable/c/f70c9d4fba46463a5b1c7b3ee9ee3b40c90dac03"
},
{
"url": "https://git.kernel.org/stable/c/c8c8e895f65fbf71ea6224e27cf8dab91b776e0d"
},
{
"url": "https://git.kernel.org/stable/c/9f6989e477f03a4721d34bb4b09b17accd40283e"
},
{
"url": "https://git.kernel.org/stable/c/5974cb66681eac367107b05924744d7e3b49d41c"
},
{
"url": "https://git.kernel.org/stable/c/fdfb46c387241b4eddd36d746793764413285913"
},
{
"url": "https://git.kernel.org/stable/c/440915499231e9db1c361aa45bb702e8fd3b4a32"
}
],
"title": "serial: amba-pl011: synchronize DMA teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80737",
"datePublished": "2026-09-03T08:21:52.539Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-10-16T19:26:36.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64553 (GCVE-0-2026-64553)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: psample: fix info leak in PSAMPLE_ATTR_DATA
psample open codes nla_put() presumably to avoid wiping
the data with 0s just to override it with packet data.
This open coding is missing clearing the pad, however,
each netlink attr is padded to 4B and data_len may
not be divisible by 4B.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/psample/psample.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0d3ea2ccddda442077fc44f11d873209c97ec50b",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "7fe7e6949964aa8ee6305f09db2dc9eede977bb3",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "e2fa322782a2d7d8078f7bb20817e0aa9f7c32e9",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "befe1ebe7fc2c65c80074bc34ceeb0a721ed3cd2",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "48930f6c59fd0056c2de46ce52bfe27d9c9e5eb6",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "a6cfb924ad74efce254e99c197d2e3863de70868",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "794a0d8bdbb39e083ed42caccb86d687a9b53570",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "aedd02af1f8b0bceb7f42f5a21c41634ca9ed390",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/psample/psample.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: psample: fix info leak in PSAMPLE_ATTR_DATA\n\npsample open codes nla_put() presumably to avoid wiping\nthe data with 0s just to override it with packet data.\nThis open coding is missing clearing the pad, however,\neach netlink attr is padded to 4B and data_len may\nnot be divisible by 4B."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:30.953Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d3ea2ccddda442077fc44f11d873209c97ec50b"
},
{
"url": "https://git.kernel.org/stable/c/7fe7e6949964aa8ee6305f09db2dc9eede977bb3"
},
{
"url": "https://git.kernel.org/stable/c/e2fa322782a2d7d8078f7bb20817e0aa9f7c32e9"
},
{
"url": "https://git.kernel.org/stable/c/befe1ebe7fc2c65c80074bc34ceeb0a721ed3cd2"
},
{
"url": "https://git.kernel.org/stable/c/48930f6c59fd0056c2de46ce52bfe27d9c9e5eb6"
},
{
"url": "https://git.kernel.org/stable/c/a6cfb924ad74efce254e99c197d2e3863de70868"
},
{
"url": "https://git.kernel.org/stable/c/794a0d8bdbb39e083ed42caccb86d687a9b53570"
},
{
"url": "https://git.kernel.org/stable/c/aedd02af1f8b0bceb7f42f5a21c41634ca9ed390"
}
],
"title": "net: psample: fix info leak in PSAMPLE_ATTR_DATA",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64553",
"datePublished": "2026-07-27T20:10:41.159Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-17T04:57:30.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53109 (GCVE-0-2023-53109)
Vulnerability from cvelistv5
Published
2025-05-02 15:55
Modified
2026-05-11 19:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: tunnels: annotate lockless accesses to dev->needed_headroom
IP tunnels can apparently update dev->needed_headroom
in their xmit path.
This patch takes care of three tunnels xmit, and also the
core LL_RESERVED_SPACE() and LL_RESERVED_SPACE_EXTRA()
helpers.
More changes might be needed for completeness.
BUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit
read to 0xffff88815b9da0ec of 2 bytes by task 888 on cpu 1:
ip_tunnel_xmit+0x1270/0x1730 net/ipv4/ip_tunnel.c:803
__gre_xmit net/ipv4/ip_gre.c:469 [inline]
ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661
__netdev_start_xmit include/linux/netdevice.h:4881 [inline]
netdev_start_xmit include/linux/netdevice.h:4895 [inline]
xmit_one net/core/dev.c:3580 [inline]
dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596
__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623
neigh_output include/net/neighbour.h:546 [inline]
ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:444 [inline]
ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126
iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82
ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813
__gre_xmit net/ipv4/ip_gre.c:469 [inline]
ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661
__netdev_start_xmit include/linux/netdevice.h:4881 [inline]
netdev_start_xmit include/linux/netdevice.h:4895 [inline]
xmit_one net/core/dev.c:3580 [inline]
dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596
__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623
neigh_output include/net/neighbour.h:546 [inline]
ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:444 [inline]
ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126
iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82
ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813
__gre_xmit net/ipv4/ip_gre.c:469 [inline]
ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661
__netdev_start_xmit include/linux/netdevice.h:4881 [inline]
netdev_start_xmit include/linux/netdevice.h:4895 [inline]
xmit_one net/core/dev.c:3580 [inline]
dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596
__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623
neigh_output include/net/neighbour.h:546 [inline]
ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:444 [inline]
ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126
iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82
ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813
__gre_xmit net/ipv4/ip_gre.c:469 [inline]
ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661
__netdev_start_xmit include/linux/netdevice.h:4881 [inline]
netdev_start_xmit include/linux/netdevice.h:4895 [inline]
xmit_one net/core/dev.c:3580 [inline]
dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596
__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623
neigh_output include/net/neighbour.h:546 [inline]
ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip_output+0xe5/0x1b0 net/i
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8eb30be0352d09165e94a41fef1c7b994dca0714 Version: 8eb30be0352d09165e94a41fef1c7b994dca0714 Version: 8eb30be0352d09165e94a41fef1c7b994dca0714 Version: 8eb30be0352d09165e94a41fef1c7b994dca0714 Version: 8eb30be0352d09165e94a41fef1c7b994dca0714 Version: 8eb30be0352d09165e94a41fef1c7b994dca0714 Version: 8eb30be0352d09165e94a41fef1c7b994dca0714 Version: 8eb30be0352d09165e94a41fef1c7b994dca0714 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h",
"net/ipv4/ip_tunnel.c",
"net/ipv6/ip6_tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8e206f66d824b3b28a7f9ee1366dfc79a937bb46",
"status": "affected",
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"versionType": "git"
},
{
"lessThan": "51f3bd3765bc5ca4583af07a00833da00d2ace1d",
"status": "affected",
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"versionType": "git"
},
{
"lessThan": "5aaab217c8f5387b9c5fff9e940d80f135e04366",
"status": "affected",
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"versionType": "git"
},
{
"lessThan": "be59b87ee4aed81db7c10e44f603866a0ac3ca5d",
"status": "affected",
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"versionType": "git"
},
{
"lessThan": "e0a557fc1daf5c1086e47150a4571aebadbb62be",
"status": "affected",
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"versionType": "git"
},
{
"lessThan": "a69b72b57b7d269e833e520ba7500d556e8189b6",
"status": "affected",
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"versionType": "git"
},
{
"lessThan": "9b86a8702b042ee4e15d2d46375be873a6a8834f",
"status": "affected",
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"versionType": "git"
},
{
"lessThan": "4b397c06cb987935b1b097336532aa6b4210e091",
"status": "affected",
"version": "8eb30be0352d09165e94a41fef1c7b994dca0714",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h",
"net/ipv4/ip_tunnel.c",
"net/ipv6/ip6_tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.311",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.279",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.238",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.311",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.279",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.238",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.176",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.104",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.21",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.8",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tunnels: annotate lockless accesses to dev-\u003eneeded_headroom\n\nIP tunnels can apparently update dev-\u003eneeded_headroom\nin their xmit path.\n\nThis patch takes care of three tunnels xmit, and also the\ncore LL_RESERVED_SPACE() and LL_RESERVED_SPACE_EXTRA()\nhelpers.\n\nMore changes might be needed for completeness.\n\nBUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit\n\nread to 0xffff88815b9da0ec of 2 bytes by task 888 on cpu 1:\nip_tunnel_xmit+0x1270/0x1730 net/ipv4/ip_tunnel.c:803\n__gre_xmit net/ipv4/ip_gre.c:469 [inline]\nipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661\n__netdev_start_xmit include/linux/netdevice.h:4881 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4895 [inline]\nxmit_one net/core/dev.c:3580 [inline]\ndev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596\n__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246\ndev_queue_xmit include/linux/netdevice.h:3051 [inline]\nneigh_direct_output+0x17/0x20 net/core/neighbour.c:1623\nneigh_output include/net/neighbour.h:546 [inline]\nip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228\nip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316\nNF_HOOK_COND include/linux/netfilter.h:291 [inline]\nip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430\ndst_output include/net/dst.h:444 [inline]\nip_local_out+0x64/0x80 net/ipv4/ip_output.c:126\niptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82\nip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813\n__gre_xmit net/ipv4/ip_gre.c:469 [inline]\nipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661\n__netdev_start_xmit include/linux/netdevice.h:4881 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4895 [inline]\nxmit_one net/core/dev.c:3580 [inline]\ndev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596\n__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246\ndev_queue_xmit include/linux/netdevice.h:3051 [inline]\nneigh_direct_output+0x17/0x20 net/core/neighbour.c:1623\nneigh_output include/net/neighbour.h:546 [inline]\nip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228\nip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316\nNF_HOOK_COND include/linux/netfilter.h:291 [inline]\nip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430\ndst_output include/net/dst.h:444 [inline]\nip_local_out+0x64/0x80 net/ipv4/ip_output.c:126\niptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82\nip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813\n__gre_xmit net/ipv4/ip_gre.c:469 [inline]\nipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661\n__netdev_start_xmit include/linux/netdevice.h:4881 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4895 [inline]\nxmit_one net/core/dev.c:3580 [inline]\ndev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596\n__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246\ndev_queue_xmit include/linux/netdevice.h:3051 [inline]\nneigh_direct_output+0x17/0x20 net/core/neighbour.c:1623\nneigh_output include/net/neighbour.h:546 [inline]\nip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228\nip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316\nNF_HOOK_COND include/linux/netfilter.h:291 [inline]\nip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430\ndst_output include/net/dst.h:444 [inline]\nip_local_out+0x64/0x80 net/ipv4/ip_output.c:126\niptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82\nip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813\n__gre_xmit net/ipv4/ip_gre.c:469 [inline]\nipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661\n__netdev_start_xmit include/linux/netdevice.h:4881 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4895 [inline]\nxmit_one net/core/dev.c:3580 [inline]\ndev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596\n__dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246\ndev_queue_xmit include/linux/netdevice.h:3051 [inline]\nneigh_direct_output+0x17/0x20 net/core/neighbour.c:1623\nneigh_output include/net/neighbour.h:546 [inline]\nip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228\nip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316\nNF_HOOK_COND include/linux/netfilter.h:291 [inline]\nip_output+0xe5/0x1b0 net/i\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T19:38:40.990Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8e206f66d824b3b28a7f9ee1366dfc79a937bb46"
},
{
"url": "https://git.kernel.org/stable/c/51f3bd3765bc5ca4583af07a00833da00d2ace1d"
},
{
"url": "https://git.kernel.org/stable/c/5aaab217c8f5387b9c5fff9e940d80f135e04366"
},
{
"url": "https://git.kernel.org/stable/c/be59b87ee4aed81db7c10e44f603866a0ac3ca5d"
},
{
"url": "https://git.kernel.org/stable/c/e0a557fc1daf5c1086e47150a4571aebadbb62be"
},
{
"url": "https://git.kernel.org/stable/c/a69b72b57b7d269e833e520ba7500d556e8189b6"
},
{
"url": "https://git.kernel.org/stable/c/9b86a8702b042ee4e15d2d46375be873a6a8834f"
},
{
"url": "https://git.kernel.org/stable/c/4b397c06cb987935b1b097336532aa6b4210e091"
}
],
"title": "net: tunnels: annotate lockless accesses to dev-\u003eneeded_headroom",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53109",
"datePublished": "2025-05-02T15:55:49.654Z",
"dateReserved": "2025-05-02T15:51:43.554Z",
"dateUpdated": "2026-05-11T19:38:40.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64423 (GCVE-0-2026-64423)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: igmp: remove multicast group from hash table on device destruction
When a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through
the multicast list and calls ip_ma_put() on each membership, scheduling
them for RCU reclamation. However, they are not unlinked from the device's
multicast hash table (mc_hash).
Since the device remains published in dev->ip_ptr until after
ip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash
can still locate and access the multicast group after its refcount is
decremented. If the RCU callback runs and frees the group while a reader is
accessing it, a use-after-free occurs.
Fix this by unlinking the multicast group from mc_hash using
ip_mc_hash_remove() before scheduling it for reclamation.
BUG: KASAN: slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0
Read of size 4 at addr ffff888009bf1408 by task mausezahn/2276
Call Trace:
<IRQ>
dump_stack_lvl+0x67/0x90
print_report+0x175/0x7c0
kasan_report+0x147/0x180
ip_check_mc_rcu+0x149/0x3f0
udp_v4_early_demux+0x36d/0x12d0
ip_rcv_finish_core+0xb8b/0x1390
ip_rcv_finish+0x54/0x120
NF_HOOK+0x213/0x2b0
__netif_receive_skb+0x126/0x340
process_backlog+0x4f2/0xf00
__napi_poll+0x92/0x2c0
net_rx_action+0x583/0xc60
handle_softirqs+0x236/0x7f0
do_softirq+0x57/0x80
</IRQ>
Allocated by task 2239:
kasan_save_track+0x3e/0x80
__kasan_kmalloc+0x72/0x90
____ip_mc_inc_group+0x31a/0xa40
__ip_mc_join_group+0x334/0x3f0
do_ip_setsockopt+0x16fa/0x2010
ip_setsockopt+0x3f/0x90
do_sock_setsockopt+0x1ad/0x300
Freed by task 0:
kasan_save_track+0x3e/0x80
kasan_save_free_info+0x40/0x50
__kasan_slab_free+0x3a/0x60
__rcu_free_sheaf_prepare+0xd4/0x220
rcu_free_sheaf+0x36/0x190
rcu_core+0x8d9/0x12f0
handle_softirqs+0x236/0x7f0
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e9897071350bd9d94a56b5b6f79c85b1a98fc7e7 Version: e9897071350bd9d94a56b5b6f79c85b1a98fc7e7 Version: e9897071350bd9d94a56b5b6f79c85b1a98fc7e7 Version: e9897071350bd9d94a56b5b6f79c85b1a98fc7e7 Version: e9897071350bd9d94a56b5b6f79c85b1a98fc7e7 Version: e9897071350bd9d94a56b5b6f79c85b1a98fc7e7 Version: e9897071350bd9d94a56b5b6f79c85b1a98fc7e7 Version: e9897071350bd9d94a56b5b6f79c85b1a98fc7e7 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:23:48.509Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:40:31.437029Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:28.280Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/igmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "412ba7def06ffe974ba9a1d862b022362c54ffa5",
"status": "affected",
"version": "e9897071350bd9d94a56b5b6f79c85b1a98fc7e7",
"versionType": "git"
},
{
"lessThan": "c6cb5f8ebe1c1a78710c19f102db9fe48b9e6ba9",
"status": "affected",
"version": "e9897071350bd9d94a56b5b6f79c85b1a98fc7e7",
"versionType": "git"
},
{
"lessThan": "5f42729d74bd6c61306d864423290d92962de4e1",
"status": "affected",
"version": "e9897071350bd9d94a56b5b6f79c85b1a98fc7e7",
"versionType": "git"
},
{
"lessThan": "76d030ac95e17f91d69a595f17ebc5979700cf9a",
"status": "affected",
"version": "e9897071350bd9d94a56b5b6f79c85b1a98fc7e7",
"versionType": "git"
},
{
"lessThan": "8820b530cb2388503d7418228d03ba074bf7a03e",
"status": "affected",
"version": "e9897071350bd9d94a56b5b6f79c85b1a98fc7e7",
"versionType": "git"
},
{
"lessThan": "2ca18df1c2611f70eb3eb487e02ae85eb703b284",
"status": "affected",
"version": "e9897071350bd9d94a56b5b6f79c85b1a98fc7e7",
"versionType": "git"
},
{
"lessThan": "f91883031e5a62877a29ce139442973cbea769f1",
"status": "affected",
"version": "e9897071350bd9d94a56b5b6f79c85b1a98fc7e7",
"versionType": "git"
},
{
"lessThan": "7993211bde166471dffac074dc965489f86531f8",
"status": "affected",
"version": "e9897071350bd9d94a56b5b6f79c85b1a98fc7e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/igmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.11"
},
{
"lessThan": "3.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: igmp: remove multicast group from hash table on device destruction\n\nWhen a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through\nthe multicast list and calls ip_ma_put() on each membership, scheduling\nthem for RCU reclamation. However, they are not unlinked from the device\u0027s\nmulticast hash table (mc_hash).\n\nSince the device remains published in dev-\u003eip_ptr until after\nip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash\ncan still locate and access the multicast group after its refcount is\ndecremented. If the RCU callback runs and frees the group while a reader is\naccessing it, a use-after-free occurs.\n\nFix this by unlinking the multicast group from mc_hash using\nip_mc_hash_remove() before scheduling it for reclamation.\n\nBUG: KASAN: slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0\nRead of size 4 at addr ffff888009bf1408 by task mausezahn/2276\n\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x67/0x90\n print_report+0x175/0x7c0\n kasan_report+0x147/0x180\n ip_check_mc_rcu+0x149/0x3f0\n udp_v4_early_demux+0x36d/0x12d0\n ip_rcv_finish_core+0xb8b/0x1390\n ip_rcv_finish+0x54/0x120\n NF_HOOK+0x213/0x2b0\n __netif_receive_skb+0x126/0x340\n process_backlog+0x4f2/0xf00\n __napi_poll+0x92/0x2c0\n net_rx_action+0x583/0xc60\n handle_softirqs+0x236/0x7f0\n do_softirq+0x57/0x80\n \u003c/IRQ\u003e\n\nAllocated by task 2239:\n kasan_save_track+0x3e/0x80\n __kasan_kmalloc+0x72/0x90\n ____ip_mc_inc_group+0x31a/0xa40\n __ip_mc_join_group+0x334/0x3f0\n do_ip_setsockopt+0x16fa/0x2010\n ip_setsockopt+0x3f/0x90\n do_sock_setsockopt+0x1ad/0x300\n\nFreed by task 0:\n kasan_save_track+0x3e/0x80\n kasan_save_free_info+0x40/0x50\n __kasan_slab_free+0x3a/0x60\n __rcu_free_sheaf_prepare+0xd4/0x220\n rcu_free_sheaf+0x36/0x190\n rcu_core+0x8d9/0x12f0\n handle_softirqs+0x236/0x7f0"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An end-to-end attacker-controlled trigger requires local socket and netlink operations to create multicast memberships and concurrently destroy IPv4 device state; received multicast packets alone cannot initiate the necessary teardown. These operations are reachable inside an attacker-created user and network namespace.\nAC:L - The attacker can populate mc_hash, generate continuous multicast traffic, and repeatedly tear down IPv4 state, controlling both sides of the race. No victim-dependent timing or secret state is required.\nPR:L - Device teardown or invalid-MTU configuration requires CAP_NET_ADMIN in the target network namespace, while multicast joins and UDP sends are unprivileged. An ordinary user can obtain this namespace-scoped capability through unprivileged user and network namespaces.\nUI:N - Exploitation requires no action by another user once the attacker can execute locally and create the required namespace and traffic.\nS:U - The vulnerable code and resulting host-kernel compromise remain within the same security authority; this is conventional kernel privilege escalation rather than a guest-to-host escape.\nC:H - The stale kmalloc-256 ip_mc_list entry exposes reuse-controlled fields and pointers to kernel reads, making kernel-memory disclosure and broader read primitives plausible.\nI:H - Reallocation permits attacker-influenced object contents to drive spinlock writes and pointer traversal on freed memory, making heap corruption and control-flow hijacking defensible.\nA:H - The confirmed slab use-after-free can dereference corrupted hash pointers or operate on an invalid spinlock, causing a kernel oops, panic, general-protection fault, or hang."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:23.253Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/412ba7def06ffe974ba9a1d862b022362c54ffa5"
},
{
"url": "https://git.kernel.org/stable/c/c6cb5f8ebe1c1a78710c19f102db9fe48b9e6ba9"
},
{
"url": "https://git.kernel.org/stable/c/5f42729d74bd6c61306d864423290d92962de4e1"
},
{
"url": "https://git.kernel.org/stable/c/76d030ac95e17f91d69a595f17ebc5979700cf9a"
},
{
"url": "https://git.kernel.org/stable/c/8820b530cb2388503d7418228d03ba074bf7a03e"
},
{
"url": "https://git.kernel.org/stable/c/2ca18df1c2611f70eb3eb487e02ae85eb703b284"
},
{
"url": "https://git.kernel.org/stable/c/f91883031e5a62877a29ce139442973cbea769f1"
},
{
"url": "https://git.kernel.org/stable/c/7993211bde166471dffac074dc965489f86531f8"
}
],
"title": "ipv4: igmp: remove multicast group from hash table on device destruction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64423",
"datePublished": "2026-07-25T08:51:01.485Z",
"dateReserved": "2026-07-19T15:36:31.787Z",
"dateUpdated": "2026-10-19T20:38:28.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63892 (GCVE-0-2026-63892)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-07-19 14:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow
On the non-root path, __tb_property_parse_dir() takes dir_len from
entry->length (u16 widened to size_t). Two distinct OOB conditions
follow when entry->length < 4:
1. The non-root path begins with kmemdup(&block[dir_offset],
sizeof(*dir->uuid), ...) which always reads 4 dwords from
dir_offset. tb_property_entry_valid() only enforces
dir_offset + entry->length <= block_len, so a crafted entry
with dir_offset close to the end of the property block and
entry->length in 0..3 passes that gate but lets the UUID copy
run off the block (e.g. dir_offset = 497, dir_len = 3 in a
500-dword block reads block[497..501]).
2. After the kmemdup, content_len = dir_len - 4 underflows size_t
to ~SIZE_MAX, nentries becomes SIZE_MAX / 4, and the entry
walk runs OOB on each iteration until an entry fails
validation or the kernel oopses on an unmapped page.
Reject dir_len < 4 on the non-root path *before* the UUID kmemdup,
which closes both holes.
Also move INIT_LIST_HEAD(&dir->properties) up to immediately after
the dir allocation so the new error-return path (and the existing
uuid-alloc failure path) calling tb_property_free_dir() sees a
walkable list rather than the zero-initialized NULL next/prev that
list_for_each_entry_safe() would oops on.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "37abc4504fa19d8f9f1e87792e8a2b8fdb308e40",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "e2d4d51cf5785815fa4e91e0c019e3eb2506a84c",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "de618299190b418291609e6921557253bd417e25",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "5506c825f14d810f0690b1f4367cb7249ebb387a",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "542a13890b742099c461d70920e97b14e568f6ec",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "d548179adcc87e1bc66b17e00352a1f536e76065",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "3bec49ca55e08fb085cc4318f24b1b37eaab28cb",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "de21b59c29e31c5108ddc04210631bbfab81b997",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow\n\nOn the non-root path, __tb_property_parse_dir() takes dir_len from\nentry-\u003elength (u16 widened to size_t). Two distinct OOB conditions\nfollow when entry-\u003elength \u003c 4:\n\n1. The non-root path begins with kmemdup(\u0026block[dir_offset],\n sizeof(*dir-\u003euuid), ...) which always reads 4 dwords from\n dir_offset. tb_property_entry_valid() only enforces\n dir_offset + entry-\u003elength \u003c= block_len, so a crafted entry\n with dir_offset close to the end of the property block and\n entry-\u003elength in 0..3 passes that gate but lets the UUID copy\n run off the block (e.g. dir_offset = 497, dir_len = 3 in a\n 500-dword block reads block[497..501]).\n\n2. After the kmemdup, content_len = dir_len - 4 underflows size_t\n to ~SIZE_MAX, nentries becomes SIZE_MAX / 4, and the entry\n walk runs OOB on each iteration until an entry fails\n validation or the kernel oopses on an unmapped page.\n\nReject dir_len \u003c 4 on the non-root path *before* the UUID kmemdup,\nwhich closes both holes.\n\nAlso move INIT_LIST_HEAD(\u0026dir-\u003eproperties) up to immediately after\nthe dir allocation so the new error-return path (and the existing\nuuid-alloc failure path) calling tb_property_free_dir() sees a\nwalkable list rather than the zero-initialized NULL next/prev that\nlist_for_each_entry_safe() would oops on."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T14:55:03.568Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/37abc4504fa19d8f9f1e87792e8a2b8fdb308e40"
},
{
"url": "https://git.kernel.org/stable/c/e2d4d51cf5785815fa4e91e0c019e3eb2506a84c"
},
{
"url": "https://git.kernel.org/stable/c/de618299190b418291609e6921557253bd417e25"
},
{
"url": "https://git.kernel.org/stable/c/5506c825f14d810f0690b1f4367cb7249ebb387a"
},
{
"url": "https://git.kernel.org/stable/c/542a13890b742099c461d70920e97b14e568f6ec"
},
{
"url": "https://git.kernel.org/stable/c/d548179adcc87e1bc66b17e00352a1f536e76065"
},
{
"url": "https://git.kernel.org/stable/c/3bec49ca55e08fb085cc4318f24b1b37eaab28cb"
},
{
"url": "https://git.kernel.org/stable/c/de21b59c29e31c5108ddc04210631bbfab81b997"
}
],
"title": "thunderbolt: property: Reject dir_len \u003c 4 to prevent size_t underflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63892",
"datePublished": "2026-07-19T14:55:03.568Z",
"dateReserved": "2026-07-19T07:54:57.019Z",
"dateUpdated": "2026-07-19T14:55:03.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63990 (GCVE-0-2026-63990)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-07-19 14:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bonding: refuse to enslave CAN devices
syzbot reported a kernel paging request crash in
can_rx_unregister() inside net/can/af_can.c. The crash occurs
because a virtual CAN device (vxcan) is being enslaved to a
bonding master.
During the enslavement process, the bonding driver mutates
and modifies the network device states to fit an Ethernet-like
aggregation model. However, CAN devices operate on a completely
different Layer 2 architecture, relying on the CAN mid-layer
private data structure (can_ml_priv) instead of standard
Ethernet structures. Since bonding does not initialize or
maintain these CAN structures, subsequent operations on the
half-enslaved interface (such as closing associated sockets
via isotp_release) lead to a null-pointer dereference when
accessing the CAN receiver lists.
Bonding CAN interfaces is architecturally invalid as CAN lacks
MAC addresses, ARP capabilities, and standard Ethernet
link-layer mechanisms. While generic loopback devices are
blocked globally in net/core/dev.c, virtual CAN devices
bypass this check because they do not carry the IFF_LOOPBACK
flag, despite acting as local software-loopbacks.
Fix this by explicitly blocking network devices of type
ARPHRD_CAN from being enslaved at the very beginning of
bond_enslave(). This prevents illegal state mutations,
eliminates the resulting KASAN crashes, and avoids potential
memory leaks from incomplete socket cleanups.
As the CAN support has been added a long time after bonding
the Fixes-tag points to the introduction of ARPHRD_CAN that
would have needed a specific handling in bonding_main.c.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cd05acfe65ed2cf2db683fa9a6adb8d35635263b Version: cd05acfe65ed2cf2db683fa9a6adb8d35635263b Version: cd05acfe65ed2cf2db683fa9a6adb8d35635263b Version: cd05acfe65ed2cf2db683fa9a6adb8d35635263b Version: cd05acfe65ed2cf2db683fa9a6adb8d35635263b Version: cd05acfe65ed2cf2db683fa9a6adb8d35635263b Version: cd05acfe65ed2cf2db683fa9a6adb8d35635263b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "69b78b5f3033272e53a2dc2dad675962654a5b38",
"status": "affected",
"version": "cd05acfe65ed2cf2db683fa9a6adb8d35635263b",
"versionType": "git"
},
{
"lessThan": "41e8478c4cd896d3abbe33d41afc90c84ac66602",
"status": "affected",
"version": "cd05acfe65ed2cf2db683fa9a6adb8d35635263b",
"versionType": "git"
},
{
"lessThan": "f4d78a81f57df82e9d82a2c07471fed1a1235893",
"status": "affected",
"version": "cd05acfe65ed2cf2db683fa9a6adb8d35635263b",
"versionType": "git"
},
{
"lessThan": "02f1c87ded33b43d48b4a1d665da15f2157b30d8",
"status": "affected",
"version": "cd05acfe65ed2cf2db683fa9a6adb8d35635263b",
"versionType": "git"
},
{
"lessThan": "9ea8a648d9120f7652bcde1ce2c4ad66871af707",
"status": "affected",
"version": "cd05acfe65ed2cf2db683fa9a6adb8d35635263b",
"versionType": "git"
},
{
"lessThan": "563090e5d450c665f70d955a39f9587afc7842eb",
"status": "affected",
"version": "cd05acfe65ed2cf2db683fa9a6adb8d35635263b",
"versionType": "git"
},
{
"lessThan": "8ba68464e4787b6a7ec938826e16124df20fd23d",
"status": "affected",
"version": "cd05acfe65ed2cf2db683fa9a6adb8d35635263b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: refuse to enslave CAN devices\n\nsyzbot reported a kernel paging request crash in\ncan_rx_unregister() inside net/can/af_can.c. The crash occurs\nbecause a virtual CAN device (vxcan) is being enslaved to a\nbonding master.\n\nDuring the enslavement process, the bonding driver mutates\nand modifies the network device states to fit an Ethernet-like\naggregation model. However, CAN devices operate on a completely\ndifferent Layer 2 architecture, relying on the CAN mid-layer\nprivate data structure (can_ml_priv) instead of standard\nEthernet structures. Since bonding does not initialize or\nmaintain these CAN structures, subsequent operations on the\nhalf-enslaved interface (such as closing associated sockets\nvia isotp_release) lead to a null-pointer dereference when\naccessing the CAN receiver lists.\n\nBonding CAN interfaces is architecturally invalid as CAN lacks\nMAC addresses, ARP capabilities, and standard Ethernet\nlink-layer mechanisms. While generic loopback devices are\nblocked globally in net/core/dev.c, virtual CAN devices\nbypass this check because they do not carry the IFF_LOOPBACK\nflag, despite acting as local software-loopbacks.\n\nFix this by explicitly blocking network devices of type\nARPHRD_CAN from being enslaved at the very beginning of\nbond_enslave(). This prevents illegal state mutations,\neliminates the resulting KASAN crashes, and avoids potential\nmemory leaks from incomplete socket cleanups.\n\nAs the CAN support has been added a long time after bonding\nthe Fixes-tag points to the introduction of ARPHRD_CAN that\nwould have needed a specific handling in bonding_main.c."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T14:56:11.111Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/69b78b5f3033272e53a2dc2dad675962654a5b38"
},
{
"url": "https://git.kernel.org/stable/c/41e8478c4cd896d3abbe33d41afc90c84ac66602"
},
{
"url": "https://git.kernel.org/stable/c/f4d78a81f57df82e9d82a2c07471fed1a1235893"
},
{
"url": "https://git.kernel.org/stable/c/02f1c87ded33b43d48b4a1d665da15f2157b30d8"
},
{
"url": "https://git.kernel.org/stable/c/9ea8a648d9120f7652bcde1ce2c4ad66871af707"
},
{
"url": "https://git.kernel.org/stable/c/563090e5d450c665f70d955a39f9587afc7842eb"
},
{
"url": "https://git.kernel.org/stable/c/8ba68464e4787b6a7ec938826e16124df20fd23d"
}
],
"title": "bonding: refuse to enslave CAN devices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63990",
"datePublished": "2026-07-19T14:56:11.111Z",
"dateReserved": "2026-07-19T07:54:57.025Z",
"dateUpdated": "2026-07-19T14:56:11.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74518 (GCVE-0-2026-74518)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: fix list corruption in allocate_file_region_entries()
allocate_file_region_entries() tops up resv->region_cache with freshly
allocated file_region descriptors. The allocation uses GFP_KERNEL, so
resv->lock is dropped around it: the new entries are gathered on a
stack-local list head, allocated_regions, and spliced into
resv->region_cache once the lock is re-acquired.
The splice used list_splice(), which moves the entries but does not
re-initialize the source head, so allocated_regions is left pointing at an
entry that now lives on resv->region_cache. The top-up runs in a while
loop that re-checks the cache deficit after re-acquiring the lock. For a
shared mapping the resv_map is shared by every mapper of the hugetlbfs
inode, so a concurrent region_chg()/region_add()/region_del() on the same
resv_map can consume cache entries during the unlocked window and force a
second iteration. That iteration calls list_add() on the stale head and
corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check
trips:
list_add corruption. next->prev should be prev (ffffc900011ff7f8),
but was ffff88814c281460. (next=ffff88814c545640).
kernel BUG at lib/list_debug.c:31!
allocate_file_region_entries+0x191/0x420
region_chg+0x267/0x300
hugetlb_reserve_pages+0x387/0xc80
hugetlbfs_file_mmap+0x2ce/0x3f0
mmap_region+0x1348/0x1a80
do_mmap+0x85e/0xb90
vm_mmap_pgoff+0x18c/0x330
ksys_mmap_pgoff+0x2a1/0x3e0
do_syscall_64+0xd7/0x420
Without CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack
address into resv->region_cache, leading to later use-after-free.
This was observed as a real host panic on a dense KVM host where a QEMU
guest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate
SPDK/DPDK vhost-user target, generating concurrent region_* traffic on one
shared resv_map.
Use list_splice_init() so the source head is re-initialized empty after
each splice, making the retry loop safe.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d3ec7b6e09e512ba902b86bcca2c512fb06d492f Version: d3ec7b6e09e512ba902b86bcca2c512fb06d492f Version: d3ec7b6e09e512ba902b86bcca2c512fb06d492f Version: d3ec7b6e09e512ba902b86bcca2c512fb06d492f Version: d3ec7b6e09e512ba902b86bcca2c512fb06d492f Version: d3ec7b6e09e512ba902b86bcca2c512fb06d492f Version: d3ec7b6e09e512ba902b86bcca2c512fb06d492f Version: d3ec7b6e09e512ba902b86bcca2c512fb06d492f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74518",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:58:55.418677Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:52.396Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "01b8569233e47693d6ff7efa96d9854c55f936fc",
"status": "affected",
"version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
"versionType": "git"
},
{
"lessThan": "9c5fdffc5e1ce84403c58289ee72697051803bf7",
"status": "affected",
"version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
"versionType": "git"
},
{
"lessThan": "f3e54f6a5e1681f83d13e8716bc92ef5ecf121d3",
"status": "affected",
"version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
"versionType": "git"
},
{
"lessThan": "62e1c2741a4d923d9854efd5927a6212aad7a187",
"status": "affected",
"version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
"versionType": "git"
},
{
"lessThan": "587a0accc2b4fccc5cf7baf0fe34e50efde51f9c",
"status": "affected",
"version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
"versionType": "git"
},
{
"lessThan": "126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df",
"status": "affected",
"version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
"versionType": "git"
},
{
"lessThan": "ac1bb7fd45088d0db57a22ce7729f258ebd63cf5",
"status": "affected",
"version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
"versionType": "git"
},
{
"lessThan": "dd9623f58ec702a07b2d67179d6fcea79c52231a",
"status": "affected",
"version": "d3ec7b6e09e512ba902b86bcca2c512fb06d492f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix list corruption in allocate_file_region_entries()\n\nallocate_file_region_entries() tops up resv-\u003eregion_cache with freshly\nallocated file_region descriptors. The allocation uses GFP_KERNEL, so\nresv-\u003elock is dropped around it: the new entries are gathered on a\nstack-local list head, allocated_regions, and spliced into\nresv-\u003eregion_cache once the lock is re-acquired.\n\nThe splice used list_splice(), which moves the entries but does not\nre-initialize the source head, so allocated_regions is left pointing at an\nentry that now lives on resv-\u003eregion_cache. The top-up runs in a while\nloop that re-checks the cache deficit after re-acquiring the lock. For a\nshared mapping the resv_map is shared by every mapper of the hugetlbfs\ninode, so a concurrent region_chg()/region_add()/region_del() on the same\nresv_map can consume cache entries during the unlocked window and force a\nsecond iteration. That iteration calls list_add() on the stale head and\ncorrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check\ntrips:\n\n list_add corruption. next-\u003eprev should be prev (ffffc900011ff7f8),\n but was ffff88814c281460. (next=ffff88814c545640).\n kernel BUG at lib/list_debug.c:31!\n allocate_file_region_entries+0x191/0x420\n region_chg+0x267/0x300\n hugetlb_reserve_pages+0x387/0xc80\n hugetlbfs_file_mmap+0x2ce/0x3f0\n mmap_region+0x1348/0x1a80\n do_mmap+0x85e/0xb90\n vm_mmap_pgoff+0x18c/0x330\n ksys_mmap_pgoff+0x2a1/0x3e0\n do_syscall_64+0xd7/0x420\n\nWithout CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack\naddress into resv-\u003eregion_cache, leading to later use-after-free.\n\nThis was observed as a real host panic on a dense KVM host where a QEMU\nguest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate\nSPDK/DPDK vhost-user target, generating concurrent region_* traffic on one\nshared resv_map.\n\nUse list_splice_init() so the source head is re-initialized empty after\neach splice, making the retry loop safe."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local hugetlb reservation paths (mmap/memfd_create/fault syscalls into region_chg/region_add/region_del); no network protocol or remote packet handler invokes allocate_file_region_entries().\nAC:L - Exploitation needs a race while resv-\u003elock is dropped during GFP_KERNEL allocation, but an attacker can spawn concurrent MAP_SHARED mappers/faulters on one hugetlb inode and controls both sides of that race.\nPR:L - Unprivileged local users can trigger this via memfd_create(MFD_HUGETLB) plus MAP_SHARED mmap/fault activity, or by mapping accessible shared hugetlbfs files, without init-namespace root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the needed concurrent syscalls and shared hugetlb mappings themselves to hit the corrupted list splice retry path.\nS:U - Impact is kernel hugetlb resv_map list/memory corruption on the host; it does not by itself cross a VM, IOMMU, or separate security-authority boundary even though KVM/DPDK hosts are a prime deployment.\nC:H - Without CONFIG_DEBUG_LIST, stale list_splice leaves a kernel-stack pointer in resv-\u003eregion_cache, producing later use-after-free that can be turned into arbitrary kernel memory read/disclosure primitives.\nI:H - Corrupted region_cache pointers let subsequent region_add/region_del/cache operations write through attacker-influenced list links, enabling heap metadata corruption and potential arbitrary kernel write or code execution.\nA:H - Real host panics were reported on dense KVM hugetlb workloads; DEBUG_LIST kernels BUG on list_add corruption, and default builds can crash from UAF while walking the poisoned region_cache."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:38:19.402Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/01b8569233e47693d6ff7efa96d9854c55f936fc"
},
{
"url": "https://git.kernel.org/stable/c/9c5fdffc5e1ce84403c58289ee72697051803bf7"
},
{
"url": "https://git.kernel.org/stable/c/f3e54f6a5e1681f83d13e8716bc92ef5ecf121d3"
},
{
"url": "https://git.kernel.org/stable/c/62e1c2741a4d923d9854efd5927a6212aad7a187"
},
{
"url": "https://git.kernel.org/stable/c/587a0accc2b4fccc5cf7baf0fe34e50efde51f9c"
},
{
"url": "https://git.kernel.org/stable/c/126a70bf1a08ddc9d79c471ebdaa2b08cfbab8df"
},
{
"url": "https://git.kernel.org/stable/c/ac1bb7fd45088d0db57a22ce7729f258ebd63cf5"
},
{
"url": "https://git.kernel.org/stable/c/dd9623f58ec702a07b2d67179d6fcea79c52231a"
}
],
"title": "mm/hugetlb: fix list corruption in allocate_file_region_entries()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74518",
"datePublished": "2026-08-15T12:27:37.480Z",
"dateReserved": "2026-08-15T05:44:03.910Z",
"dateUpdated": "2026-10-16T19:05:52.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53001 (GCVE-0-2026-53001)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-10-15 01:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xtables: restrict several matches to inet family
This is a partial revert of:
commit ab4f21e6fb1c ("netfilter: xtables: use NFPROTO_UNSPEC in more extensions")
to allow ipv4 and ipv6 only.
- xt_mac
- xt_owner
- xt_physdev
These extensions are not used by ebtables in userspace.
Moreover, xt_realm is only for ipv4, since dst->tclassid is ipv4
specific.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ab4f21e6fb1c09b13c4c3cb8357babe8223471bd Version: ab4f21e6fb1c09b13c4c3cb8357babe8223471bd Version: ab4f21e6fb1c09b13c4c3cb8357babe8223471bd Version: ab4f21e6fb1c09b13c4c3cb8357babe8223471bd Version: ab4f21e6fb1c09b13c4c3cb8357babe8223471bd Version: ab4f21e6fb1c09b13c4c3cb8357babe8223471bd Version: ab4f21e6fb1c09b13c4c3cb8357babe8223471bd Version: ab4f21e6fb1c09b13c4c3cb8357babe8223471bd |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:22:13.020Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_mac.c",
"net/netfilter/xt_owner.c",
"net/netfilter/xt_physdev.c",
"net/netfilter/xt_realm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14203f9edf944b3fb63faadd62f38452421ecdfc",
"status": "affected",
"version": "ab4f21e6fb1c09b13c4c3cb8357babe8223471bd",
"versionType": "git"
},
{
"lessThan": "7eaf9c740f33230cb224dc265f3c69f8531ff57b",
"status": "affected",
"version": "ab4f21e6fb1c09b13c4c3cb8357babe8223471bd",
"versionType": "git"
},
{
"lessThan": "9a109751b297b0f2135495749ef5a18ba31ec7d4",
"status": "affected",
"version": "ab4f21e6fb1c09b13c4c3cb8357babe8223471bd",
"versionType": "git"
},
{
"lessThan": "cbeb259f31382de70a70a59ffd0e66f5e80d9818",
"status": "affected",
"version": "ab4f21e6fb1c09b13c4c3cb8357babe8223471bd",
"versionType": "git"
},
{
"lessThan": "689a91ff18d6448d94c1ab7c076fecdb2b668bef",
"status": "affected",
"version": "ab4f21e6fb1c09b13c4c3cb8357babe8223471bd",
"versionType": "git"
},
{
"lessThan": "76160e04440c9698b989dbd9492a7ec4f520c9ee",
"status": "affected",
"version": "ab4f21e6fb1c09b13c4c3cb8357babe8223471bd",
"versionType": "git"
},
{
"lessThan": "fa88161ef56e29bdaa05cc89dbc4ee221e94bfe9",
"status": "affected",
"version": "ab4f21e6fb1c09b13c4c3cb8357babe8223471bd",
"versionType": "git"
},
{
"lessThan": "b6fe26f86a1649f84e057f3f15605b08eda15497",
"status": "affected",
"version": "ab4f21e6fb1c09b13c4c3cb8357babe8223471bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_mac.c",
"net/netfilter/xt_owner.c",
"net/netfilter/xt_physdev.c",
"net/netfilter/xt_realm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.28"
},
{
"lessThan": "2.6.28",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xtables: restrict several matches to inet family\n\nThis is a partial revert of:\n\n commit ab4f21e6fb1c (\"netfilter: xtables: use NFPROTO_UNSPEC in more extensions\")\n\nto allow ipv4 and ipv6 only.\n\n- xt_mac\n- xt_owner\n- xt_physdev\n\nThese extensions are not used by ebtables in userspace.\n\nMoreover, xt_realm is only for ipv4, since dst-\u003etclassid is ipv4\nspecific."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:13.513Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14203f9edf944b3fb63faadd62f38452421ecdfc"
},
{
"url": "https://git.kernel.org/stable/c/7eaf9c740f33230cb224dc265f3c69f8531ff57b"
},
{
"url": "https://git.kernel.org/stable/c/9a109751b297b0f2135495749ef5a18ba31ec7d4"
},
{
"url": "https://git.kernel.org/stable/c/cbeb259f31382de70a70a59ffd0e66f5e80d9818"
},
{
"url": "https://git.kernel.org/stable/c/689a91ff18d6448d94c1ab7c076fecdb2b668bef"
},
{
"url": "https://git.kernel.org/stable/c/76160e04440c9698b989dbd9492a7ec4f520c9ee"
},
{
"url": "https://git.kernel.org/stable/c/fa88161ef56e29bdaa05cc89dbc4ee221e94bfe9"
},
{
"url": "https://git.kernel.org/stable/c/b6fe26f86a1649f84e057f3f15605b08eda15497"
}
],
"title": "netfilter: xtables: restrict several matches to inet family",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53001",
"datePublished": "2026-06-24T16:29:13.513Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-10-15T01:22:13.020Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64572 (GCVE-0-2026-64572)
Vulnerability from cvelistv5
Published
2026-08-05 08:08
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
fib_table_insert() publishes new_fa into the leaf's fa_list with
fib_insert_alias() before calling the fib entry notifiers. When a
notifier fails, the error path removes new_fa with fib_remove_alias()
(hlist_del_rcu) and frees it right away with kmem_cache_free().
fib_table_lookup() walks that list under rcu_read_lock() only, so a
concurrent lookup that already reached new_fa keeps reading it after the
free:
BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601)
Read of size 1 at addr ffff88810676d4eb by task exploit/297
Call Trace:
fib_table_lookup (net/ipv4/fib_trie.c:1601)
ip_route_output_key_hash_rcu (net/ipv4/route.c:2814)
ip_route_output_key_hash (net/ipv4/route.c:2705)
__ip4_datagram_connect (net/ipv4/datagram.c:49)
udp_connect (net/ipv4/udp.c:2144)
__sys_connect (net/socket.c:2167)
__x64_sys_connect (net/socket.c:2173)
do_syscall_64
entry_SYSCALL_64_after_hwframe
which belongs to the cache ip_fib_alias of size 56
Triggering the error path needs CAP_NET_ADMIN and a registered fib
notifier that can reject a route; a netdevsim device whose IPv4 FIB
resource is exhausted is enough.
Free new_fa with alias_free_mem_rcu(), as fib_table_delete() already
does for a fib_alias removed from the trie.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a6c76c17df021b141b0d306828c9fe4ba2d2717c Version: a6c76c17df021b141b0d306828c9fe4ba2d2717c Version: a6c76c17df021b141b0d306828c9fe4ba2d2717c Version: a6c76c17df021b141b0d306828c9fe4ba2d2717c Version: a6c76c17df021b141b0d306828c9fe4ba2d2717c Version: a6c76c17df021b141b0d306828c9fe4ba2d2717c Version: a6c76c17df021b141b0d306828c9fe4ba2d2717c Version: a6c76c17df021b141b0d306828c9fe4ba2d2717c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/fib_trie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9d0778571def598c31e84a38ae5a7ebc6f65e6d8",
"status": "affected",
"version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
"versionType": "git"
},
{
"lessThan": "bb03350f974aec352b660d032a1d283eb462165a",
"status": "affected",
"version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
"versionType": "git"
},
{
"lessThan": "6429c9cfd941e62acd7bb0bc64d631574d4c3b2a",
"status": "affected",
"version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
"versionType": "git"
},
{
"lessThan": "8150b5365f026e72250cacc527ea00be30f40105",
"status": "affected",
"version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
"versionType": "git"
},
{
"lessThan": "d007056868723de9c0cc3f5ffaad47a8d468b9a4",
"status": "affected",
"version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
"versionType": "git"
},
{
"lessThan": "cb8be318b4432abd88d3172ec157330f27a5f7a7",
"status": "affected",
"version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
"versionType": "git"
},
{
"lessThan": "b8d2ea75c76abcd0d72679c2f488271f573e32fb",
"status": "affected",
"version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
"versionType": "git"
},
{
"lessThan": "f2f152e94a67bc746afaf05a1b2702c195553112",
"status": "affected",
"version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/fib_trie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: free fib_alias with kfree_rcu() on insert error path\n\nfib_table_insert() publishes new_fa into the leaf\u0027s fa_list with\nfib_insert_alias() before calling the fib entry notifiers. When a\nnotifier fails, the error path removes new_fa with fib_remove_alias()\n(hlist_del_rcu) and frees it right away with kmem_cache_free().\n\nfib_table_lookup() walks that list under rcu_read_lock() only, so a\nconcurrent lookup that already reached new_fa keeps reading it after the\nfree:\n\n BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601)\n Read of size 1 at addr ffff88810676d4eb by task exploit/297\n Call Trace:\n fib_table_lookup (net/ipv4/fib_trie.c:1601)\n ip_route_output_key_hash_rcu (net/ipv4/route.c:2814)\n ip_route_output_key_hash (net/ipv4/route.c:2705)\n __ip4_datagram_connect (net/ipv4/datagram.c:49)\n udp_connect (net/ipv4/udp.c:2144)\n __sys_connect (net/socket.c:2167)\n __x64_sys_connect (net/socket.c:2173)\n do_syscall_64\n entry_SYSCALL_64_after_hwframe\n which belongs to the cache ip_fib_alias of size 56\n\nTriggering the error path needs CAP_NET_ADMIN and a registered fib\nnotifier that can reject a route; a netdevsim device whose IPv4 FIB\nresource is exhausted is enough.\n\nFree new_fa with alias_free_mem_rcu(), as fib_table_delete() already\ndoes for a fib_alias removed from the trie."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:49.541Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9d0778571def598c31e84a38ae5a7ebc6f65e6d8"
},
{
"url": "https://git.kernel.org/stable/c/bb03350f974aec352b660d032a1d283eb462165a"
},
{
"url": "https://git.kernel.org/stable/c/6429c9cfd941e62acd7bb0bc64d631574d4c3b2a"
},
{
"url": "https://git.kernel.org/stable/c/8150b5365f026e72250cacc527ea00be30f40105"
},
{
"url": "https://git.kernel.org/stable/c/d007056868723de9c0cc3f5ffaad47a8d468b9a4"
},
{
"url": "https://git.kernel.org/stable/c/cb8be318b4432abd88d3172ec157330f27a5f7a7"
},
{
"url": "https://git.kernel.org/stable/c/b8d2ea75c76abcd0d72679c2f488271f573e32fb"
},
{
"url": "https://git.kernel.org/stable/c/f2f152e94a67bc746afaf05a1b2702c195553112"
}
],
"title": "ipv4: fib: free fib_alias with kfree_rcu() on insert error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64572",
"datePublished": "2026-08-05T08:08:09.068Z",
"dateReserved": "2026-07-19T15:36:31.797Z",
"dateUpdated": "2026-08-19T16:28:49.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43257 (GCVE-0-2026-43257)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: cx88: Add missing unmap in snd_cx88_hw_params()
In error path, add cx88_alsa_dma_unmap() to release
resource acquired by cx88_alsa_dma_map().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/cx88/cx88-alsa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f0d7f735eba963742009b0706e19dd0bed91537a",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "dc911fccc6e08ef46a66b2a42a764252b001ee3c",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "24f3dabeb97bd0bec8c1c926c97e3eb6a8129225",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "10ab64f8efc2f479293dce929fde326c285fc96f",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "e3fb15aadfc8643203bbdf97ace0396e4586fa64",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "1ce8c2a8f050a23240553c8bae628ac623f9dbc1",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "3baefeeb7b85e1e34eebef399ffa312be7179e30",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "dbc527d980f7ba8559de38f8c1e4158c71a78915",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/cx88/cx88-alsa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx88: Add missing unmap in snd_cx88_hw_params()\n\nIn error path, add cx88_alsa_dma_unmap() to release\nresource acquired by cx88_alsa_dma_map()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:03.247Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f0d7f735eba963742009b0706e19dd0bed91537a"
},
{
"url": "https://git.kernel.org/stable/c/dc911fccc6e08ef46a66b2a42a764252b001ee3c"
},
{
"url": "https://git.kernel.org/stable/c/24f3dabeb97bd0bec8c1c926c97e3eb6a8129225"
},
{
"url": "https://git.kernel.org/stable/c/10ab64f8efc2f479293dce929fde326c285fc96f"
},
{
"url": "https://git.kernel.org/stable/c/e3fb15aadfc8643203bbdf97ace0396e4586fa64"
},
{
"url": "https://git.kernel.org/stable/c/1ce8c2a8f050a23240553c8bae628ac623f9dbc1"
},
{
"url": "https://git.kernel.org/stable/c/3baefeeb7b85e1e34eebef399ffa312be7179e30"
},
{
"url": "https://git.kernel.org/stable/c/dbc527d980f7ba8559de38f8c1e4158c71a78915"
}
],
"title": "media: cx88: Add missing unmap in snd_cx88_hw_params()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43257",
"datePublished": "2026-05-06T11:28:45.872Z",
"dateReserved": "2026-05-01T14:12:55.996Z",
"dateUpdated": "2026-05-11T22:21:03.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68155 (GCVE-0-2026-68155)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Reject monmaps advertising zero monitors
A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a
monitor to the client. This monmap contains information about the
existing monitors in the cluster. Currently, a monmap indicating that
there are zero monitors in the cluster is treated as valid. However, it
is impossible to have zero monitors in the cluster and still receive a
valid monmap from a monitor. Therefore, such a monmap must be corrupted
and should be treated as invalid. Furthermore, a monmap with a monitor
count of zero can subsequently crash the client when attempting to open
a session with a monitor in __open_session(). This happens because the
"BUG_ON(monc->monmap->num_mon < 1)" assertion in pick_new_mon() is
triggered.
This patch extends a check in ceph_monmap_decode() to also reject
arriving mon_maps with num_mon == 0 rather than only with
num_mon > CEPH_MAX_MON.
[ idryomov: drop "log output for unusual values of num_mon" part ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe Version: ba75bb98cfb93b62c54af25bf67ff90857264bbe |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68155",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:45:06.305922Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:54.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ba5f0015bfd376d764163045a61c17be75f44dae",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "caf082ef8609a6ac26159ce115f55ab7d00231a3",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "e3ccd4ecab09b22f507f49cb7ed9990c7158ceab",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "0591a15815b498be628a937146e44487d599ba33",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "cd0d41bc569632eaaeccde9d2a6bc919ec00c407",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "e67e8b694872c9bc66996040f9de9242f6236ed9",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "3b249546f59c3d6d3592c10657f82bc3f1faa07c",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
},
{
"lessThan": "40480eee361ed9676b3f844d532ac28b47251634",
"status": "affected",
"version": "ba75bb98cfb93b62c54af25bf67ff90857264bbe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Reject monmaps advertising zero monitors\n\nA message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a\nmonitor to the client. This monmap contains information about the\nexisting monitors in the cluster. Currently, a monmap indicating that\nthere are zero monitors in the cluster is treated as valid. However, it\nis impossible to have zero monitors in the cluster and still receive a\nvalid monmap from a monitor. Therefore, such a monmap must be corrupted\nand should be treated as invalid. Furthermore, a monmap with a monitor\ncount of zero can subsequently crash the client when attempting to open\na session with a monitor in __open_session(). This happens because the\n\"BUG_ON(monc-\u003emonmap-\u003enum_mon \u003c 1)\" assertion in pick_new_mon() is\ntriggered.\n\nThis patch extends a check in ceph_monmap_decode() to also reject\narriving mon_maps with num_mon == 0 rather than only with\nnum_mon \u003e CEPH_MAX_MON.\n\n[ idryomov: drop \"log output for unusual values of num_mon\" part ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when libceph decodes CEPH_MSG_MON_MAP from a remote Ceph monitor over the kernel client\u0027s established TCP/msgr2 session (mon_dispatch -\u003e ceph_monc_handle_map -\u003e ceph_monmap_decode), which is a network protocol attack surface on CephFS/RBD/cloud nodes.\nAC:L - An attacker who can send monitor protocol messages only needs to set num_mon=0 in the monmap; once accepted, any later session reopen (keepalive timeout, hunt, or connection fault) deterministically hits BUG_ON in pick_new_mon without races or special memory layout.\nPR:N - In the highest-impact scenario a malicious or compromised Ceph monitor (or equivalent authenticated cluster peer) sends the malformed monmap to already-connected kernel clients; the attacker needs no local privileges on the victim host.\nUI:N - After a Ceph client session exists, monmap updates are delivered and processed automatically by the kernel monitor client; no further mount, open, or other victim interaction is required to accept the bad map and later crash on reconnect.\nS:U - Exploitation causes a kernel BUG/panic within the same kernel security domain and does not cross VM, container, IOMMU, or other security boundaries.\nC:N - The failure mode is a BUG_ON assertion in pick_new_mon when num_mon is zero; there is no memory corruption, out-of-bounds access, or other information disclosure primitive on the vulnerable path.\nI:N - Accepting num_mon==0 only stores an empty monmap and later triggers a deliberate kernel BUG; attacker input does not corrupt or modify arbitrary kernel memory or enable code execution.\nA:H - BUG_ON(monc-\u003emonmap-\u003enum_mon \u003c 1) in pick_new_mon during __open_session causes a kernel oops/panic, fully denying availability of the affected host until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T10:55:38.556Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ba5f0015bfd376d764163045a61c17be75f44dae"
},
{
"url": "https://git.kernel.org/stable/c/caf082ef8609a6ac26159ce115f55ab7d00231a3"
},
{
"url": "https://git.kernel.org/stable/c/e3ccd4ecab09b22f507f49cb7ed9990c7158ceab"
},
{
"url": "https://git.kernel.org/stable/c/0591a15815b498be628a937146e44487d599ba33"
},
{
"url": "https://git.kernel.org/stable/c/cd0d41bc569632eaaeccde9d2a6bc919ec00c407"
},
{
"url": "https://git.kernel.org/stable/c/e67e8b694872c9bc66996040f9de9242f6236ed9"
},
{
"url": "https://git.kernel.org/stable/c/3b249546f59c3d6d3592c10657f82bc3f1faa07c"
},
{
"url": "https://git.kernel.org/stable/c/40480eee361ed9676b3f844d532ac28b47251634"
}
],
"title": "libceph: Reject monmaps advertising zero monitors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68155",
"datePublished": "2026-08-10T11:59:21.200Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-10-19T20:58:54.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63891 (GCVE-0-2026-63891)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-07-19 14:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()
A DIRECTORY entry's value field is used as the dir_offset for a
recursive call into __tb_property_parse_dir() with no depth counter.
A crafted peer that chains DIRECTORY entries into a back-reference
loop drives the parser until the kernel stack is exhausted and the
guard page fires. Any untrusted XDomain peer (cable, dock, in-line
inspector, adjacent host) that reaches the PROPERTIES_REQUEST
control-plane exchange can trigger this without authentication.
Thread a depth counter through tb_property_parse() and
__tb_property_parse_dir(), and reject blocks that exceed
TB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any
observed legitimate XDomain layout.
Operators who do not need XDomain host-to-host discovery can disable
the path entirely with thunderbolt.xdomain=0 on the kernel command
line.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2b5f47a710172c962ef42d1b732b04d2ad0dce21",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "95839a67ea56ca35732aad7f711404a3127cfe2d",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "0a84ab9271936c11e84e511bb52fc5682f8b6726",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "b4621e5ef63405c317a84b711faf3bd75b3c6a94",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "f31c6d220f455b5af63590302b30e1b932d14599",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "830c8a9b467e7d3a158483d37fa7dc13892b293a",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "ed9455ef4bd9babc90f92e526abe3fb68c1a8709",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "928abe19fbf0127003abcb1ea69cabc1c897d0ab",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: property: Cap recursion depth in __tb_property_parse_dir()\n\nA DIRECTORY entry\u0027s value field is used as the dir_offset for a\nrecursive call into __tb_property_parse_dir() with no depth counter.\nA crafted peer that chains DIRECTORY entries into a back-reference\nloop drives the parser until the kernel stack is exhausted and the\nguard page fires. Any untrusted XDomain peer (cable, dock, in-line\ninspector, adjacent host) that reaches the PROPERTIES_REQUEST\ncontrol-plane exchange can trigger this without authentication.\n\nThread a depth counter through tb_property_parse() and\n__tb_property_parse_dir(), and reject blocks that exceed\nTB_PROPERTY_MAX_DEPTH = 8. That is comfortably larger than any\nobserved legitimate XDomain layout.\n\nOperators who do not need XDomain host-to-host discovery can disable\nthe path entirely with thunderbolt.xdomain=0 on the kernel command\nline."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T14:55:02.840Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2b5f47a710172c962ef42d1b732b04d2ad0dce21"
},
{
"url": "https://git.kernel.org/stable/c/95839a67ea56ca35732aad7f711404a3127cfe2d"
},
{
"url": "https://git.kernel.org/stable/c/0a84ab9271936c11e84e511bb52fc5682f8b6726"
},
{
"url": "https://git.kernel.org/stable/c/b4621e5ef63405c317a84b711faf3bd75b3c6a94"
},
{
"url": "https://git.kernel.org/stable/c/f31c6d220f455b5af63590302b30e1b932d14599"
},
{
"url": "https://git.kernel.org/stable/c/830c8a9b467e7d3a158483d37fa7dc13892b293a"
},
{
"url": "https://git.kernel.org/stable/c/ed9455ef4bd9babc90f92e526abe3fb68c1a8709"
},
{
"url": "https://git.kernel.org/stable/c/928abe19fbf0127003abcb1ea69cabc1c897d0ab"
}
],
"title": "thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63891",
"datePublished": "2026-07-19T14:55:02.840Z",
"dateReserved": "2026-07-19T07:54:57.019Z",
"dateUpdated": "2026-07-19T14:55:02.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68214 (GCVE-0-2025-68214)
Vulnerability from cvelistv5
Published
2025-12-16 13:57
Modified
2026-05-23 16:02
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
timers: Fix NULL function pointer race in timer_shutdown_sync()
There is a race condition between timer_shutdown_sync() and timer
expiration that can lead to hitting a WARN_ON in expire_timers().
The issue occurs when timer_shutdown_sync() clears the timer function
to NULL while the timer is still running on another CPU. The race
scenario looks like this:
CPU0 CPU1
<SOFTIRQ>
lock_timer_base()
expire_timers()
base->running_timer = timer;
unlock_timer_base()
[call_timer_fn enter]
mod_timer()
...
timer_shutdown_sync()
lock_timer_base()
// For now, will not detach the timer but only clear its function to NULL
if (base->running_timer != timer)
ret = detach_if_pending(timer, base, true);
if (shutdown)
timer->function = NULL;
unlock_timer_base()
[call_timer_fn exit]
lock_timer_base()
base->running_timer = NULL;
unlock_timer_base()
...
// Now timer is pending while its function set to NULL.
// next timer trigger
<SOFTIRQ>
expire_timers()
WARN_ON_ONCE(!fn) // hit
...
lock_timer_base()
// Now timer will detach
if (base->running_timer != timer)
ret = detach_if_pending(timer, base, true);
if (shutdown)
timer->function = NULL;
unlock_timer_base()
The problem is that timer_shutdown_sync() clears the timer function
regardless of whether the timer is currently running. This can leave a
pending timer with a NULL function pointer, which triggers the
WARN_ON_ONCE(!fn) check in expire_timers().
Fix this by only clearing the timer function when actually detaching the
timer. If the timer is running, leave the function pointer intact, which is
safe because the timer will be properly detached when it finishes running.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: debbcf812d735003c96c5e5968a3cfa4e1fbd1af Version: 334c33aa487be406a149c8b87c38c8399d2dba8d Version: 0cc04e80458a822300b93f82ed861a513edde194 Version: 0cc04e80458a822300b93f82ed861a513edde194 Version: 0cc04e80458a822300b93f82ed861a513edde194 Version: 0cc04e80458a822300b93f82ed861a513edde194 Version: 6.1.158 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/time/timer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ba43ac025c4318241f8edf94f31d2eebab86991b",
"status": "affected",
"version": "debbcf812d735003c96c5e5968a3cfa4e1fbd1af",
"versionType": "git"
},
{
"lessThan": "1a975716cc8977f461e45e28e3e5977d46ad7a6a",
"status": "affected",
"version": "334c33aa487be406a149c8b87c38c8399d2dba8d",
"versionType": "git"
},
{
"lessThan": "6665fbd7730b26d770c232b20d1b907e6a67a914",
"status": "affected",
"version": "0cc04e80458a822300b93f82ed861a513edde194",
"versionType": "git"
},
{
"lessThan": "176725f4848376530a0f0da9023f956afcc33585",
"status": "affected",
"version": "0cc04e80458a822300b93f82ed861a513edde194",
"versionType": "git"
},
{
"lessThan": "a01efa7a780c42ac5170a949bd95c9786ffcc60a",
"status": "affected",
"version": "0cc04e80458a822300b93f82ed861a513edde194",
"versionType": "git"
},
{
"lessThan": "20739af07383e6eb1ec59dcd70b72ebfa9ac362c",
"status": "affected",
"version": "0cc04e80458a822300b93f82ed861a513edde194",
"versionType": "git"
},
{
"lessThan": "6.1.159",
"status": "affected",
"version": "6.1.158",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/time/timer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.159",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.118",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.159",
"versionStartIncluding": "6.1.158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.118",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.60",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.10",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntimers: Fix NULL function pointer race in timer_shutdown_sync()\n\nThere is a race condition between timer_shutdown_sync() and timer\nexpiration that can lead to hitting a WARN_ON in expire_timers().\n\nThe issue occurs when timer_shutdown_sync() clears the timer function\nto NULL while the timer is still running on another CPU. The race\nscenario looks like this:\n\nCPU0\t\t\t\t\tCPU1\n\t\t\t\t\t\u003cSOFTIRQ\u003e\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tbase-\u003erunning_timer = timer;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t[call_timer_fn enter]\n\t\t\t\t\tmod_timer()\n\t\t\t\t\t...\ntimer_shutdown_sync()\nlock_timer_base()\n// For now, will not detach the timer but only clear its function to NULL\nif (base-\u003erunning_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer-\u003efunction = NULL;\nunlock_timer_base()\n\t\t\t\t\t[call_timer_fn exit]\n\t\t\t\t\tlock_timer_base()\n\t\t\t\t\tbase-\u003erunning_timer = NULL;\n\t\t\t\t\tunlock_timer_base()\n\t\t\t\t\t...\n\t\t\t\t\t// Now timer is pending while its function set to NULL.\n\t\t\t\t\t// next timer trigger\n\t\t\t\t\t\u003cSOFTIRQ\u003e\n\t\t\t\t\texpire_timers()\n\t\t\t\t\tWARN_ON_ONCE(!fn) // hit\n\t\t\t\t\t...\nlock_timer_base()\n// Now timer will detach\nif (base-\u003erunning_timer != timer)\n\tret = detach_if_pending(timer, base, true);\nif (shutdown)\n\ttimer-\u003efunction = NULL;\nunlock_timer_base()\n\nThe problem is that timer_shutdown_sync() clears the timer function\nregardless of whether the timer is currently running. This can leave a\npending timer with a NULL function pointer, which triggers the\nWARN_ON_ONCE(!fn) check in expire_timers().\n\nFix this by only clearing the timer function when actually detaching the\ntimer. If the timer is running, leave the function pointer intact, which is\nsafe because the timer will be properly detached when it finishes running."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:02:22.475Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ba43ac025c4318241f8edf94f31d2eebab86991b"
},
{
"url": "https://git.kernel.org/stable/c/1a975716cc8977f461e45e28e3e5977d46ad7a6a"
},
{
"url": "https://git.kernel.org/stable/c/6665fbd7730b26d770c232b20d1b907e6a67a914"
},
{
"url": "https://git.kernel.org/stable/c/176725f4848376530a0f0da9023f956afcc33585"
},
{
"url": "https://git.kernel.org/stable/c/a01efa7a780c42ac5170a949bd95c9786ffcc60a"
},
{
"url": "https://git.kernel.org/stable/c/20739af07383e6eb1ec59dcd70b72ebfa9ac362c"
}
],
"title": "timers: Fix NULL function pointer race in timer_shutdown_sync()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-68214",
"datePublished": "2025-12-16T13:57:09.728Z",
"dateReserved": "2025-12-16T13:41:40.256Z",
"dateUpdated": "2026-05-23T16:02:22.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68234 (GCVE-0-2026-68234)
Vulnerability from cvelistv5
Published
2026-08-10 12:00
Modified
2026-08-19 16:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
amdgpu_bo_create_reserved() only allocates a new BO when
*bo_ptr (struct amdgpu_bo **bo_ptr as input parameter) is
NULL, it simply skips creation when *bo_ptr is non-NULL.
But it unconditionally reserves, pins, gart allocates
and maps the BO afterwards.
When the same non-NULL BO pointer is passed in again,
for example firmware buffers that live in adev and are
re-loaded on every resume / cp_resume / start
under AMDGPU_FW_LOAD_DIRECT, amdgpu_bo_pin() just increases
pin_count unconditionally, however the matching teardown only unpins
once, so pin_count never drops to zero, so TTM is not able
to move, swap or evict a BO, causing BO leaks.
This commit fixes this issue by only pinning the bo
once at creation, and repeated calls no longer
take additional pin references.
(cherry picked from commit 3ddc0ae76202c447b6aec61e907b852bc94671cf)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 53766e5adac75872e9d413cdbfd0e47ae40701f9 Version: 53766e5adac75872e9d413cdbfd0e47ae40701f9 Version: 53766e5adac75872e9d413cdbfd0e47ae40701f9 Version: 53766e5adac75872e9d413cdbfd0e47ae40701f9 Version: 53766e5adac75872e9d413cdbfd0e47ae40701f9 Version: 53766e5adac75872e9d413cdbfd0e47ae40701f9 Version: 53766e5adac75872e9d413cdbfd0e47ae40701f9 Version: 53766e5adac75872e9d413cdbfd0e47ae40701f9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_object.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7aea619d9f186dcf0f1289879e9edb69d2b56639",
"status": "affected",
"version": "53766e5adac75872e9d413cdbfd0e47ae40701f9",
"versionType": "git"
},
{
"lessThan": "b572d0814c1366701ca704286589fab025802566",
"status": "affected",
"version": "53766e5adac75872e9d413cdbfd0e47ae40701f9",
"versionType": "git"
},
{
"lessThan": "e06e0885725a16304b7723aeb478a78cca9dc96a",
"status": "affected",
"version": "53766e5adac75872e9d413cdbfd0e47ae40701f9",
"versionType": "git"
},
{
"lessThan": "51eeef1949c11d3dcb5f422a5d9b3f09ebe8a1bc",
"status": "affected",
"version": "53766e5adac75872e9d413cdbfd0e47ae40701f9",
"versionType": "git"
},
{
"lessThan": "2f390b4c83011452753fd84972f657d2b00a952b",
"status": "affected",
"version": "53766e5adac75872e9d413cdbfd0e47ae40701f9",
"versionType": "git"
},
{
"lessThan": "ba7b6444097a73ccd3d3ac9e2be4ebb73d226460",
"status": "affected",
"version": "53766e5adac75872e9d413cdbfd0e47ae40701f9",
"versionType": "git"
},
{
"lessThan": "9743f60013273987abf415dc47474683d22aaee9",
"status": "affected",
"version": "53766e5adac75872e9d413cdbfd0e47ae40701f9",
"versionType": "git"
},
{
"lessThan": "a2f895f3c852063258d62e9f74b081de07ca95df",
"status": "affected",
"version": "53766e5adac75872e9d413cdbfd0e47ae40701f9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_object.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved\n\namdgpu_bo_create_reserved() only allocates a new BO when\n*bo_ptr (struct amdgpu_bo **bo_ptr as input parameter) is\nNULL, it simply skips creation when *bo_ptr is non-NULL.\nBut it unconditionally reserves, pins, gart allocates\nand maps the BO afterwards.\n\nWhen the same non-NULL BO pointer is passed in again,\nfor example firmware buffers that live in adev and are\nre-loaded on every resume / cp_resume / start\nunder AMDGPU_FW_LOAD_DIRECT, amdgpu_bo_pin() just increases\npin_count unconditionally, however the matching teardown only unpins\nonce, so pin_count never drops to zero, so TTM is not able\nto move, swap or evict a BO, causing BO leaks.\n\nThis commit fixes this issue by only pinning the bo\nonce at creation, and repeated calls no longer\ntake additional pin references.\n\n(cherry picked from commit 3ddc0ae76202c447b6aec61e907b852bc94671cf)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:32:06.457Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7aea619d9f186dcf0f1289879e9edb69d2b56639"
},
{
"url": "https://git.kernel.org/stable/c/b572d0814c1366701ca704286589fab025802566"
},
{
"url": "https://git.kernel.org/stable/c/e06e0885725a16304b7723aeb478a78cca9dc96a"
},
{
"url": "https://git.kernel.org/stable/c/51eeef1949c11d3dcb5f422a5d9b3f09ebe8a1bc"
},
{
"url": "https://git.kernel.org/stable/c/2f390b4c83011452753fd84972f657d2b00a952b"
},
{
"url": "https://git.kernel.org/stable/c/ba7b6444097a73ccd3d3ac9e2be4ebb73d226460"
},
{
"url": "https://git.kernel.org/stable/c/9743f60013273987abf415dc47474683d22aaee9"
},
{
"url": "https://git.kernel.org/stable/c/a2f895f3c852063258d62e9f74b081de07ca95df"
}
],
"title": "drm/amdgpu: fix bo-\u003epin leaking in amdgpu_bo_create_reserved",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68234",
"datePublished": "2026-08-10T12:00:59.074Z",
"dateReserved": "2026-07-30T09:28:09.376Z",
"dateUpdated": "2026-08-19T16:32:06.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64561 (GCVE-0-2026-64561)
Vulnerability from cvelistv5
Published
2026-08-04 06:23
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
Check for a "stale" page fault, i.e. for an invalid and/or obsolete root,
after making MMU pages available for the shadow MMU. If reclaiming shadow
pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to
map memory into an invalid root. On its own, populating an invalid root is
"fine", but because child shadow pages inherit their parent's role, any
children created during the map/fetch will be created as invalid pages,
thus violating KVM's invariant that invalid pages are never on the list of
active MMU pages.
Note, the underlying flaw has existed since KVM first started tracking
invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root
pagetables"), but the true badness only came along in 2020 (Linux 5.9)
with the invariant that invalid shadow pages can't be on the list of
active pages.
Note #2, inheriting role.invalid when creating child shadow pages is also
far from ideal; that flaw will be addressed separately.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f95eec9bed76d42194c23153cb1cc8f186bf91cb Version: f95eec9bed76d42194c23153cb1cc8f186bf91cb Version: f95eec9bed76d42194c23153cb1cc8f186bf91cb Version: f95eec9bed76d42194c23153cb1cc8f186bf91cb Version: f95eec9bed76d42194c23153cb1cc8f186bf91cb Version: f95eec9bed76d42194c23153cb1cc8f186bf91cb Version: f95eec9bed76d42194c23153cb1cc8f186bf91cb |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64561",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:48.794184Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:41.652Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/mmu.c",
"arch/x86/kvm/mmu/paging_tmpl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "62ef67af1878fa2cd066642f2f59e33ade95f637",
"status": "affected",
"version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
"versionType": "git"
},
{
"lessThan": "65c4f7a1028cf01a93a2762d679c289810ede990",
"status": "affected",
"version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
"versionType": "git"
},
{
"lessThan": "35e77467610c4a37cb0ff54ee56b85f73b1f5700",
"status": "affected",
"version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
"versionType": "git"
},
{
"lessThan": "0026dbb7de8ea76e97d6edf42fc3cc084564e2bf",
"status": "affected",
"version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
"versionType": "git"
},
{
"lessThan": "f3477a6a4164f15287444eda685b5f6405dbd1e5",
"status": "affected",
"version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
"versionType": "git"
},
{
"lessThan": "bce0d3c26e2c761a4bf43c8949f333fc7374eb2d",
"status": "affected",
"version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
"versionType": "git"
},
{
"lessThan": "2abd5287f08319fa35764566b15c6e22cb1068db",
"status": "affected",
"version": "f95eec9bed76d42194c23153cb1cc8f186bf91cb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/mmu.c",
"arch/x86/kvm/mmu/paging_tmpl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Check for invalid/obsolete root *after* making MMU pages available\n\nCheck for a \"stale\" page fault, i.e. for an invalid and/or obsolete root,\nafter making MMU pages available for the shadow MMU. If reclaiming shadow\npages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to\nmap memory into an invalid root. On its own, populating an invalid root is\n\"fine\", but because child shadow pages inherit their parent\u0027s role, any\nchildren created during the map/fetch will be created as invalid pages,\nthus violating KVM\u0027s invariant that invalid pages are never on the list of\nactive MMU pages.\n\nNote, the underlying flaw has existed since KVM first started tracking\ninvalid roots in 2008 (commit 2e53d63acba7, \"KVM: MMU: ignore zapped root\npagetables\"), but the true badness only came along in 2020 (Linux 5.9)\nwith the invariant that invalid shadow pages can\u0027t be on the list of\nactive pages.\n\nNote #2, inheriting role.invalid when creating child shadow pages is also\nfar from ideal; that flaw will be addressed separately."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable shadow-MMU page-fault path is reached via local KVM_RUN handling of guest EPT/shadow faults (and nested EPT via paging_tmpl), not by network or adjacent-radio packets.\nAC:L - An attacker who can run nested or shadow-MMU guests controls MMU pressure (heavy nested mappings and/or KVM_SET_NR_MMU_PAGES) and concurrent faults so reclaim zaps an in-use root during make_mmu_pages_available; no attacker-uncontrollable condition is required.\nPR:L - Exploitation needs /dev/kvm access or a nested-capable guest on the host, privileges commonly available to kvm-group users or cloud tenants, not real init-namespace root or CAP_SYS_ADMIN on the create/run path.\nUI:N - Once the attacker can run the guest, they trigger reclaim and page faults entirely through their own vCPU activity with no action by another user.\nS:C - Guest-controlled faults corrupt host KVM MMU state (invalid shadow pages on active_mmu_pages and subsequent list handling), crossing the guest-to-host virtualization boundary into the host kernel authority.\nC:H - Invalid children on active_mmu_pages break zap accounting assumptions so later prepare_zap list_add on still-linked entries corrupts kernel lists, a memory-corruption primitive that can be leveraged for arbitrary host reads.\nI:H - The same active-list invariant break and linked-list corruption in host MMU teardown/reclaim paths yield writable host corruption suitable for control-flow or structure hijacking, not merely a benign accounting glitch.\nA:H - WARN_ON_ONCE skips, infinite zap loops, list corruption, and host oops/hangs are reachable when invalid shadow pages remain on active_mmu_pages, causing host and co-located VM denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:43.193Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/62ef67af1878fa2cd066642f2f59e33ade95f637"
},
{
"url": "https://git.kernel.org/stable/c/65c4f7a1028cf01a93a2762d679c289810ede990"
},
{
"url": "https://git.kernel.org/stable/c/35e77467610c4a37cb0ff54ee56b85f73b1f5700"
},
{
"url": "https://git.kernel.org/stable/c/0026dbb7de8ea76e97d6edf42fc3cc084564e2bf"
},
{
"url": "https://git.kernel.org/stable/c/f3477a6a4164f15287444eda685b5f6405dbd1e5"
},
{
"url": "https://git.kernel.org/stable/c/bce0d3c26e2c761a4bf43c8949f333fc7374eb2d"
},
{
"url": "https://git.kernel.org/stable/c/2abd5287f08319fa35764566b15c6e22cb1068db"
},
{
"url": "https://github.com/V4bel/Zapscape"
}
],
"title": "KVM: x86: Check for invalid/obsolete root *after* making MMU pages available",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64561",
"datePublished": "2026-08-04T06:23:21.094Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-10-19T20:48:41.652Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68433 (GCVE-0-2026-68433)
Vulnerability from cvelistv5
Published
2026-08-12 00:07
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: bound get_version reply decode to front len
handle_get_version_reply() uses msg->front_alloc_len as the decode
boundary for MON_GET_VERSION_REPLY. That is the size of the reused
reply buffer, not the number of bytes actually received.
A truncated reply can therefore pass ceph_decode_need() and decode the
second u64 from stale tail bytes left in the buffer by an earlier
message, causing an uninitialized memory read.
Use msg->front.iov_len as the receive-side decode boundary, matching
other libceph reply handlers and limiting decoding to the bytes that
were actually read from the wire.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 Version: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 Version: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 Version: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 Version: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 Version: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 Version: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 Version: 513a8243d67f8e8d27f2883bd2f18bc87c7ca376 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68433",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:55.526707Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:10.325Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1307028f082756bf453e1889aee9983d30643a4b",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "72a35070fcefa229b1b031aa7482ad3788e18f07",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "340e0386aa39da181015bee38f309018c335ce16",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "d60de8253c85a02d0e6194b0735e7a562981a04c",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "4e7ebfaa0d14cf50e44041bfde38070d6dbc019f",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "0d934c934ec746d53fc7e4f53239792647bbae63",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
},
{
"lessThan": "d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0",
"status": "affected",
"version": "513a8243d67f8e8d27f2883bd2f18bc87c7ca376",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound get_version reply decode to front len\n\nhandle_get_version_reply() uses msg-\u003efront_alloc_len as the decode\nboundary for MON_GET_VERSION_REPLY. That is the size of the reused\nreply buffer, not the number of bytes actually received.\n\nA truncated reply can therefore pass ceph_decode_need() and decode the\nsecond u64 from stale tail bytes left in the buffer by an earlier\nmessage, causing an uninitialized memory read.\n\nUse msg-\u003efront.iov_len as the receive-side decode boundary, matching\nother libceph reply handlers and limiting decoding to the bytes that\nwere actually read from the wire."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The malformed MON_GET_VERSION_REPLY arrives over the ceph messenger TCP connection to a monitor; a malicious/compromised ceph-mon or an on-path attacker on the msgr1/crc-mode session triggers the bug purely with received network data.\nAC:L - The attacker fully controls the reply\u0027s hdr.front_len and tid, so truncating the reply to 8 bytes reliably makes the handler decode past the received data every time; no race or memory-layout condition outside attacker control is involved.\nPR:N - The vulnerable decode runs on any reply the client accepts for an outstanding generic request; the attacker acts as the remote server/peer and needs no credentials or account on the victim kernel client.\nUI:N - An already-mounted CephFS/RBD client issues mon_get_version requests automatically (osdmap checks, pool-dne checks, remount/latest-map waits), so no local user action is needed once the client is connected.\nS:U - The uninitialized read and the resulting bogus epoch stay within the kernel\u0027s own libceph client state; no security authority other than the affected kernel is impacted.\nC:L - Eight bytes of uninitialized kvmalloc\u0027d heap (or stale bytes of a prior reply) are consumed as req-\u003eu.newest; the read stays inside the 32-byte allocation and is not copied to userspace, so it is a small bounded uninitialized-memory disclosure that only leaks indirectly through client behaviour.\nI:L - The attacker causes kernel state (req-\u003eu.newest, r_map_dne_bound, linger map_dne_bound) to be populated from uninitialized memory rather than the wire, corrupting osdmap-epoch bookkeeping and leading to wrong pool-does-not-exist decisions, but gives no arbitrary write.\nA:H - A zero stale value trips WARN_ON(greq-\u003eresult || !greq-\u003eu.newest) in map_check_cb()/linger_map_check_cb() (panic with panic_on_warn), while a huge garbage epoch makes ceph_monc_wait_osdmap() block until mount_timeout or indefinitely and makes check_pool_dne() abort in-flight requests with -ENOENT; all repeatable at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:35:33.508Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1307028f082756bf453e1889aee9983d30643a4b"
},
{
"url": "https://git.kernel.org/stable/c/f6cbf6878f3a1503c872ba8f1e69a58ee68d8b2e"
},
{
"url": "https://git.kernel.org/stable/c/72a35070fcefa229b1b031aa7482ad3788e18f07"
},
{
"url": "https://git.kernel.org/stable/c/340e0386aa39da181015bee38f309018c335ce16"
},
{
"url": "https://git.kernel.org/stable/c/d60de8253c85a02d0e6194b0735e7a562981a04c"
},
{
"url": "https://git.kernel.org/stable/c/4e7ebfaa0d14cf50e44041bfde38070d6dbc019f"
},
{
"url": "https://git.kernel.org/stable/c/0d934c934ec746d53fc7e4f53239792647bbae63"
},
{
"url": "https://git.kernel.org/stable/c/d3c32939fa0e3ee9b883b9a0fd1972c5c444e3d0"
}
],
"title": "libceph: bound get_version reply decode to front len",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68433",
"datePublished": "2026-08-12T00:07:20.455Z",
"dateReserved": "2026-07-30T09:28:09.393Z",
"dateUpdated": "2026-10-19T21:09:10.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68093 (GCVE-0-2026-68093)
Vulnerability from cvelistv5
Published
2026-08-10 11:58
Modified
2026-08-19 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug
If a vCPU stays scheduled out (or blocked) while the last pCPU it ran
on goes through a hotplug cycle (online->offline->online), and the vCPU
then resumes execution on the same pCPU, then it is possible for it to
run with an ASID that has now been assigned to a different vCPU,
resulting in stale TLB translations being used.
svm_enable_virtualization_cpu() resets asid_generation to 1 and sets
next_asid to max_asid + 1 on every CPU online event, including hotplug
cycles. Because next_asid starts beyond the pool boundary, the first
call to new_asid() after an online event always wraps the pool,
incrementing asid_generation to 2 and assigning ASIDs starting from
min_asid.
Consider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding
asid_generation=2 and ASID=N from before the hotplug event:
1. CPU-X goes offline and back online: asid_generation resets to 1,
next_asid = max_asid + 1.
2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping
the pool and consuming ASIDs starting from min_asid. Eventually
vCPU-B from a different VM is assigned asid_generation=2, ASID=N
— the same ASID that vCPU-A held before the hotplug.
3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb->cpu is
unchanged so the migration branch is skipped. Its saved
asid_generation=2 matches sd->asid_generation=2, so the generation
check silently passes and vCPU-A continues running with ASID=N —
the same ASID just freshly assigned to vCPU-B.
Both vCPUs from different VMs now run on CPU-X with the same ASID,
causing them to share NPT TLB entries and producing stale translations.
The collision manifests as a KVM internal error (Suberror: 1, emulation
failure). The NPT page fault reports a faulting GPA far outside the
VM's physical memory range — a sign of stale TLB translations being
used. KVM falls back to instruction emulation, which fails on
FPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not
implement.
Fix this by incrementing asid_generation instead of resetting it to 1
in svm_enable_virtualization_cpu(). On module load, asid_generation
starts at 0 (memset) and the increment produces 1, identical to the
old behaviour. On subsequent hotplug cycles the generation advances
beyond any value a vCPU previously observed on this CPU, so the
generation check in pre_svm_run() reliably forces new_asid() on every
vCPU after every hotplug cycle.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 774c47f1d78e373a6bd2964f4e278d1ce26c21cb Version: 774c47f1d78e373a6bd2964f4e278d1ce26c21cb Version: 774c47f1d78e373a6bd2964f4e278d1ce26c21cb Version: 774c47f1d78e373a6bd2964f4e278d1ce26c21cb Version: 774c47f1d78e373a6bd2964f4e278d1ce26c21cb Version: 774c47f1d78e373a6bd2964f4e278d1ce26c21cb |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2028b81321dc757b6875b99c10d908e349c141e2",
"status": "affected",
"version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
"versionType": "git"
},
{
"lessThan": "60283726f2845bd78b95efbd0e50b93944780477",
"status": "affected",
"version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
"versionType": "git"
},
{
"lessThan": "7508916b4b55d6f5ecc68cd09774dabd3a6b4440",
"status": "affected",
"version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
"versionType": "git"
},
{
"lessThan": "0f33b1c457c2199ed130b92cc2ff363a3f7b9415",
"status": "affected",
"version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
"versionType": "git"
},
{
"lessThan": "6b542d116acecb83a1ca34e8eace304cff6a4ec9",
"status": "affected",
"version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
"versionType": "git"
},
{
"lessThan": "25f744ffa0c8e799e06250ce2e618367b166b0d4",
"status": "affected",
"version": "774c47f1d78e373a6bd2964f4e278d1ce26c21cb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.21"
},
{
"lessThan": "2.6.21",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug\n\nIf a vCPU stays scheduled out (or blocked) while the last pCPU it ran\non goes through a hotplug cycle (online-\u003eoffline-\u003eonline), and the vCPU\nthen resumes execution on the same pCPU, then it is possible for it to\nrun with an ASID that has now been assigned to a different vCPU,\nresulting in stale TLB translations being used.\n\nsvm_enable_virtualization_cpu() resets asid_generation to 1 and sets\nnext_asid to max_asid + 1 on every CPU online event, including hotplug\ncycles. Because next_asid starts beyond the pool boundary, the first\ncall to new_asid() after an online event always wraps the pool,\nincrementing asid_generation to 2 and assigning ASIDs starting from\nmin_asid.\n\nConsider two vCPUs from different VMs, vCPU-A pinned to CPU-X holding\nasid_generation=2 and ASID=N from before the hotplug event:\n\n 1. CPU-X goes offline and back online: asid_generation resets to 1,\n next_asid = max_asid + 1.\n\n 2. One or more vCPUs migrate to CPU-X and call new_asid(), wrapping\n the pool and consuming ASIDs starting from min_asid. Eventually\n vCPU-B from a different VM is assigned asid_generation=2, ASID=N\n \u2014 the same ASID that vCPU-A held before the hotplug.\n\n 3. vCPU-A enters pre_svm_run() on CPU-X: current_vmcb-\u003ecpu is\n unchanged so the migration branch is skipped. Its saved\n asid_generation=2 matches sd-\u003easid_generation=2, so the generation\n check silently passes and vCPU-A continues running with ASID=N \u2014\n the same ASID just freshly assigned to vCPU-B.\n\nBoth vCPUs from different VMs now run on CPU-X with the same ASID,\ncausing them to share NPT TLB entries and producing stale translations.\n\nThe collision manifests as a KVM internal error (Suberror: 1, emulation\nfailure). The NPT page fault reports a faulting GPA far outside the\nVM\u0027s physical memory range \u2014 a sign of stale TLB translations being\nused. KVM falls back to instruction emulation, which fails on\nFPU/XSave instructions (XRSTOR, STMXCSR) that the emulator does not\nimplement.\n\nFix this by incrementing asid_generation instead of resetting it to 1\nin svm_enable_virtualization_cpu(). On module load, asid_generation\nstarts at 0 (memset) and the increment produces 1, identical to the\nold behaviour. On subsequent hotplug cycles the generation advances\nbeyond any value a vCPU previously observed on this CPU, so the\ngeneration check in pre_svm_run() reliably forces new_asid() on every\nvCPU after every hotplug cycle."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:15.060Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2028b81321dc757b6875b99c10d908e349c141e2"
},
{
"url": "https://git.kernel.org/stable/c/60283726f2845bd78b95efbd0e50b93944780477"
},
{
"url": "https://git.kernel.org/stable/c/7508916b4b55d6f5ecc68cd09774dabd3a6b4440"
},
{
"url": "https://git.kernel.org/stable/c/0f33b1c457c2199ed130b92cc2ff363a3f7b9415"
},
{
"url": "https://git.kernel.org/stable/c/6b542d116acecb83a1ca34e8eace304cff6a4ec9"
},
{
"url": "https://git.kernel.org/stable/c/25f744ffa0c8e799e06250ce2e618367b166b0d4"
}
],
"title": "KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68093",
"datePublished": "2026-08-10T11:58:05.933Z",
"dateReserved": "2026-07-30T09:28:09.367Z",
"dateUpdated": "2026-08-19T16:29:15.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53061 (GCVE-0-2026-53061)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix dirty mapping checking in passthrough mode switching
As mentioned in commit 9b1cc9f251af ("dm cache: share cache-metadata
object across inactive and active DM tables"), dm-cache assumed table
reload occurs after suspension, while LVM's table preload breaks this
assumption. The dirty mapping check for passthrough mode was designed
around this assumption and is performed during table creation, causing
the check to fail with preload while metadata updates are ongoing. This
risks loading dirty mappings into passthrough mode, resulting in data
loss.
Reproduce steps:
1. Create a writeback cache with zero migration_threshold to produce
dirty mappings
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
dmsetup create cdata --table "0 131072 linear /dev/sdc 8192"
dmsetup create corig --table "0 262144 linear /dev/sdc 262144"
dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writeback smq \
2 migration_threshold 0"
2. Preload a table in passthrough mode
dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0"
3. Write to the first cache block to make it dirty
fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \
--direct=1 --size=64k
4. Resume the inactive table. Now it's possible to load the dirty block
into passthrough mode.
dmsetup resume cache
Fix by moving the checks to the preresume phase to support table
preloading. Also remove the unused function dm_cache_metadata_all_clean.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-metadata.c",
"drivers/md/dm-cache-metadata.h",
"drivers/md/dm-cache-target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c2e86f647561fcf5e1c6eba7d75e9e0c4299c94d",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "5c98a3f1d7a554c9e920aa31daf92af6b5bbb8cc",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "1443c32f24d6d8bcdf4beceef2afc09290b98717",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "12105c7f18375d7615dad7605d89eadae7eb12a6",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "bd5a2c1018938e6b32670728bdb32a3f0efff00f",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "21c503d60a257e54ca3ac58e2721bd24501d5bde",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "01b22656d8a68dbeae59f8b80866e7b11936b20a",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "322586745bd1a0e5f3559fd1635fdeb4dbd1d6b8",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-metadata.c",
"drivers/md/dm-cache-metadata.h",
"drivers/md/dm-cache-target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix dirty mapping checking in passthrough mode switching\n\nAs mentioned in commit 9b1cc9f251af (\"dm cache: share cache-metadata\nobject across inactive and active DM tables\"), dm-cache assumed table\nreload occurs after suspension, while LVM\u0027s table preload breaks this\nassumption. The dirty mapping check for passthrough mode was designed\naround this assumption and is performed during table creation, causing\nthe check to fail with preload while metadata updates are ongoing. This\nrisks loading dirty mappings into passthrough mode, resulting in data\nloss.\n\nReproduce steps:\n\n1. Create a writeback cache with zero migration_threshold to produce\n dirty mappings\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 262144 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \"0 262144 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writeback smq \\\n2 migration_threshold 0\"\n\n2. Preload a table in passthrough mode\n\ndmsetup reload cache --table \"0 262144 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0\"\n\n3. Write to the first cache block to make it dirty\n\nfio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \\\n--direct=1 --size=64k\n\n4. Resume the inactive table. Now it\u0027s possible to load the dirty block\n into passthrough mode.\n\ndmsetup resume cache\n\nFix by moving the checks to the preresume phase to support table\npreloading. Also remove the unused function dm_cache_metadata_all_clean."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:05.522Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c2e86f647561fcf5e1c6eba7d75e9e0c4299c94d"
},
{
"url": "https://git.kernel.org/stable/c/5c98a3f1d7a554c9e920aa31daf92af6b5bbb8cc"
},
{
"url": "https://git.kernel.org/stable/c/1443c32f24d6d8bcdf4beceef2afc09290b98717"
},
{
"url": "https://git.kernel.org/stable/c/12105c7f18375d7615dad7605d89eadae7eb12a6"
},
{
"url": "https://git.kernel.org/stable/c/bd5a2c1018938e6b32670728bdb32a3f0efff00f"
},
{
"url": "https://git.kernel.org/stable/c/21c503d60a257e54ca3ac58e2721bd24501d5bde"
},
{
"url": "https://git.kernel.org/stable/c/01b22656d8a68dbeae59f8b80866e7b11936b20a"
},
{
"url": "https://git.kernel.org/stable/c/322586745bd1a0e5f3559fd1635fdeb4dbd1d6b8"
}
],
"title": "dm cache: fix dirty mapping checking in passthrough mode switching",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53061",
"datePublished": "2026-06-24T16:30:05.522Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-06-24T16:30:05.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64317 (GCVE-0-2026-64317)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
isofs: bound Rock Ridge symlink components to the SL record
get_symlink_chunk() and the SL handling in
parse_rock_ridge_inode_internal() walk the variable-length components of
a Rock Ridge "SL" (symbolic link) record. Each component is a two-byte
header (flags, len) followed by len bytes of text, so it occupies
slp->len + 2 bytes. Both loops read slp->len and advance to the next
component, and get_symlink_chunk() additionally does
memcpy(rpnt, slp->text, slp->len), but neither checks that the component
lies within the SL record before dereferencing it.
A crafted SL record whose component declares a len that runs past the
record (rr->len) therefore triggers an out-of-bounds read of up to 255
bytes. When the record sits at the tail of its backing buffer - for
example a small kmalloc()ed continuation block reached through a CE
record - the read crosses the allocation; get_symlink_chunk() then
copies the out-of-bounds bytes into the symlink body returned to user
space by readlink(), disclosing adjacent kernel memory.
ISO 9660 images are routinely mounted from untrusted removable media -
desktop environments auto-mount them (e.g. via udisks2) without
CAP_SYS_ADMIN - so the record contents are attacker-controlled.
Reject any component that does not fit in the remaining record bytes
before using it. In get_symlink_chunk() return NULL, like the existing
output-buffer (plimit) checks, so a malformed record makes readlink()
fail with -EIO rather than silently returning a truncated target; in
parse_rock_ridge_inode_internal() stop the inode-size walk.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:23:35.529Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64317",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:38:57.230320Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:23.435Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/isofs/rock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1015e1c4b2fadd9c09704e24738e46598778c869",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "36fe7d25dbc40da0c6b1dd4513a4f69ac6164eee",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a22cb6bb54dc167047ea9e70d97dfbc2c15649e3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b736b12108fd116c41777628f5a333791604df26",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6bf41db09ef935d76fcc84ccf213b42c18de95ee",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b5699642640d6cff357638738c5293985cd5a53d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9830725078c8483c6831ec10222ae724806ea36b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5fa1d6a5ec2356d2107dead614437c66fa7138b1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/isofs/rock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: bound Rock Ridge symlink components to the SL record\n\nget_symlink_chunk() and the SL handling in\nparse_rock_ridge_inode_internal() walk the variable-length components of\na Rock Ridge \"SL\" (symbolic link) record. Each component is a two-byte\nheader (flags, len) followed by len bytes of text, so it occupies\nslp-\u003elen + 2 bytes. Both loops read slp-\u003elen and advance to the next\ncomponent, and get_symlink_chunk() additionally does\nmemcpy(rpnt, slp-\u003etext, slp-\u003elen), but neither checks that the component\nlies within the SL record before dereferencing it.\n\nA crafted SL record whose component declares a len that runs past the\nrecord (rr-\u003elen) therefore triggers an out-of-bounds read of up to 255\nbytes. When the record sits at the tail of its backing buffer - for\nexample a small kmalloc()ed continuation block reached through a CE\nrecord - the read crosses the allocation; get_symlink_chunk() then\ncopies the out-of-bounds bytes into the symlink body returned to user\nspace by readlink(), disclosing adjacent kernel memory.\n\nISO 9660 images are routinely mounted from untrusted removable media -\ndesktop environments auto-mount them (e.g. via udisks2) without\nCAP_SYS_ADMIN - so the record contents are attacker-controlled.\n\nReject any component that does not fit in the remaining record bytes\nbefore using it. In get_symlink_chunk() return NULL, like the existing\noutput-buffer (plimit) checks, so a malformed record makes readlink()\nfail with -EIO rather than silently returning a truncated target; in\nparse_rock_ridge_inode_internal() stop the inode-size walk."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An active unprivileged local user can use UDisks2 to mount an attacker-created ISO image and invoke readlink(); ISOFS is not directly mountable through an unprivileged user namespace.\nAC:L - The attacker fully controls the SL component length and CE continuation layout, reliably triggering the out-of-bounds read without a race or an uncontrollable condition.\nPR:L - Direct mounting requires CAP_SYS_ADMIN in the initial user namespace, but common UDisks2 policies permit an active ordinary desktop user to create a loop device and mount the image without administrator authentication.\nUI:N - The local attacker can mount the crafted image and read the symlink themselves, requiring no action by another user.\nS:U - The disclosure and possible crash occur within the host kernel\u0027s existing security authority and do not cross a virtualization or comparable scope boundary.\nC:H - Up to 255 bytes per malformed SL component are copied from beyond a controllably sized kernel allocation into readlink() output; repeated components or attempts can disclose kernel pointers, secrets, and substantial adjacent heap data.\nI:N - The flaw performs an out-of-bounds source read while all destination writes remain bounded to the symlink page, providing no kernel-memory overwrite or control-flow modification primitive.\nA:H - The out-of-bounds memcpy can cross into inaccessible or allocator-guarded memory and cause a kernel oops or panic, and a local attacker can trigger repeated allocations and reads."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:17.683Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1015e1c4b2fadd9c09704e24738e46598778c869"
},
{
"url": "https://git.kernel.org/stable/c/36fe7d25dbc40da0c6b1dd4513a4f69ac6164eee"
},
{
"url": "https://git.kernel.org/stable/c/a22cb6bb54dc167047ea9e70d97dfbc2c15649e3"
},
{
"url": "https://git.kernel.org/stable/c/b736b12108fd116c41777628f5a333791604df26"
},
{
"url": "https://git.kernel.org/stable/c/6bf41db09ef935d76fcc84ccf213b42c18de95ee"
},
{
"url": "https://git.kernel.org/stable/c/b5699642640d6cff357638738c5293985cd5a53d"
},
{
"url": "https://git.kernel.org/stable/c/9830725078c8483c6831ec10222ae724806ea36b"
},
{
"url": "https://git.kernel.org/stable/c/5fa1d6a5ec2356d2107dead614437c66fa7138b1"
}
],
"title": "isofs: bound Rock Ridge symlink components to the SL record",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64317",
"datePublished": "2026-07-25T08:49:47.067Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-10-19T20:38:23.435Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74537 (GCVE-0-2026-74537)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: hold sk properly in iso_conn_ready
sk deref in iso_conn_ready must be done either under conn->lock, or
holding a refcount, to avoid concurrent close. conn->sk is currently
accessed without either:
[Task 1] [Task 2]
iso_sock_release
iso_conn_ready
sk = conn->sk
lock_sock(sk)
conn->sk = NULL
lock_sock(sk)
release_sock(sk)
iso_sock_kill(sk)
UAF on sk deref
Fix possible UAF by holding sk refcount in iso_conn_ready(). Also
recheck after lock_sock that the socket is still valid. Adjust locking
so conn->sk is cleared only under lock_sock.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74537",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:33.051138Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:54.154Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "44590dc53c9e949d2fed399a571a89c3d7d0b245",
"status": "affected",
"version": "27c24fda62b601d6f9ca5e992502578c4310876f",
"versionType": "git"
},
{
"lessThan": "99b65f0ea3370c13687ff870330c425b6ca44e89",
"status": "affected",
"version": "27c24fda62b601d6f9ca5e992502578c4310876f",
"versionType": "git"
},
{
"lessThan": "4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5",
"status": "affected",
"version": "27c24fda62b601d6f9ca5e992502578c4310876f",
"versionType": "git"
},
{
"lessThan": "1308d72903d792d10b82bc4ef08b8a4452308b04",
"status": "affected",
"version": "27c24fda62b601d6f9ca5e992502578c4310876f",
"versionType": "git"
},
{
"lessThan": "0d255e63fcf3f13a570d7ac11678fa1164ac015c",
"status": "affected",
"version": "27c24fda62b601d6f9ca5e992502578c4310876f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: hold sk properly in iso_conn_ready\n\nsk deref in iso_conn_ready must be done either under conn-\u003elock, or\nholding a refcount, to avoid concurrent close. conn-\u003esk is currently\naccessed without either:\n\n [Task 1] [Task 2]\n iso_sock_release\n iso_conn_ready\n sk = conn-\u003esk\n lock_sock(sk)\n conn-\u003esk = NULL\n lock_sock(sk)\n release_sock(sk)\n iso_sock_kill(sk)\n UAF on sk deref\n\nFix possible UAF by holding sk refcount in iso_conn_ready(). Also\nrecheck after lock_sock that the socket is still valid. Adjust locking\nso conn-\u003esk is cleared only under lock_sock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is in the Bluetooth ISO stack; iso_conn_ready runs from HCI connection-confirmation events (CIS/BIS/PA sync) driven by LE isochronous traffic from Bluetooth peers within radio range, which is an adjacent attack surface (phones, earbuds, automotive, embedded).\nAC:L - This is a use-after-free race between iso_conn_ready and iso_sock_release/iso_sock_kill; an attacker who controls both an ISO socket close and concurrent HCI completion (e.g., dual-thread connect/close or rapid adjacent CIS/BIS establish-teardown) can reliably trigger it without uncontrollable conditions.\nPR:N - Exploitation requires no elevated credentials on the victim: HCI events are processed for any Bluetooth-enabled device in range, and the racing socket close can occur from automatic stack/daemon teardown during connection setup without the victim performing privileged local actions.\nUI:N - No victim interaction is required when the OS Bluetooth stack (e.g., LE Audio on Android phones or bluetoothd on Linux) automatically manages ISO sockets during pairing, reconnection, or broadcast sync while processing peer-initiated CIS/BIS traffic.\nS:U - The UAF corrupts kernel socket memory and can enable local privilege escalation within the kernel; it does not cross a VM, container, or IOMMU security boundary, so scope remains unchanged.\nC:H - Use-after-free on struct sock after iso_sock_kill frees the socket lets an attacker dereference attacker-influenced freed heap memory, enabling arbitrary kernel memory disclosure via heap grooming and reuse of the sock object.\nI:H - The UAF touches sk-\u003esk_state and sk-\u003esk_state_change during iso_sock_ready on a freed sock, providing a standard kernel heap corruption primitive that can be leveraged for arbitrary write and control-flow hijack.\nA:H - Concurrent iso_sock_kill and iso_conn_ready can dereference freed socket memory, causing kernel oops/panic from invalid lock_sock/sk_state access; UAF in the Bluetooth ISO path is inherently a high-availability risk even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:50.544Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/44590dc53c9e949d2fed399a571a89c3d7d0b245"
},
{
"url": "https://git.kernel.org/stable/c/99b65f0ea3370c13687ff870330c425b6ca44e89"
},
{
"url": "https://git.kernel.org/stable/c/4e9b5e8669b3602a4e01b6d1e9539b72e42c84d5"
},
{
"url": "https://git.kernel.org/stable/c/1308d72903d792d10b82bc4ef08b8a4452308b04"
},
{
"url": "https://git.kernel.org/stable/c/0d255e63fcf3f13a570d7ac11678fa1164ac015c"
}
],
"title": "Bluetooth: ISO: hold sk properly in iso_conn_ready",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74537",
"datePublished": "2026-08-15T12:27:49.668Z",
"dateReserved": "2026-08-15T05:44:03.913Z",
"dateUpdated": "2026-10-21T12:45:50.544Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80534 (GCVE-0-2026-80534)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-08-27 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix ilock leak on error in xfs_dq_get_next_id
xfs_dq_get_next_id() takes the quota inode ILOCK before calling
xfs_iread_extents(). If xfs_iread_extents() fails, the function returns
immediately without releasing the lock, leaking the quota inode ILOCK.
This can leave the quota inode locked and cause subsequent quota
operations to hang.
Fix this by jumping to a common unlock path on error instead of returning
directly.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bda250dbaf39f67f8910e183853e4e6a9e5ce899 Version: bda250dbaf39f67f8910e183853e4e6a9e5ce899 Version: bda250dbaf39f67f8910e183853e4e6a9e5ce899 Version: bda250dbaf39f67f8910e183853e4e6a9e5ce899 Version: bda250dbaf39f67f8910e183853e4e6a9e5ce899 Version: bda250dbaf39f67f8910e183853e4e6a9e5ce899 Version: bda250dbaf39f67f8910e183853e4e6a9e5ce899 Version: bda250dbaf39f67f8910e183853e4e6a9e5ce899 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_dquot.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e4c05ebd01e910bccd4f7e9517c7353982e27763",
"status": "affected",
"version": "bda250dbaf39f67f8910e183853e4e6a9e5ce899",
"versionType": "git"
},
{
"lessThan": "6401b99a285cd4cfb2949ba44675541b91ad7e4f",
"status": "affected",
"version": "bda250dbaf39f67f8910e183853e4e6a9e5ce899",
"versionType": "git"
},
{
"lessThan": "0865e4fca02e418fd2423fae9a887dee87b778a1",
"status": "affected",
"version": "bda250dbaf39f67f8910e183853e4e6a9e5ce899",
"versionType": "git"
},
{
"lessThan": "ed8bfb43de71213cfdbbe833b2c2817250e18b1a",
"status": "affected",
"version": "bda250dbaf39f67f8910e183853e4e6a9e5ce899",
"versionType": "git"
},
{
"lessThan": "e270d539b8a2e0cb8f617fee47a7b083c0088361",
"status": "affected",
"version": "bda250dbaf39f67f8910e183853e4e6a9e5ce899",
"versionType": "git"
},
{
"lessThan": "514a5d42d4188fc5f1499a8d654c717ebf981193",
"status": "affected",
"version": "bda250dbaf39f67f8910e183853e4e6a9e5ce899",
"versionType": "git"
},
{
"lessThan": "08bed2b67d2ee79d3e138c344d8dcfa4c9b26a38",
"status": "affected",
"version": "bda250dbaf39f67f8910e183853e4e6a9e5ce899",
"versionType": "git"
},
{
"lessThan": "63320a0f70f66f311f4bccff3af0719c2119f46c",
"status": "affected",
"version": "bda250dbaf39f67f8910e183853e4e6a9e5ce899",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_dquot.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix ilock leak on error in xfs_dq_get_next_id\n\nxfs_dq_get_next_id() takes the quota inode ILOCK before calling\nxfs_iread_extents(). If xfs_iread_extents() fails, the function returns\nimmediately without releasing the lock, leaking the quota inode ILOCK.\nThis can leave the quota inode locked and cause subsequent quota\noperations to hang.\n\nFix this by jumping to a common unlock path on error instead of returning\ndirectly."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:40:03.205Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e4c05ebd01e910bccd4f7e9517c7353982e27763"
},
{
"url": "https://git.kernel.org/stable/c/6401b99a285cd4cfb2949ba44675541b91ad7e4f"
},
{
"url": "https://git.kernel.org/stable/c/0865e4fca02e418fd2423fae9a887dee87b778a1"
},
{
"url": "https://git.kernel.org/stable/c/ed8bfb43de71213cfdbbe833b2c2817250e18b1a"
},
{
"url": "https://git.kernel.org/stable/c/e270d539b8a2e0cb8f617fee47a7b083c0088361"
},
{
"url": "https://git.kernel.org/stable/c/514a5d42d4188fc5f1499a8d654c717ebf981193"
},
{
"url": "https://git.kernel.org/stable/c/08bed2b67d2ee79d3e138c344d8dcfa4c9b26a38"
},
{
"url": "https://git.kernel.org/stable/c/63320a0f70f66f311f4bccff3af0719c2119f46c"
}
],
"title": "xfs: fix ilock leak on error in xfs_dq_get_next_id",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80534",
"datePublished": "2026-08-26T14:37:10.378Z",
"dateReserved": "2026-08-26T14:34:25.764Z",
"dateUpdated": "2026-08-27T12:40:03.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53059 (GCVE-0-2026-53059)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-09-04 12:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm log: fix out-of-bounds write due to region_count overflow
The local variable region_count in create_log_context() is declared as
unsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit).
When a device-mapper target has a sufficiently large ti->len with a small
region_size, the division result can exceed UINT_MAX. The truncated
value is then used to calculate bitset_size, causing clean_bits,
sync_bits, and recovering_bits to be allocated far smaller than needed
for the actual number of regions.
Subsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use
region indices derived from the full untruncated region space, causing
out-of-bounds writes to kernel heap memory allocated by vmalloc.
This can be reproduced by creating a mirror target whose region_count
overflows 32 bits:
dmsetup create bigzero --table '0 8589934594 zero'
dmsetup create mymirror --table '0 8589934594 mirror \
core 2 2 nosync 2 /dev/mapper/bigzero 0 \
/dev/mapper/bigzero 0'
The status output confirms the truncation (sync_count=1 instead of
4294967297, because 0x100000001 was truncated to 1):
$ dmsetup status mymirror
0 8589934594 mirror 2 254:1 254:1 1/4294967297 ...
This leads to a kernel crash in core_in_sync:
BUG: scheduling while atomic: (udev-worker)/9150/0x00000000
RIP: 0010:core_in_sync+0x14/0x30 [dm_log]
CR2: 0000000000000008
Fixing recursive fault but reboot is needed!
Fix by widening the local region_count to sector_t and adding an
explicit overflow check before the value is assigned to lc->region_count.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.39.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.98.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_extras_rt_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.159.1.rt56.1311.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.159.1.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.147.1.rt7.488.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.147.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.200.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.200.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.206.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.206.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.158.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.158.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.30.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.188.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.188.1.rt14.473.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.135.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s device-mapper log (dm log) component. A local attacker could exploit an integer overflow vulnerability where a 64-bit value is truncated to 32 bits, leading to undersized memory allocations. This allows for out-of-bounds writes to kernel memory during log operations. Successful exploitation of this flaw can cause a kernel crash, resulting in a Denial of Service (DoS) for the affected system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T12:04:41.314Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53059"
},
{
"name": "RHBZ#2492277",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492277"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53059.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:61692"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:63189"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55445"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45114"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59662"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56574"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45192"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45115"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47248"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53989"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:52649"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45116"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59663"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:61692: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:63189: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:55445: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:45114: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:59662: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:56574: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:45192: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:45115: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:47248: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:53989: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:52649: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:45116: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:59663: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: dm log: fix out-of-bounds write due to region_count overflow",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "44ab8875ae4a2842bde2d756bed195d375e0debb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "defe483e47173768c227532694dc78cb65db5f09",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3ec74da927b4e171a6fc0e77b1188ba4d019af51",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d4ac87567f86a55c3c92e9a5144dcd943a9772a1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "12bd5b88e91a02785244ff1d20fb157e96e9cdc8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b455903eed4558982be0811f5b7f44f6bbc4ff57",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4ec8323b9f0764a14d532b1ae9b87f8a9fecb867",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c20e36b7631d83e7535877f08af8b0af72c44b1a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm log: fix out-of-bounds write due to region_count overflow\n\nThe local variable region_count in create_log_context() is declared as\nunsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit).\nWhen a device-mapper target has a sufficiently large ti-\u003elen with a small\nregion_size, the division result can exceed UINT_MAX. The truncated\nvalue is then used to calculate bitset_size, causing clean_bits,\nsync_bits, and recovering_bits to be allocated far smaller than needed\nfor the actual number of regions.\n\nSubsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use\nregion indices derived from the full untruncated region space, causing\nout-of-bounds writes to kernel heap memory allocated by vmalloc.\n\nThis can be reproduced by creating a mirror target whose region_count\noverflows 32 bits:\n\n dmsetup create bigzero --table \u00270 8589934594 zero\u0027\n dmsetup create mymirror --table \u00270 8589934594 mirror \\\n core 2 2 nosync 2 /dev/mapper/bigzero 0 \\\n /dev/mapper/bigzero 0\u0027\n\nThe status output confirms the truncation (sync_count=1 instead of\n4294967297, because 0x100000001 was truncated to 1):\n\n $ dmsetup status mymirror\n 0 8589934594 mirror 2 254:1 254:1 1/4294967297 ...\n\nThis leads to a kernel crash in core_in_sync:\n\n BUG: scheduling while atomic: (udev-worker)/9150/0x00000000\n RIP: 0010:core_in_sync+0x14/0x30 [dm_log]\n CR2: 0000000000000008\n Fixing recursive fault but reboot is needed!\n\nFix by widening the local region_count to sector_t and adding an\nexplicit overflow check before the value is assigned to lc-\u003eregion_count."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:04.210Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/44ab8875ae4a2842bde2d756bed195d375e0debb"
},
{
"url": "https://git.kernel.org/stable/c/defe483e47173768c227532694dc78cb65db5f09"
},
{
"url": "https://git.kernel.org/stable/c/3ec74da927b4e171a6fc0e77b1188ba4d019af51"
},
{
"url": "https://git.kernel.org/stable/c/d4ac87567f86a55c3c92e9a5144dcd943a9772a1"
},
{
"url": "https://git.kernel.org/stable/c/12bd5b88e91a02785244ff1d20fb157e96e9cdc8"
},
{
"url": "https://git.kernel.org/stable/c/b455903eed4558982be0811f5b7f44f6bbc4ff57"
},
{
"url": "https://git.kernel.org/stable/c/4ec8323b9f0764a14d532b1ae9b87f8a9fecb867"
},
{
"url": "https://git.kernel.org/stable/c/c20e36b7631d83e7535877f08af8b0af72c44b1a"
}
],
"title": "dm log: fix out-of-bounds write due to region_count overflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53059",
"datePublished": "2026-06-24T16:30:04.210Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-09-04T12:04:41.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64355 (GCVE-0-2026-64355)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject fragmented frames in devmap
Devmap broadcast redirects clone the packet for all but the last
destination.
For native XDP, that clone path copies only the linear xdp_frame data,
while fragmented frames keep skb_shared_info in tailroom outside the
linear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but
without valid frag metadata, and the later free path can interpret
uninitialized tail data as skb_shared_info, leading to an out-of-bounds
access during frame return.
Reject fragmented native XDP frames in dev_map_enqueue_clone().
Add the same restriction to the generic XDP clone path in
dev_map_redirect_clone(). Generic XDP represents fragmented packets as
nonlinear skbs, and rejecting them here keeps clone-based broadcast
support aligned between native and generic XDP.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64355",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:39:19.688076Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:24.590Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/devmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "47baddc856ae7e93a565dd9deeb797999b179466",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "07a4c11ee8ef4abcb39d922e9e410ae269671cdf",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "bccbab36ff228e0825eb85d9b0f9b8434cd0a399",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "c5b4f5efcb55c1af3fe44ff712d31b7fb098a831",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "a9bb2d9c798cb62a4050a991c27b752770c33afe",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "51d07c12ca411e692c424ecdabf077f1e61a61be",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "aa496720618f1a6054f1c870bf10b4f6c99bf656",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/devmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject fragmented frames in devmap\n\nDevmap broadcast redirects clone the packet for all but the last\ndestination.\n\nFor native XDP, that clone path copies only the linear xdp_frame data,\nwhile fragmented frames keep skb_shared_info in tailroom outside the\nlinear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but\nwithout valid frag metadata, and the later free path can interpret\nuninitialized tail data as skb_shared_info, leading to an out-of-bounds\naccess during frame return.\n\nReject fragmented native XDP frames in dev_map_enqueue_clone().\n\nAdd the same restriction to the generic XDP clone path in\ndev_map_redirect_clone(). Generic XDP represents fragmented packets as\nnonlinear skbs, and rejecting them here keeps clone-based broadcast\nsupport aligned between native and generic XDP."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote peer can send an oversized packet that a fragment-capable NIC represents as a multi-buffer XDP frame, reaching the vulnerable devmap broadcast clone path on a configured forwarding host.\nAC:L - No race or uncontrollable timing condition is required; fragmented packets reliably enter the faulty clone path and can be sent repeatedly.\nPR:N - Although initial-namespace CAP_BPF and CAP_NET_ADMIN are needed to configure the XDP deployment, the attacker sending packets through the already-configured unauthenticated data path needs no privileges.\nUI:N - Packet reception and XDP processing occur automatically without victim action.\nS:U - The corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other distinct boundary.\nC:H - Uninitialized fragment descriptors are consumed as page references and can be used by scatter-gather transmitters for unintended DMA mappings, potentially exposing arbitrary kernel memory.\nI:H - An uninitialized fragment count can overrun fixed-size driver arrays, while bogus page references can cause invalid refcount decrements, premature frees, and exploitable kernel memory corruption.\nA:H - Invalid fragment metadata can fault during DMA mapping, transmission, or frame return and cause a kernel oops or panic; an attacker can trigger this repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:01.161Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/47baddc856ae7e93a565dd9deeb797999b179466"
},
{
"url": "https://git.kernel.org/stable/c/07a4c11ee8ef4abcb39d922e9e410ae269671cdf"
},
{
"url": "https://git.kernel.org/stable/c/bccbab36ff228e0825eb85d9b0f9b8434cd0a399"
},
{
"url": "https://git.kernel.org/stable/c/c5b4f5efcb55c1af3fe44ff712d31b7fb098a831"
},
{
"url": "https://git.kernel.org/stable/c/a9bb2d9c798cb62a4050a991c27b752770c33afe"
},
{
"url": "https://git.kernel.org/stable/c/51d07c12ca411e692c424ecdabf077f1e61a61be"
},
{
"url": "https://git.kernel.org/stable/c/aa496720618f1a6054f1c870bf10b4f6c99bf656"
}
],
"title": "bpf: Reject fragmented frames in devmap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64355",
"datePublished": "2026-07-25T08:50:13.410Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-10-19T20:38:24.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53264 (GCVE-0-2026-53264)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-15 01:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_api: use RCU with deferred freeing for action lifecycle
When NEWTFILTER and DELFILTER are run concurrently it is possible to create a
race with an associated action.
Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:
0: mutex_lock() <-- holds the idr lock
0: rcu_read_lock()
0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR)
0: mutex_unlock() <-- releases the idr lock
1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held
1: idr_remove(idr, index) <-- Action removed from IDR
1: mutex_unlock() <-- mutex released allowing us to delete the action
1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral
0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory
This patch fixes the race condition between NEWTFILTER and DELFILTER by
adding struct rcu_head to tc_action used in the deferral and introducing a
call_rcu() in the delete path to defer the final kfree().
Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu")
but also modernization/simplification to directly use kfree_rcu().
Let's illustrate the new restored code path:
0: rcu_read_lock()
1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held
1: idr_remove(idr, index)
1: mutex_unlock()
1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period
0: p = idr_find(idr, index)
0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0
1: rcu_read_unlock() <-- release so freeing can run after grace period
After CPU1 calls idr_remove(), the object is no longer reachable through the IDR.
CPU0's subsequent idr_find() will return NULL, and even if it still held a
stale pointer, the immediate kfree() is now deferred until after the RCU grace
period, so no UAF can occur.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da Version: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da Version: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da Version: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da Version: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da Version: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da Version: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da Version: d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53264",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T03:55:26.363824Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:15:51.295Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://starlabs.sg/blog/2026/07-when-ai-makes-0-days-feel-like-n-days/"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:23:06.219Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/act_api.h",
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "98b2e40879abf0245be5a5b7af69e0f6ff524ac3",
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"versionType": "git"
},
{
"lessThan": "18af5d2ef0c4f65787fd1280c8b23286b9f2a835",
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"versionType": "git"
},
{
"lessThan": "1f1b98fea6b9ea30507d0f2fbff6750292d097e2",
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"versionType": "git"
},
{
"lessThan": "8b136f18ac4b2ace5aaad3305b3f8a5d8165a009",
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"versionType": "git"
},
{
"lessThan": "5dd51e09020c65aa53cf128e5e3517cd53b3c113",
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"versionType": "git"
},
{
"lessThan": "b60e9391142e983fab2be53497aa8f71fdd09cd5",
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"versionType": "git"
},
{
"lessThan": "91d105d2cbe002f9c7b43a6183adedc37e1da1f7",
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"versionType": "git"
},
{
"lessThan": "5057e1aca011e51ef51498c940ef96f3d3e8a305",
"status": "affected",
"version": "d7fb60b9cafb982cb2e46a267646a8dfd4f2e5da",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/act_api.h",
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_api: use RCU with deferred freeing for action lifecycle\n\nWhen NEWTFILTER and DELFILTER are run concurrently it is possible to create a\nrace with an associated action.\n\nLet\u0027s illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER:\n\n 0: mutex_lock() \u003c-- holds the idr lock\n 0: rcu_read_lock()\n 0: p = idr_find(idr, index) \u003c-- action p is valid (RCU protects IDR)\n 0: mutex_unlock() \u003c-- releases the idr lock\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\n 1: idr_remove(idr, index) \u003c-- Action removed from IDR\n 1: mutex_unlock() \u003c-- mutex released allowing us to delete the action\n 1: tcf_action_cleanup(p); kfree(p) \u003c-- Kfrees p immediately, no deferral\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- ouch, UAF p points to freed memory\n\nThis patch fixes the race condition between NEWTFILTER and DELFILTER by\nadding struct rcu_head to tc_action used in the deferral and introducing a\ncall_rcu() in the delete path to defer the final kfree().\n\nNote: this is a revert of commit d7fb60b9cafb (\"net_sched: get rid of tcfa_rcu\")\nbut also modernization/simplification to directly use kfree_rcu().\n\nLet\u0027s illustrate the new restored code path:\n\n 0: rcu_read_lock()\n 1: refcount_dec_and_mutex_lock() \u003c-- refcnt 1-\u003e0, mutex held\n 1: idr_remove(idr, index)\n 1: mutex_unlock()\n 1: call_rcu(\u0026p-\u003etcfa_rcu, tcf_action_rcu_free) \u003c-- defer kfree after grace period\n 0: p = idr_find(idr, index)\n 0: refcount_inc_not_zero(\u0026p-\u003etcfa_refcnt) \u003c-- fails, refcnt already 0\n 1: rcu_read_unlock() \u003c-- release so freeing can run after grace period\n\nAfter CPU1 calls idr_remove(), the object is no longer reachable through the IDR.\nCPU0\u0027s subsequent idr_find() will return NULL, and even if it still held a\nstale pointer, the immediate kfree() is now deferred until after the RCU grace\nperiod, so no UAF can occur."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local rtnetlink `RTM_NEWTFILTER`/`RTM_DELTFILTER` traffic-control netlink messages, not by remote packet input.\nAC:L - The race is attacker-controlled because the same local actor can issue concurrent filter creation and deletion operations against the same action index. No external victim timing or rare environmental condition is required.\nPR:L - The operations require `CAP_NET_ADMIN` for non-GET rtnetlink messages, but traffic control is reachable with `CAP_NET_ADMIN` inside a user-created network namespace. Under the provided kernel guidance, this is Low privileges rather than High.\nUI:N - No victim interaction is needed; exploitation consists of the attacker sending crafted concurrent rtnetlink requests.\nS:U - The impact is within the kernel security authority and is a standard local kernel memory-corruption/privilege-escalation class issue. It does not cross a VM, IOMMU, or separate authorization scope boundary.\nC:H - The bug is a use-after-free of a `tc_action` object during action lookup/refcounting. A kernel heap UAF can be shaped into disclosure primitives, so confidentiality impact is High.\nI:H - The stale freed action pointer can be reused after heap reallocation and then modified/dereferenced through refcount, bind count, ops, and action lifecycle fields. This is memory corruption that can plausibly support arbitrary write or code execution, so integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or mutate freed/reused kernel memory and can crash or oops the kernel. Availability impact is therefore High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:41.215Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/98b2e40879abf0245be5a5b7af69e0f6ff524ac3"
},
{
"url": "https://git.kernel.org/stable/c/18af5d2ef0c4f65787fd1280c8b23286b9f2a835"
},
{
"url": "https://git.kernel.org/stable/c/1f1b98fea6b9ea30507d0f2fbff6750292d097e2"
},
{
"url": "https://git.kernel.org/stable/c/8b136f18ac4b2ace5aaad3305b3f8a5d8165a009"
},
{
"url": "https://git.kernel.org/stable/c/5dd51e09020c65aa53cf128e5e3517cd53b3c113"
},
{
"url": "https://git.kernel.org/stable/c/b60e9391142e983fab2be53497aa8f71fdd09cd5"
},
{
"url": "https://git.kernel.org/stable/c/91d105d2cbe002f9c7b43a6183adedc37e1da1f7"
},
{
"url": "https://git.kernel.org/stable/c/5057e1aca011e51ef51498c940ef96f3d3e8a305"
}
],
"title": "net/sched: act_api: use RCU with deferred freeing for action lifecycle",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53264",
"datePublished": "2026-06-25T08:39:51.870Z",
"dateReserved": "2026-06-09T07:44:35.395Z",
"dateUpdated": "2026-10-15T01:23:06.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64577 (GCVE-0-2026-64577)
Vulnerability from cvelistv5
Published
2026-08-05 08:09
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
gtp1u_send_echo_resp() ignores skb_pull_data()'s return value. Its
caller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr +
gtp1_header), but the pull requests 20 (gtp1_header_long + udphdr). For
a 16-19 byte echo request the pull fails and returns NULL without
advancing skb->data; execution continues, and the following skb_push()
plus the IP header pushed by iptunnel_xmit() move skb->data below
skb->head, tripping skb_under_panic().
Fix it by dropping the packet when skb_pull_data() fails.
skbuff: skb_under_panic: ...
kernel BUG at net/core/skbuff.c:214!
Call Trace:
skb_push (net/core/skbuff.c:2648)
iptunnel_xmit (net/ipv4/ip_tunnel_core.c:82)
gtp_encap_recv (drivers/net/gtp.c:701 drivers/net/gtp.c:808 drivers/net/gtp.c:920)
udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)
...
Kernel panic - not syncing: Fatal exception in interrupt
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 Version: 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 Version: 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 Version: 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 Version: 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 Version: 9af41cc33471ea1efa6f77e188f055cc77d0a5c5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/gtp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9033fe49926f0e7421fefee922dc086417e905cf",
"status": "affected",
"version": "9af41cc33471ea1efa6f77e188f055cc77d0a5c5",
"versionType": "git"
},
{
"lessThan": "b3c733eaae7f362601c28ac1533d47a961cd3e1c",
"status": "affected",
"version": "9af41cc33471ea1efa6f77e188f055cc77d0a5c5",
"versionType": "git"
},
{
"lessThan": "4fc7923871d176ce0e5fecf4a9b7bb915af790ed",
"status": "affected",
"version": "9af41cc33471ea1efa6f77e188f055cc77d0a5c5",
"versionType": "git"
},
{
"lessThan": "961e9b1e33445f8e42859ecc020c9f60d8b69a8b",
"status": "affected",
"version": "9af41cc33471ea1efa6f77e188f055cc77d0a5c5",
"versionType": "git"
},
{
"lessThan": "cf45d748e437b8dd2dd987f27ee79c8c86f95c88",
"status": "affected",
"version": "9af41cc33471ea1efa6f77e188f055cc77d0a5c5",
"versionType": "git"
},
{
"lessThan": "cd170f051dba9ac146fabcd1b91726487c0cb9fa",
"status": "affected",
"version": "9af41cc33471ea1efa6f77e188f055cc77d0a5c5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/gtp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngtp: check skb_pull_data() return in gtp1u_send_echo_resp()\n\ngtp1u_send_echo_resp() ignores skb_pull_data()\u0027s return value. Its\ncaller gtp1u_udp_encap_recv() only guarantees 16 bytes (udphdr +\ngtp1_header), but the pull requests 20 (gtp1_header_long + udphdr). For\na 16-19 byte echo request the pull fails and returns NULL without\nadvancing skb-\u003edata; execution continues, and the following skb_push()\nplus the IP header pushed by iptunnel_xmit() move skb-\u003edata below\nskb-\u003ehead, tripping skb_under_panic().\n\nFix it by dropping the packet when skb_pull_data() fails.\n\n skbuff: skb_under_panic: ...\n kernel BUG at net/core/skbuff.c:214!\n Call Trace:\n skb_push (net/core/skbuff.c:2648)\n iptunnel_xmit (net/ipv4/ip_tunnel_core.c:82)\n gtp_encap_recv (drivers/net/gtp.c:701 drivers/net/gtp.c:808 drivers/net/gtp.c:920)\n udp_queue_rcv_one_skb (net/ipv4/udp.c:2388)\n ...\n Kernel panic - not syncing: Fatal exception in interrupt"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A crafted GTP-U Echo Request to UDP port 2152 reaches gtp_encap_recv \u2192 gtp1u_udp_encap_recv \u2192 gtp1u_send_echo_resp via the in-kernel UDP encap receive path, so a remote IP peer can trigger the bug without local access.\nAC:L - The attacker fully controls the packet: a 16\u201319 byte GTP-U Echo Request with the S flag set and TEID 0 reliably fails the unchecked 20-byte pull and drives the subsequent skb_push path into skb_under_panic with no race or external condition required.\nPR:N - GTP-U echo handling runs on unauthenticated received UDP datagrams once a GTP device with kernel-created sockets exists; the attacker needs no credentials or local privileges on the target.\nUI:N - No victim action is required; packet delivery to the GTP-U encap socket alone invokes the vulnerable echo-response path.\nS:U - Impact is a kernel BUG/panic in the host GTP/network stack within the same security authority; it does not cross a VM, IOMMU, or other separate boundary.\nC:N - The failure is a deterministic skb headroom underflow caught by skb_under_panic/BUG with no out-of-bounds read, UAF, or other information-disclosure primitive identified.\nI:N - skb_push detects data \u003c head and BUG()s before further attacker-controlled writes; this is an availability crash, not an exploitable write or control-flow hijack primitive.\nA:H - The commit-reproduced path hits skb_under_panic and a fatal kernel BUG in interrupt context, causing kernel panic and full denial of service that can be retriggered by further crafted echo requests."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:59.684Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9033fe49926f0e7421fefee922dc086417e905cf"
},
{
"url": "https://git.kernel.org/stable/c/b3c733eaae7f362601c28ac1533d47a961cd3e1c"
},
{
"url": "https://git.kernel.org/stable/c/4fc7923871d176ce0e5fecf4a9b7bb915af790ed"
},
{
"url": "https://git.kernel.org/stable/c/961e9b1e33445f8e42859ecc020c9f60d8b69a8b"
},
{
"url": "https://git.kernel.org/stable/c/cf45d748e437b8dd2dd987f27ee79c8c86f95c88"
},
{
"url": "https://git.kernel.org/stable/c/cd170f051dba9ac146fabcd1b91726487c0cb9fa"
}
],
"title": "gtp: check skb_pull_data() return in gtp1u_send_echo_resp()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64577",
"datePublished": "2026-08-05T08:09:33.135Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-19T16:28:59.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53265 (GCVE-0-2026-53265)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-19 19:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm cache policy smq: check allocation under invalidate lock
commit 2d1f7b65f5de ("dm cache policy smq: fix missing locks in
invalidating cache blocks") added mq->lock around the destructive part of
smq_invalidate_mapping(), but left the e->allocated check outside the
critical section.
That leaves a check-then-act race. Two concurrent invalidators can both
observe e->allocated as true before either of them takes mq->lock. The
first invalidator that acquires the lock removes the entry from the
queues and hash table and then calls free_entry(), which clears
e->allocated and puts the entry back on the free list. The second
invalidator can then acquire mq->lock and continue with the stale result
of the unlocked check.
This can corrupt the SMQ queues or hash table by deleting an entry that
is no longer on those structures. It can also hit the allocation check in
free_entry() when the same entry is freed again.
Move the allocation check under mq->lock so the predicate and the
destructive operations are serialized by the same lock.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4991b5a08751e2e82488fb93ae08849b6aea10d9 Version: 1b2bec4a7dcf5f00b7a1cbeeec8997841d783513 Version: 9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e Version: ac5ee99443891bdb161f5539606a66a1b5e72542 Version: 93627a29d4b66d4a2def938dfb8610cc80ae454b Version: c348ae47d8e65f06429fa41adce9ad986b696766 Version: 2b62d0611c9af14a16bddf22df2612b4f40eb5a1 Version: 2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:23:07.374Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53265",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:28:01.536149Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:57:32.554Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-policy-smq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c242c7af2aecf0b538b8623bdb86b8b441da38d9",
"status": "affected",
"version": "4991b5a08751e2e82488fb93ae08849b6aea10d9",
"versionType": "git"
},
{
"lessThan": "13da856c86fb8c2ccab95034fd77da1bb2c2a17c",
"status": "affected",
"version": "1b2bec4a7dcf5f00b7a1cbeeec8997841d783513",
"versionType": "git"
},
{
"lessThan": "d886945fcb0f8c9dc6b39928d7a96c95c587346c",
"status": "affected",
"version": "9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e",
"versionType": "git"
},
{
"lessThan": "b4892561552d671bd8c4da5ebb70e9fbb1ec446e",
"status": "affected",
"version": "ac5ee99443891bdb161f5539606a66a1b5e72542",
"versionType": "git"
},
{
"lessThan": "03ffe1112ed88bb3a9bd0b971549bf4d64bfc59a",
"status": "affected",
"version": "93627a29d4b66d4a2def938dfb8610cc80ae454b",
"versionType": "git"
},
{
"lessThan": "42ff6774ecd9d7f70d599cb71ff64373a1da4948",
"status": "affected",
"version": "c348ae47d8e65f06429fa41adce9ad986b696766",
"versionType": "git"
},
{
"lessThan": "c57570fba24016ec25ec046ab44db39143fb7a64",
"status": "affected",
"version": "2b62d0611c9af14a16bddf22df2612b4f40eb5a1",
"versionType": "git"
},
{
"lessThan": "d3f0a606b9f278ece8a0df626ded9c4044071235",
"status": "affected",
"version": "2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-policy-smq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5.10.259",
"status": "affected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThan": "5.15.210",
"status": "affected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThan": "6.1.176",
"status": "affected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThan": "6.6.143",
"status": "affected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThan": "6.12.94",
"status": "affected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThan": "6.18.36",
"status": "affected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThan": "7.0.13",
"status": "affected",
"version": "7.0.10",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.10.258",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.15.209",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "6.1.175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.6.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.12.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.18.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "7.0.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache policy smq: check allocation under invalidate lock\n\ncommit 2d1f7b65f5de (\"dm cache policy smq: fix missing locks in\ninvalidating cache blocks\") added mq-\u003elock around the destructive part of\nsmq_invalidate_mapping(), but left the e-\u003eallocated check outside the\ncritical section.\n\nThat leaves a check-then-act race. Two concurrent invalidators can both\nobserve e-\u003eallocated as true before either of them takes mq-\u003elock. The\nfirst invalidator that acquires the lock removes the entry from the\nqueues and hash table and then calls free_entry(), which clears\ne-\u003eallocated and puts the entry back on the free list. The second\ninvalidator can then acquire mq-\u003elock and continue with the stale result\nof the unlocked check.\n\nThis can corrupt the SMQ queues or hash table by deleting an entry that\nis no longer on those structures. It can also hit the allocation check in\nfree_entry() when the same entry is freed again.\n\nMove the allocation check under mq-\u003elock so the predicate and the\ndestructive operations are serialized by the same lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached locally through device-mapper cache invalidation, via DM target messages or writes to an already configured passthrough dm-cache device. There is no network, adjacent, or physical packet/device path.\nAC:L - The race is between concurrent invalidators, and an attacker who can issue concurrent writes or invalidation requests can create that concurrency. When uncertain, the attacker-controlled race is scored as low complexity.\nPR:L - DM control ioctls require init-namespace CAP_SYS_ADMIN, but a plausible deployment lets a low-privileged local user generate passthrough cache writes through a mounted or otherwise writable dm-cache-backed device. User namespaces do not bypass the DM ioctl gate.\nUI:N - No victim action is required after the vulnerable dm-cache device is present; the attacker triggers invalidation with local I/O or messages. The race does not depend on another user opening a file or approving an action.\nS:U - The impact remains within the same kernel/storage security authority. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The stale invalidation can corrupt SMQ queue/hash policy state, potentially misdirecting cached block mappings and exposing data from other blocks. As kernel memory/data-structure corruption, confidentiality impact is scored high when uncertain.\nI:H - The bug can delete/free an entry twice and corrupt SMQ queues or hash tables before hitting the allocation check. That can corrupt cache mapping state and kernel data structures, so integrity impact is high.\nA:H - The second free can hit BUG_ON(!e-\u003eallocated), causing a kernel oops/panic. Even without the BUG_ON path, corrupted cache policy structures can destabilize the kernel, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:42.297Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c242c7af2aecf0b538b8623bdb86b8b441da38d9"
},
{
"url": "https://git.kernel.org/stable/c/13da856c86fb8c2ccab95034fd77da1bb2c2a17c"
},
{
"url": "https://git.kernel.org/stable/c/d886945fcb0f8c9dc6b39928d7a96c95c587346c"
},
{
"url": "https://git.kernel.org/stable/c/b4892561552d671bd8c4da5ebb70e9fbb1ec446e"
},
{
"url": "https://git.kernel.org/stable/c/03ffe1112ed88bb3a9bd0b971549bf4d64bfc59a"
},
{
"url": "https://git.kernel.org/stable/c/42ff6774ecd9d7f70d599cb71ff64373a1da4948"
},
{
"url": "https://git.kernel.org/stable/c/c57570fba24016ec25ec046ab44db39143fb7a64"
},
{
"url": "https://git.kernel.org/stable/c/d3f0a606b9f278ece8a0df626ded9c4044071235"
}
],
"title": "dm cache policy smq: check allocation under invalidate lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53265",
"datePublished": "2026-06-25T08:39:52.543Z",
"dateReserved": "2026-06-09T07:44:35.395Z",
"dateUpdated": "2026-10-19T19:57:32.554Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64340 (GCVE-0-2026-64340)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: legousbtower: fix use-after-free on disconnect race
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 18bcbcfe9ca2308ebffb40068b51803da9315d97 Version: 18bcbcfe9ca2308ebffb40068b51803da9315d97 Version: 18bcbcfe9ca2308ebffb40068b51803da9315d97 Version: 18bcbcfe9ca2308ebffb40068b51803da9315d97 Version: 18bcbcfe9ca2308ebffb40068b51803da9315d97 Version: 18bcbcfe9ca2308ebffb40068b51803da9315d97 Version: 18bcbcfe9ca2308ebffb40068b51803da9315d97 Version: 18bcbcfe9ca2308ebffb40068b51803da9315d97 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/legousbtower.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "11d069f85851997b4ea0adf242ed9672dc749b8f",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "b4222c05066b252b451f9c8c4730b5b60824ea66",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "ab2bfd7bec4f134b377ec42f513e90c35db94160",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "766738ecf2b819e54d38763c8d1c8ae6cff14b39",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "9ba62966461a8e3cc593b62c56ec62eb2d80436d",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
},
{
"lessThan": "62fc8eb1b1481051f7bab4aa93d79809053dd09f",
"status": "affected",
"version": "18bcbcfe9ca2308ebffb40068b51803da9315d97",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/legousbtower.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: legousbtower: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it\u0027s unlocked\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:43.875Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/11d069f85851997b4ea0adf242ed9672dc749b8f"
},
{
"url": "https://git.kernel.org/stable/c/b4222c05066b252b451f9c8c4730b5b60824ea66"
},
{
"url": "https://git.kernel.org/stable/c/6462de75d2e370c7e74dcfb7b4ae79eb5a6a55ee"
},
{
"url": "https://git.kernel.org/stable/c/0b57e5ddbd89df3bc367463de3d2ca66f99a1a5e"
},
{
"url": "https://git.kernel.org/stable/c/ab2bfd7bec4f134b377ec42f513e90c35db94160"
},
{
"url": "https://git.kernel.org/stable/c/766738ecf2b819e54d38763c8d1c8ae6cff14b39"
},
{
"url": "https://git.kernel.org/stable/c/9ba62966461a8e3cc593b62c56ec62eb2d80436d"
},
{
"url": "https://git.kernel.org/stable/c/62fc8eb1b1481051f7bab4aa93d79809053dd09f"
}
],
"title": "USB: legousbtower: fix use-after-free on disconnect race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64340",
"datePublished": "2026-07-25T08:50:03.896Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:43.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68143 (GCVE-0-2026-68143)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: slip: serialize receive against buffer reallocation
sl_realloc_bufs() replaces rbuff and updates buffsize while holding
sl->lock. slip_receive_buf() reads those fields and writes through rbuff
without holding the lock.
An MTU change can therefore race with receive processing. An MTU shrink
can expose the new smaller rbuff with the old larger bound, causing an
out-of-bounds write. A receive callback which already loaded the old
rbuff can instead continue writing after that buffer has been freed.
Serialize receive processing with sl_realloc_bufs() by holding sl->lock
while consuming each receive batch.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:44:44.088088Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:53.572Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/slip/slip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8180daf2b66155f84ec4f9e3f95488c8a3421716",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "189a550eb7e1dc10018718ddfc46d003ffe58653",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1be09d175b627fad7f6bec7ad27b8a4a99863912",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "eb3836eab47487823f362e6985e170a1e15f20fd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "44401f7dd9940ced7098930ef64f5a332f279fc2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5d07b178bef511d69558cfc89fe1129258dc39f8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0e37bbd6d617eb52bace49390e99eaedc1af73ce",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/slip/slip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: slip: serialize receive against buffer reallocation\n\nsl_realloc_bufs() replaces rbuff and updates buffsize while holding\nsl-\u003elock. slip_receive_buf() reads those fields and writes through rbuff\nwithout holding the lock.\n\nAn MTU change can therefore race with receive processing. An MTU shrink\ncan expose the new smaller rbuff with the old larger bound, causing an\nout-of-bounds write. A receive callback which already loaded the old\nrbuff can instead continue writing after that buffer has been freed.\n\nSerialize receive processing with sl_realloc_bufs() by holding sl-\u003elock\nwhile consuming each receive batch."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in the SLIP TTY line discipline; triggering the MTU shrink/realloc race requires SIOCSIFMTU/RTM_SETLINK (CAP_NET_ADMIN) on the host, so a single attacker must have local access even if SLIP frames arrive over a serial backhaul.\nAC:L - An attacker with CAP_NET_ADMIN can concurrently hammer MTU changes via ioctl/rtnetlink and inject SLIP frames on the bound TTY/PTY, controlling both sides of the race without depending on uncontrollable timing.\nPR:L - SIOCSIFMTU requires CAP_NET_ADMIN in the interface network namespace, obtainable by an unprivileged user via user namespaces; exploitation targets already-active SLIP links and does not repeat slip_open()\u0027s init-namespace check.\nUI:N - No end-user or administrator interaction is required during exploitation once a SLIP interface is active; the attacker drives both MTU reallocation and receive processing directly.\nS:U - Heap corruption is confined to kernel SLIP receive buffers and adjacent kmalloc objects; impact is standard kernel memory corruption and local privilege escalation, not a cross-VM or sandbox boundary escape.\nC:H - The race yields heap out-of-bounds writes and use-after-free writes on freed rbuff kmalloc objects; per kernel guidance, this class of memory corruption enables arbitrary kernel memory disclosure.\nI:H - Writing past the reallocated rbuff boundary or into a freed buffer corrupts adjacent heap metadata/objects, providing primitives for arbitrary kernel writes and control-flow hijacking.\nA:H - Out-of-bounds and use-after-free corruption of kernel heap memory reliably causes kernel oops/panic during the race even when not fully weaponized for code execution."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:30:04.807Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8180daf2b66155f84ec4f9e3f95488c8a3421716"
},
{
"url": "https://git.kernel.org/stable/c/189a550eb7e1dc10018718ddfc46d003ffe58653"
},
{
"url": "https://git.kernel.org/stable/c/1be09d175b627fad7f6bec7ad27b8a4a99863912"
},
{
"url": "https://git.kernel.org/stable/c/eb3836eab47487823f362e6985e170a1e15f20fd"
},
{
"url": "https://git.kernel.org/stable/c/44401f7dd9940ced7098930ef64f5a332f279fc2"
},
{
"url": "https://git.kernel.org/stable/c/5d07b178bef511d69558cfc89fe1129258dc39f8"
},
{
"url": "https://git.kernel.org/stable/c/0e37bbd6d617eb52bace49390e99eaedc1af73ce"
},
{
"url": "https://git.kernel.org/stable/c/ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d"
}
],
"title": "net: slip: serialize receive against buffer reallocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68143",
"datePublished": "2026-08-10T11:59:07.354Z",
"dateReserved": "2026-07-30T09:28:09.370Z",
"dateUpdated": "2026-10-19T20:58:53.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68300 (GCVE-0-2026-68300)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: auth: verify auth requirement when auth_chunk is NULL
sctp_auth_chunk_verify() returns true unconditionally when
chunk->auth_chunk is NULL, silently skipping authentication.
This is incorrect when:
1. skb_clone() failed in the BH receive path, leaving auth_chunk
NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new
connections, so the early sctp_auth_recv_cid() check cannot
catch this.
2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never
called and auth_chunk remains NULL.
Fix by checking sctp_auth_recv_cid() when auth_chunk is NULL:
if authentication is required, return false to drop the chunk;
otherwise continue normally.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e Version: bbd0d59809f923ea2b540cbd781b32110e249f6e |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68300",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:46:55.343274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:04.214Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a129792b3aef15002746c13522781d92ed3522c3",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "5a022ac51ad83b4ce6c898f4b9eefc65bd26b247",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "6caf0e8590c0bf05a76b0d387726adf3a6f3725c",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "ec2e157fc9678a9bc411305a25aec3fd337d7efb",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "28c5fdce9dd955d2baf5e28987819b6d7cfaf646",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "18957373920caf5cdaf5cf32e5d1d7a99ca7700a",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "83f5031f2a6a49d696eb4cc0898345d12f9c6451",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
},
{
"lessThan": "8e04823c120b376ef7dab14b60ebf6823aa16c14",
"status": "affected",
"version": "bbd0d59809f923ea2b540cbd781b32110e249f6e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: auth: verify auth requirement when auth_chunk is NULL\n\nsctp_auth_chunk_verify() returns true unconditionally when\nchunk-\u003eauth_chunk is NULL, silently skipping authentication.\nThis is incorrect when:\n\n1. skb_clone() failed in the BH receive path, leaving auth_chunk\n NULL. In sctp_endpoint_bh_rcv() asoc is NULL for new\n connections, so the early sctp_auth_recv_cid() check cannot\n catch this.\n\n2. No AUTH chunk precedes COOKIE-ECHO, so skb_clone() is never\n called and auth_chunk remains NULL.\n\nFix by checking sctp_auth_recv_cid() when auth_chunk is NULL:\nif authentication is required, return false to drop the chunk;\notherwise continue normally."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is SCTP COOKIE-ECHO chunk processing in the kernel\u0027s SCTP state machine, reached directly from packets received on the network from any remote peer over an arbitrarily routed SCTP connection.\nAC:L - The attacker deterministically triggers the bypass by completing a normal INIT/INIT-ACK exchange with the AUTH extension advertised and then sending COOKIE-ECHO with no preceding AUTH chunk; no race, no memory-layout dependency, and every step is under the attacker\u0027s control.\nPR:N - This is the pre-authentication association-establishment path itself; the attacker needs no credentials, no shared SCTP-AUTH key, and no account, since the bug is precisely that the required authentication is skipped.\nUI:N - The listening SCTP endpoint processes the crafted COOKIE-ECHO automatically in the receive path; no action by any local user or administrator is needed.\nS:U - The bypass affects the SCTP association and the application relying on it within the same host security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An unauthenticated peer is admitted as an apparently authenticated one, and because peer.auth_capable is set the SCTP_AUTH_NO_AUTH notification is suppressed so the application cannot detect it, giving the attacker full read access to all data the service sends on that association.\nI:H - The attacker can inject arbitrary SCTP data and control chunks into the service as a trusted, supposedly key-verified peer, and can use the dupcook restart path to update or replace an existing association\u0027s state without authentication.\nA:H - Authenticating COOKIE-ECHO is the RFC 4895 defense against unauthorized association restart; bypassing it lets an attacker reset/take over an established association, dropping its queued state and denying service to the legitimate peer, and lets unauthorized peers consume association and accept-queue resources on an endpoint meant to admit only key-holding peers."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:32:51.209Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a129792b3aef15002746c13522781d92ed3522c3"
},
{
"url": "https://git.kernel.org/stable/c/5a022ac51ad83b4ce6c898f4b9eefc65bd26b247"
},
{
"url": "https://git.kernel.org/stable/c/6caf0e8590c0bf05a76b0d387726adf3a6f3725c"
},
{
"url": "https://git.kernel.org/stable/c/ec2e157fc9678a9bc411305a25aec3fd337d7efb"
},
{
"url": "https://git.kernel.org/stable/c/28c5fdce9dd955d2baf5e28987819b6d7cfaf646"
},
{
"url": "https://git.kernel.org/stable/c/18957373920caf5cdaf5cf32e5d1d7a99ca7700a"
},
{
"url": "https://git.kernel.org/stable/c/83f5031f2a6a49d696eb4cc0898345d12f9c6451"
},
{
"url": "https://git.kernel.org/stable/c/8e04823c120b376ef7dab14b60ebf6823aa16c14"
}
],
"title": "sctp: auth: verify auth requirement when auth_chunk is NULL",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68300",
"datePublished": "2026-08-10T12:02:34.168Z",
"dateReserved": "2026-07-30T09:28:09.380Z",
"dateUpdated": "2026-10-19T21:09:04.214Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64450 (GCVE-0-2026-64450)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix out-of-bounds read in broadcast Gap ACK blocks
A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its
data area. tipc_get_gap_ack_blks() only verifies that the record's len
field is self-consistent with its ugack_cnt/bgack_cnt counts
(sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check
that the record actually fits in the message data area, msg_data_sz().
The unicast caller tipc_link_proto_rcv() bounds it ("if (glen > dlen)
break;"), but the broadcast caller tipc_bcast_sync_rcv() discards the
returned size, so tipc_link_advance_transmq() copies the record off the
receive skb with an attacker-controlled count:
this_ga = kmemdup(ga, struct_size(ga, gacks, ga->bgack_cnt),
GFP_ATOMIC);
A TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK triggers it with one
ordinary broadcast STATE_MSG (msg_bc_ack_invalid() clear), sized so its
data area is short, carrying a Gap ACK record with len = 0x400,
bgack_cnt = 0xff and ugack_cnt = 0. len then equals
struct_size(p, gacks, 255), so the consistency check passes and ga is
non-NULL; kmemdup() reads struct_size(ga, gacks, 255) = 1024 bytes out
of the much smaller skb:
BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x48/0x60
Read of size 1024 at addr ffff0000c7030d38 by task poc864/69
Call trace:
kmemdup_noprof+0x48/0x60
tipc_link_advance_transmq+0x86c/0xb80
tipc_link_bc_ack_rcv+0x19c/0x1e0
tipc_bcast_sync_rcv+0x1c4/0x2c4
tipc_rcv+0x85c/0x1340
tipc_l2_rcv_msg+0xac/0x104
The buggy address belongs to the object at ffff0000c7030d00
which belongs to the cache skbuff_small_head of size 704
The buggy address is located 56 bytes inside of
allocated 704-byte region [ffff0000c7030d00, ffff0000c7030fc0)
The copied-out bytes are subsequently consumed as gap/ack values, but
the read is already out of bounds at the kmemdup() regardless of how
they are used.
The unicast STATE path drops such a message: "if (glen > dlen) break;"
skips the rest of STATE_MSG handling and the skb is freed. Make the
broadcast path drop it too. tipc_bcast_sync_rcv() now bounds the record
against msg_data_sz() and, when it does not fit, reports it back through
tipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded rather than
processed. ga is not cleared on this path: ga == NULL already means
"legacy peer without Selective ACK", a distinct legitimate state.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d7626b5acff9227e2a65da636a53e09bdafdc0aa Version: d7626b5acff9227e2a65da636a53e09bdafdc0aa Version: d7626b5acff9227e2a65da636a53e09bdafdc0aa Version: d7626b5acff9227e2a65da636a53e09bdafdc0aa Version: d7626b5acff9227e2a65da636a53e09bdafdc0aa Version: d7626b5acff9227e2a65da636a53e09bdafdc0aa Version: d7626b5acff9227e2a65da636a53e09bdafdc0aa Version: d7626b5acff9227e2a65da636a53e09bdafdc0aa |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:41:04.841993Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:30.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/bcast.c",
"net/tipc/bcast.h",
"net/tipc/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "055663d21dc4336f67933ab26bef3c5934be6324",
"status": "affected",
"version": "d7626b5acff9227e2a65da636a53e09bdafdc0aa",
"versionType": "git"
},
{
"lessThan": "016f5995c37a5a2c45198308f830f244517d70b7",
"status": "affected",
"version": "d7626b5acff9227e2a65da636a53e09bdafdc0aa",
"versionType": "git"
},
{
"lessThan": "74b45af86a767594ba52330cd440ea84e24d700d",
"status": "affected",
"version": "d7626b5acff9227e2a65da636a53e09bdafdc0aa",
"versionType": "git"
},
{
"lessThan": "9a51115fcdc78687c8852bf93a1db3951dbb223b",
"status": "affected",
"version": "d7626b5acff9227e2a65da636a53e09bdafdc0aa",
"versionType": "git"
},
{
"lessThan": "a21ed5064217cc33726da6c7ef1a520eba43aea1",
"status": "affected",
"version": "d7626b5acff9227e2a65da636a53e09bdafdc0aa",
"versionType": "git"
},
{
"lessThan": "2de42e268174766cb2e2b90721afdfdff70e0d8d",
"status": "affected",
"version": "d7626b5acff9227e2a65da636a53e09bdafdc0aa",
"versionType": "git"
},
{
"lessThan": "f333b6851bdf326fd2134133272dbbed0c94d921",
"status": "affected",
"version": "d7626b5acff9227e2a65da636a53e09bdafdc0aa",
"versionType": "git"
},
{
"lessThan": "2b66974a1b6134a4bbc3bfed181f7418f688eb54",
"status": "affected",
"version": "d7626b5acff9227e2a65da636a53e09bdafdc0aa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/bcast.c",
"net/tipc/bcast.h",
"net/tipc/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix out-of-bounds read in broadcast Gap ACK blocks\n\nA broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its\ndata area. tipc_get_gap_ack_blks() only verifies that the record\u0027s len\nfield is self-consistent with its ugack_cnt/bgack_cnt counts\n(sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check\nthat the record actually fits in the message data area, msg_data_sz().\n\nThe unicast caller tipc_link_proto_rcv() bounds it (\"if (glen \u003e dlen)\nbreak;\"), but the broadcast caller tipc_bcast_sync_rcv() discards the\nreturned size, so tipc_link_advance_transmq() copies the record off the\nreceive skb with an attacker-controlled count:\n\n\tthis_ga = kmemdup(ga, struct_size(ga, gacks, ga-\u003ebgack_cnt),\n\t\t\t GFP_ATOMIC);\n\nA TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK triggers it with one\nordinary broadcast STATE_MSG (msg_bc_ack_invalid() clear), sized so its\ndata area is short, carrying a Gap ACK record with len = 0x400,\nbgack_cnt = 0xff and ugack_cnt = 0. len then equals\nstruct_size(p, gacks, 255), so the consistency check passes and ga is\nnon-NULL; kmemdup() reads struct_size(ga, gacks, 255) = 1024 bytes out\nof the much smaller skb:\n\n BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x48/0x60\n Read of size 1024 at addr ffff0000c7030d38 by task poc864/69\n Call trace:\n kmemdup_noprof+0x48/0x60\n tipc_link_advance_transmq+0x86c/0xb80\n tipc_link_bc_ack_rcv+0x19c/0x1e0\n tipc_bcast_sync_rcv+0x1c4/0x2c4\n tipc_rcv+0x85c/0x1340\n tipc_l2_rcv_msg+0xac/0x104\n The buggy address belongs to the object at ffff0000c7030d00\n which belongs to the cache skbuff_small_head of size 704\n The buggy address is located 56 bytes inside of\n allocated 704-byte region [ffff0000c7030d00, ffff0000c7030fc0)\n\nThe copied-out bytes are subsequently consumed as gap/ack values, but\nthe read is already out of bounds at the kmemdup() regardless of how\nthey are used.\n\nThe unicast STATE path drops such a message: \"if (glen \u003e dlen) break;\"\nskips the rest of STATE_MSG handling and the skb is freed. Make the\nbroadcast path drop it too. tipc_bcast_sync_rcv() now bounds the record\nagainst msg_data_sz() and, when it does not fit, reports it back through\ntipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded rather than\nprocessed. ga is not cleared on this path: ga == NULL already means\n\"legacy peer without Selective ACK\", a distinct legitimate state."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - TIPC packets can arrive through an IP/UDP bearer from a routable remote source, and the receive callback does not restrict packets to configured remote addresses. An attacker can also establish or spoof the required TIPC neighbour state without credentials.\nAC:L - The attacker controls capability advertisement, link establishment, broadcast synchronization, and the malformed STATE message; one packet then reliably performs the out-of-bounds copy without a race or uncontrollable condition.\nPR:N - The packet-receive path performs no capability or user-credential check, and TIPC discovery and link negotiation are unauthenticated when optional cryptographic keys are not configured. The vulnerable broadcast processing also precedes normal STATE-session validation.\nUI:N - No victim action is required after the TIPC bearer is active; receipt of the crafted STATE message directly invokes the vulnerable code.\nS:U - The vulnerability compromises availability and potentially confidentiality within the receiving kernel\u0027s existing security authority, without crossing a VM, IOMMU, or comparable scope boundary.\nC:H - The attacker-controlled count makes the kernel copy up to 1,024 bytes from a much smaller skb, incorporating substantial adjacent slab contents rather than a strictly bounded few-byte read.\nI:N - The defect performs an out-of-bounds read into a correctly sized new allocation; investigation found no out-of-bounds write, arbitrary-write primitive, or control-flow corruption.\nA:H - The demonstrated 1,024-byte slab-out-of-bounds access produces a KASAN BUG and can panic or fault hardened kernels, and an unauthenticated attacker can trigger it repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:54.043Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/055663d21dc4336f67933ab26bef3c5934be6324"
},
{
"url": "https://git.kernel.org/stable/c/016f5995c37a5a2c45198308f830f244517d70b7"
},
{
"url": "https://git.kernel.org/stable/c/74b45af86a767594ba52330cd440ea84e24d700d"
},
{
"url": "https://git.kernel.org/stable/c/9a51115fcdc78687c8852bf93a1db3951dbb223b"
},
{
"url": "https://git.kernel.org/stable/c/a21ed5064217cc33726da6c7ef1a520eba43aea1"
},
{
"url": "https://git.kernel.org/stable/c/2de42e268174766cb2e2b90721afdfdff70e0d8d"
},
{
"url": "https://git.kernel.org/stable/c/f333b6851bdf326fd2134133272dbbed0c94d921"
},
{
"url": "https://git.kernel.org/stable/c/2b66974a1b6134a4bbc3bfed181f7418f688eb54"
}
],
"title": "tipc: fix out-of-bounds read in broadcast Gap ACK blocks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64450",
"datePublished": "2026-07-25T08:51:20.319Z",
"dateReserved": "2026-07-19T15:36:31.788Z",
"dateUpdated": "2026-10-19T20:38:30.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64470 (GCVE-0-2026-64470)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: fix use-after-free on marvell probe failure
Make sure to stop any TX URBs submitted during Marvell OOB wakeup
configuration on later probe failures to avoid use-after-free in the
completion callback.
This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac Version: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac Version: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac Version: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac Version: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac Version: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac Version: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac Version: a4ccc9e33d2f01532bcceb621ea06bbf4db6efac |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1edd524de5cc8143ece9c42c466346983dc5b5ed",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "0ccb1cb0a464dab78284c34196cd3e8e18bab4c4",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "631de465aba7f8ae46478bf5f598111412e8eff8",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "6e1b10df890f4663cb38af9fc1c93d36747b75af",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "92c736866244340497a8a65afe2ac25354c2bf5e",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "a7e941a395711791c7e98d9870c6562c2c9e9ef2",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "838c917a2f16eefe68def800ebf48a2af591149a",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
},
{
"lessThan": "c5b600a3c05b1a7a110d558df935a8fc8a471c79",
"status": "affected",
"version": "a4ccc9e33d2f01532bcceb621ea06bbf4db6efac",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: fix use-after-free on marvell probe failure\n\nMake sure to stop any TX URBs submitted during Marvell OOB wakeup\nconfiguration on later probe failures to avoid use-after-free in the\ncompletion callback.\n\nThis issue was reported by Sashiko while reviewing a fix for a wakeup\nsource leak in the btusb probe errors paths."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:56:16.023Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1edd524de5cc8143ece9c42c466346983dc5b5ed"
},
{
"url": "https://git.kernel.org/stable/c/0ccb1cb0a464dab78284c34196cd3e8e18bab4c4"
},
{
"url": "https://git.kernel.org/stable/c/631de465aba7f8ae46478bf5f598111412e8eff8"
},
{
"url": "https://git.kernel.org/stable/c/6e1b10df890f4663cb38af9fc1c93d36747b75af"
},
{
"url": "https://git.kernel.org/stable/c/92c736866244340497a8a65afe2ac25354c2bf5e"
},
{
"url": "https://git.kernel.org/stable/c/a7e941a395711791c7e98d9870c6562c2c9e9ef2"
},
{
"url": "https://git.kernel.org/stable/c/838c917a2f16eefe68def800ebf48a2af591149a"
},
{
"url": "https://git.kernel.org/stable/c/c5b600a3c05b1a7a110d558df935a8fc8a471c79"
}
],
"title": "Bluetooth: btusb: fix use-after-free on marvell probe failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64470",
"datePublished": "2026-07-25T08:51:34.673Z",
"dateReserved": "2026-07-19T15:36:31.790Z",
"dateUpdated": "2026-08-17T04:56:16.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52939 (GCVE-0-2026-52939)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-06-24 07:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
rds_ib_xmit_atomic() always programs a masked atomic opcode
(IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD)
for every RDS atomic cmsg. But the completion-side switch in
rds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked
atomic completion falls through to default and returns rm == NULL while
send->s_op is left set. rds_ib_send_cqe_handler() then dereferences the
NULL rm via rm->m_final_op, oopsing in softirq context. An unprivileged
AF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection
triggers it; on hardware that natively accepts masked atomics (mlx4,
mlx5) no extra setup is needed.
RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR!
Oops: general protection fault [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
RIP: rds_ib_send_cqe_handler+0x25c/0xb10 (net/rds/ib_send.c:282)
Call Trace:
<IRQ>
rds_ib_send_cqe_handler (net/rds/ib_send.c:282)
poll_scq (net/rds/ib_cm.c:274)
rds_ib_tasklet_fn_send (net/rds/ib_cm.c:294)
tasklet_action_common (kernel/softirq.c:943)
handle_softirqs (kernel/softirq.c:573)
run_ksoftirqd (kernel/softirq.c:479)
</IRQ>
Kernel panic - not syncing: Fatal exception in interrupt
Handle the masked atomic opcodes in the same case as the non-masked
ones: they map to the same struct rds_message.atomic union member, so
the existing container_of()/rds_ib_send_unmap_atomic() body is correct
for them.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 20c72bd5f5f902e5a8745d51573699605bf8d21c Version: 20c72bd5f5f902e5a8745d51573699605bf8d21c Version: 20c72bd5f5f902e5a8745d51573699605bf8d21c Version: 20c72bd5f5f902e5a8745d51573699605bf8d21c Version: 20c72bd5f5f902e5a8745d51573699605bf8d21c Version: 20c72bd5f5f902e5a8745d51573699605bf8d21c Version: 20c72bd5f5f902e5a8745d51573699605bf8d21c Version: 20c72bd5f5f902e5a8745d51573699605bf8d21c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/ib_send.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a0148342badd8c9b2e46551766a27cb76c82e715",
"status": "affected",
"version": "20c72bd5f5f902e5a8745d51573699605bf8d21c",
"versionType": "git"
},
{
"lessThan": "4dd262f875e87653df50b138de1390ab0628e6b7",
"status": "affected",
"version": "20c72bd5f5f902e5a8745d51573699605bf8d21c",
"versionType": "git"
},
{
"lessThan": "6e4615164d185a26badb2f376a2449f4d174a5f0",
"status": "affected",
"version": "20c72bd5f5f902e5a8745d51573699605bf8d21c",
"versionType": "git"
},
{
"lessThan": "0f22412a2f4fbbe0251c132abee045d15a90e5b6",
"status": "affected",
"version": "20c72bd5f5f902e5a8745d51573699605bf8d21c",
"versionType": "git"
},
{
"lessThan": "0f7baa82a24813cdad0b06a6f8f07e4824af5ed5",
"status": "affected",
"version": "20c72bd5f5f902e5a8745d51573699605bf8d21c",
"versionType": "git"
},
{
"lessThan": "dcf458120add64c96a6ef5cf719340453f6e6abf",
"status": "affected",
"version": "20c72bd5f5f902e5a8745d51573699605bf8d21c",
"versionType": "git"
},
{
"lessThan": "4fd34669558085bcb589aa2078a13b0ca79e360d",
"status": "affected",
"version": "20c72bd5f5f902e5a8745d51573699605bf8d21c",
"versionType": "git"
},
{
"lessThan": "34080db3e70ddf94c38512ad2331e3c3afca6cc1",
"status": "affected",
"version": "20c72bd5f5f902e5a8745d51573699605bf8d21c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/ib_send.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion\n\nrds_ib_xmit_atomic() always programs a masked atomic opcode\n(IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD)\nfor every RDS atomic cmsg. But the completion-side switch in\nrds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked\natomic completion falls through to default and returns rm == NULL while\nsend-\u003es_op is left set. rds_ib_send_cqe_handler() then dereferences the\nNULL rm via rm-\u003em_final_op, oopsing in softirq context. An unprivileged\nAF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection\ntriggers it; on hardware that natively accepts masked atomics (mlx4,\nmlx5) no extra setup is needed.\n\n RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR!\n Oops: general protection fault [#1] SMP KASAN\n KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]\n RIP: rds_ib_send_cqe_handler+0x25c/0xb10 (net/rds/ib_send.c:282)\n Call Trace:\n \u003cIRQ\u003e\n rds_ib_send_cqe_handler (net/rds/ib_send.c:282)\n poll_scq (net/rds/ib_cm.c:274)\n rds_ib_tasklet_fn_send (net/rds/ib_cm.c:294)\n tasklet_action_common (kernel/softirq.c:943)\n handle_softirqs (kernel/softirq.c:573)\n run_ksoftirqd (kernel/softirq.c:479)\n \u003c/IRQ\u003e\n Kernel panic - not syncing: Fatal exception in interrupt\n\nHandle the masked atomic opcodes in the same case as the non-masked\nones: they map to the same struct rds_message.atomic union member, so\nthe existing container_of()/rds_ib_send_unmap_atomic() body is correct\nfor them."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T07:14:28.622Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a0148342badd8c9b2e46551766a27cb76c82e715"
},
{
"url": "https://git.kernel.org/stable/c/4dd262f875e87653df50b138de1390ab0628e6b7"
},
{
"url": "https://git.kernel.org/stable/c/6e4615164d185a26badb2f376a2449f4d174a5f0"
},
{
"url": "https://git.kernel.org/stable/c/0f22412a2f4fbbe0251c132abee045d15a90e5b6"
},
{
"url": "https://git.kernel.org/stable/c/0f7baa82a24813cdad0b06a6f8f07e4824af5ed5"
},
{
"url": "https://git.kernel.org/stable/c/dcf458120add64c96a6ef5cf719340453f6e6abf"
},
{
"url": "https://git.kernel.org/stable/c/4fd34669558085bcb589aa2078a13b0ca79e360d"
},
{
"url": "https://git.kernel.org/stable/c/34080db3e70ddf94c38512ad2331e3c3afca6cc1"
}
],
"title": "net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52939",
"datePublished": "2026-06-24T07:14:28.622Z",
"dateReserved": "2026-06-09T07:44:35.370Z",
"dateUpdated": "2026-06-24T07:14:28.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64114 (GCVE-0-2026-64114)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: raw: reject IP_HDRINCL packets with ihl < 5
raw_send_hdrinc() validates that the caller-supplied IPv4 header
fits within the message length:
iphlen = iph->ihl * 4;
err = -EINVAL;
if (iphlen > length)
goto error_free;
if (iphlen >= sizeof(*iph)) {
/* fix up saddr, tot_len, id, csum, transport_header */
}
It does not, however, reject ihl < 5. For such a packet the
"if (iphlen >= sizeof(*iph))" branch is skipped, leaving the
crafted iphdr untouched, but the packet is still handed to
__ip_local_out() and onward. Downstream consumers that read
iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in
particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4
and passes the (signed-int-negative, then cast to size_t)
result to memcpy(), producing an OOB access of length close to
SIZE_MAX and a host kernel panic.
An IPv4 header with ihl < 5 is malformed by definition (RFC 791:
"Internet Header Length is the length of the internet header in
32 bit words ... Note that the minimum value for a correct header
is 5."). The kernel should not be willing to inject such a
packet into its own output path.
Reject "iphlen < sizeof(*iph)" alongside the existing
"iphlen > length" check. This matches the principle that locally
constructed packets that re-enter the IP stack must pass the same
basic sanity tests that a foreign packet would be subjected to.
Once this lands, the "if (iphlen >= sizeof(*iph))" wrapper around
the fixup branch becomes redundant; left in place to keep the
patch minimal and backport-friendly. A follow-up can unwrap it.
Note that commit 86f4c90a1c5c ("ipv4, ipv6: ensure raw socket
message is big enough to hold an IP header") ensures the message
buffer is large enough to hold an iphdr, but does not constrain
the self-reported iph->ihl.
Reachability: the malformed packet source is any caller with
CAP_NET_RAW, including an unprivileged process in a user+net
namespace on a kernel with CONFIG_USER_NS=y. The reproduced AH
crash also requires a matching xfrm AH policy on the outgoing
route; a container granted CAP_NET_ADMIN can install that state
and policy in its netns. Loopback bypasses xfrm_output, so the
trigger uses a real netdev.
Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with
memcpy_orig at the crash site. Same shape reproduces inside a
rootless Docker container with --cap-add NET_ADMIN on a stock
distro kernel.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64114",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:36:31.414892Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:12.671Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/raw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1065b9efa4126df559b03a849c139ecfae92cd25",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bc20dbd48c26e743f7e0845020c11ed2ce8b15ee",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5a564f737ec54d63e8ee221d3ff396d07586d464",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3c5411fa4944ed99af3d9d1de750ea8169b6dac9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "145e9afa5b905229b4788bb72c3255f5a5f77508",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7725cd3b471740fd23d25ed1da722c671fb2a5d3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bbe0be67de296176e7243c76e3d9f02f6ae9ff0b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "915fab69823a14c170dbaa3b41978768e0fe62fc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/raw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5\n\nraw_send_hdrinc() validates that the caller-supplied IPv4 header\nfits within the message length:\n\n iphlen = iph-\u003eihl * 4;\n err = -EINVAL;\n if (iphlen \u003e length)\n goto error_free;\n\n if (iphlen \u003e= sizeof(*iph)) {\n /* fix up saddr, tot_len, id, csum, transport_header */\n }\n\nIt does not, however, reject ihl \u003c 5. For such a packet the\n\"if (iphlen \u003e= sizeof(*iph))\" branch is skipped, leaving the\ncrafted iphdr untouched, but the packet is still handed to\n__ip_local_out() and onward. Downstream consumers that read\niph-\u003eihl assume a sane value: net/ipv4/ah4.c:ah_output() in\nparticular subtracts sizeof(struct iphdr) from top_iph-\u003eihl * 4\nand passes the (signed-int-negative, then cast to size_t)\nresult to memcpy(), producing an OOB access of length close to\nSIZE_MAX and a host kernel panic.\n\nAn IPv4 header with ihl \u003c 5 is malformed by definition (RFC 791:\n\"Internet Header Length is the length of the internet header in\n32 bit words ... Note that the minimum value for a correct header\nis 5.\"). The kernel should not be willing to inject such a\npacket into its own output path.\n\nReject \"iphlen \u003c sizeof(*iph)\" alongside the existing\n\"iphlen \u003e length\" check. This matches the principle that locally\nconstructed packets that re-enter the IP stack must pass the same\nbasic sanity tests that a foreign packet would be subjected to.\n\nOnce this lands, the \"if (iphlen \u003e= sizeof(*iph))\" wrapper around\nthe fixup branch becomes redundant; left in place to keep the\npatch minimal and backport-friendly. A follow-up can unwrap it.\n\nNote that commit 86f4c90a1c5c (\"ipv4, ipv6: ensure raw socket\nmessage is big enough to hold an IP header\") ensures the message\nbuffer is large enough to hold an iphdr, but does not constrain\nthe self-reported iph-\u003eihl.\n\nReachability: the malformed packet source is any caller with\nCAP_NET_RAW, including an unprivileged process in a user+net\nnamespace on a kernel with CONFIG_USER_NS=y. The reproduced AH\ncrash also requires a matching xfrm AH policy on the outgoing\nroute; a container granted CAP_NET_ADMIN can install that state\nand policy in its netns. Loopback bypasses xfrm_output, so the\ntrigger uses a real netdev.\n\nReproduced on UML + KASAN: kernel-mode fault at addr 0x0 with\nmemcpy_orig at the crash site. Same shape reproduces inside a\nrootless Docker container with --cap-add NET_ADMIN on a stock\ndistro kernel."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscalls (socket/sendmsg on a raw IP_HDRINCL socket); malformed packets are injected locally into the output path, not via remote network ingress which validates ihl \u003e= 5.\nAC:L - The attacker fully controls the crafted header ihl value and can install the required xfrm AH policy and route via CAP_NET_ADMIN in their own network namespace, making exploitation reliable without conditions outside attacker control.\nPR:L - Triggering requires CAP_NET_RAW for raw sockets and CAP_NET_ADMIN to install xfrm AH policy, both obtainable by an unprivileged user via user+network namespaces or a container granted NET_ADMIN without init-namespace root.\nUI:N - No victim interaction is required; the attacker sends the malformed packet directly through their own raw socket and configured IPsec policy.\nS:U - Impact is kernel memory corruption and panic within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The integer underflow in ah_output() memcpy length produces an out-of-bounds read of near SIZE_MAX bytes, providing an arbitrary kernel memory read primitive beyond any bounded disclosure.\nI:H - The same memcpy with underflowed length causes a massive out-of-bounds write that can corrupt adjacent kernel heap memory and be leveraged for control-flow hijacking.\nA:H - The OOB memcpy reliably causes a kernel-mode fault and host panic, as reproduced with KASAN and in a rootless Docker container, denying all system availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:23.263Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1065b9efa4126df559b03a849c139ecfae92cd25"
},
{
"url": "https://git.kernel.org/stable/c/bc20dbd48c26e743f7e0845020c11ed2ce8b15ee"
},
{
"url": "https://git.kernel.org/stable/c/5a564f737ec54d63e8ee221d3ff396d07586d464"
},
{
"url": "https://git.kernel.org/stable/c/3c5411fa4944ed99af3d9d1de750ea8169b6dac9"
},
{
"url": "https://git.kernel.org/stable/c/145e9afa5b905229b4788bb72c3255f5a5f77508"
},
{
"url": "https://git.kernel.org/stable/c/7725cd3b471740fd23d25ed1da722c671fb2a5d3"
},
{
"url": "https://git.kernel.org/stable/c/bbe0be67de296176e7243c76e3d9f02f6ae9ff0b"
},
{
"url": "https://git.kernel.org/stable/c/915fab69823a14c170dbaa3b41978768e0fe62fc"
}
],
"title": "ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64114",
"datePublished": "2026-07-19T15:40:14.854Z",
"dateReserved": "2026-07-19T07:54:57.035Z",
"dateUpdated": "2026-10-19T20:28:12.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68432 (GCVE-0-2026-68432)
Vulnerability from cvelistv5
Published
2026-08-12 00:07
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vxlan: require CAP_NET_ADMIN in the device netns for changelink
A tunnel changelink() operates on at most two netns, dev_net(dev) and
the sticky underlay netns vxlan->net. They differ once the device is
created in or moved to a netns other than the one the request runs in.
The rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev),
so a caller privileged there but not in vxlan->net can rewrite a vxlan
device whose underlay lives in vxlan->net.
vxlan_changelink() validates and applies the new configuration against
vxlan->net (vxlan_config_validate(vxlan->net, ...)) and can reopen the
underlay socket in that netns, so the same reasoning as the tunnel
changelink series applies here.
Gate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of
the op before any attribute is parsed, matching ipgre_changelink() and
the rest of the "require CAP_NET_ADMIN in the device netns for
changelink" series.
Found by 0sec automated security-research tooling (https://0sec.ai).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 Version: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 Version: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 Version: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 Version: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 Version: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 Version: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 Version: 8bcdc4f3a20be949df54b67e5ae2734daabb5792 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68432",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:52.480523Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:10.150Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b95a8743e58f7efed5ddc4cb73829b66f17feab0",
"status": "affected",
"version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
"versionType": "git"
},
{
"lessThan": "7465ade989ba84adc2bfa58bad3ca25d249f0f7a",
"status": "affected",
"version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
"versionType": "git"
},
{
"lessThan": "0aa580a8bbbed2507b4582a1f0ef581d480d06ed",
"status": "affected",
"version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
"versionType": "git"
},
{
"lessThan": "b3793d7dccb192ffff29894d11824db6251acdd5",
"status": "affected",
"version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
"versionType": "git"
},
{
"lessThan": "32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f",
"status": "affected",
"version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
"versionType": "git"
},
{
"lessThan": "730c7e5fea7f06e0cdf21c547222ec93234fd1d6",
"status": "affected",
"version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
"versionType": "git"
},
{
"lessThan": "e8ad0d311e225939a9a6c745d6cc384c7364ec87",
"status": "affected",
"version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
"versionType": "git"
},
{
"lessThan": "3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e",
"status": "affected",
"version": "8bcdc4f3a20be949df54b67e5ae2734daabb5792",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe sticky underlay netns vxlan-\u003enet. They differ once the device is\ncreated in or moved to a netns other than the one the request runs in.\nThe rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev),\nso a caller privileged there but not in vxlan-\u003enet can rewrite a vxlan\ndevice whose underlay lives in vxlan-\u003enet.\n\nvxlan_changelink() validates and applies the new configuration against\nvxlan-\u003enet (vxlan_config_validate(vxlan-\u003enet, ...)) and can reopen the\nunderlay socket in that netns, so the same reasoning as the tunnel\nchangelink series applies here.\n\nGate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of\nthe op before any attribute is parsed, matching ipgre_changelink() and\nthe rest of the \"require CAP_NET_ADMIN in the device netns for\nchangelink\" series.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires issuing an RTM_NEWLINK changelink request over an rtnetlink socket on the local system, matching the kernel guidance that netlink configuration paths are Local.\nAC:L - Once a cross-namespace vxlan device is present in the caller\u0027s netns, the missing check is bypassed by a single deterministic netlink changelink call with no race, timing, or memory-layout dependency.\nPR:L - The rtnl entry path only requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user obtains inside a user namespace via unshare --user --map-root-user --net; no privilege in the underlay netns vxlan-\u003enet is needed.\nUI:N - The attack is fully programmatic through netlink from the attacker\u0027s own process; no victim action such as mounting, opening a file, or clicking is required.\nS:C - Authorization is evaluated against dev_net(dev) while the configuration is validated and applied against vxlan-\u003enet, so the impact crosses from the attacker\u0027s net/user namespace into another tenant\u0027s or the host\u0027s network namespace.\nC:H - The attacker can rewrite IFLA_VXLAN_GROUP/LOCAL and the underlay IFLA_VXLAN_LINK so encapsulated overlay traffic in the victim netns is sent to an attacker-controlled endpoint, exposing tunneled payloads.\nI:H - Unauthorized changelink mutates live tunnel state in the victim underlay netns (remote/local addresses, lower device, TOS/TTL/label, learning and proxy/RSC flags, default-remote FDB entries), enabling redirection and injection of overlay traffic.\nA:H - Rewriting the remote group, source address, or lower device tears down and re-establishes multicast group membership and forwarding state, causing sustained loss of connectivity for every service riding the affected VXLAN overlay."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:35:30.743Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b95a8743e58f7efed5ddc4cb73829b66f17feab0"
},
{
"url": "https://git.kernel.org/stable/c/7465ade989ba84adc2bfa58bad3ca25d249f0f7a"
},
{
"url": "https://git.kernel.org/stable/c/0aa580a8bbbed2507b4582a1f0ef581d480d06ed"
},
{
"url": "https://git.kernel.org/stable/c/b3793d7dccb192ffff29894d11824db6251acdd5"
},
{
"url": "https://git.kernel.org/stable/c/32d10c46bfde3e9b274e9e1bd6399d0ebea8f60f"
},
{
"url": "https://git.kernel.org/stable/c/730c7e5fea7f06e0cdf21c547222ec93234fd1d6"
},
{
"url": "https://git.kernel.org/stable/c/e8ad0d311e225939a9a6c745d6cc384c7364ec87"
},
{
"url": "https://git.kernel.org/stable/c/3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e"
}
],
"title": "vxlan: require CAP_NET_ADMIN in the device netns for changelink",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68432",
"datePublished": "2026-08-12T00:07:18.806Z",
"dateReserved": "2026-07-30T09:28:09.393Z",
"dateUpdated": "2026-10-19T21:09:10.150Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68428 (GCVE-0-2026-68428)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-08-19 16:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mmu: Fix use-after-free on vendor module reload
mmu_destroy_caches() destroys pte_list_desc_cache and
mmu_page_header_cache, but leaves both pointers unchanged. The pointers
live in kvm.ko, and therefore survive when a vendor module is unloaded
while kvm.ko remains loaded.
If creation of pte_list_desc_cache fails during a subsequent vendor
module load, its assignment sets pte_list_desc_cache to NULL and the
error path calls mmu_destroy_caches(). mmu_page_header_cache still
points to the cache destroyed during the preceding vendor module
unload. Passing that stale pointer to kmem_cache_destroy() causes a
slab use-after-free.
Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y,
CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A
one-shot test hook forces pte_list_desc_cache to NULL on the second
invocation of kvm_mmu_vendor_module_init():
1. Load kvm.ko and kvm-intel.ko, creating both caches.
2. Unload only kvm_intel, leaving kvm.ko loaded.
3. Reload kvm_intel and force initialization through the -ENOMEM path.
KASAN reports:
BUG: KASAN: slab-use-after-free in
kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
...
kmem_cache_destroy+0x21/0x1d0
kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
...
Allocated by task 16817:
__kmem_cache_create_args+0x12c/0x3b0
__kmem_cache_create.constprop.0+0xb6/0xf0 [kvm]
kvm_mmu_vendor_module_init+0x13b/0x170 [kvm]
...
Freed by task 16820:
kmem_cache_destroy+0x117/0x1d0
kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]
Clear both pointers immediately after destroying their caches so that
the stored state reflects the caches' lifetime and repeated cleanup is
safe.
With the fix applied, the same injected vendor module reload fails with
-ENOMEM as expected and produces no KASAN report.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cb498ea2ce1d3f3c0bc0a2522241dca10263e437 Version: cb498ea2ce1d3f3c0bc0a2522241dca10263e437 Version: cb498ea2ce1d3f3c0bc0a2522241dca10263e437 Version: cb498ea2ce1d3f3c0bc0a2522241dca10263e437 Version: cb498ea2ce1d3f3c0bc0a2522241dca10263e437 Version: cb498ea2ce1d3f3c0bc0a2522241dca10263e437 Version: cb498ea2ce1d3f3c0bc0a2522241dca10263e437 Version: cb498ea2ce1d3f3c0bc0a2522241dca10263e437 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/mmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "034b7fa1f5846d69eb51f12ce6d1c71871e83c2d",
"status": "affected",
"version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
"versionType": "git"
},
{
"lessThan": "42272b0f239f3a89f9c26a01cc37aee06138b1b7",
"status": "affected",
"version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
"versionType": "git"
},
{
"lessThan": "940950d5cd86f250dca578279ad5ca63b4e0986b",
"status": "affected",
"version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
"versionType": "git"
},
{
"lessThan": "6f4be73880302d5642c83a0813fdfe1f5fd4b6e3",
"status": "affected",
"version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
"versionType": "git"
},
{
"lessThan": "32b9f89ed9e6d7a45075d64089c254a7f6e13695",
"status": "affected",
"version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
"versionType": "git"
},
{
"lessThan": "ec9daa8fd1b6f45545c9839dca55bd867fad9e13",
"status": "affected",
"version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
"versionType": "git"
},
{
"lessThan": "43cfb20d62ffe49626d62beecfc32eb6f262191c",
"status": "affected",
"version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
"versionType": "git"
},
{
"lessThan": "52f2f7c30126037975389aa04d24c506a5177c35",
"status": "affected",
"version": "cb498ea2ce1d3f3c0bc0a2522241dca10263e437",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/mmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: Fix use-after-free on vendor module reload\n\nmmu_destroy_caches() destroys pte_list_desc_cache and\nmmu_page_header_cache, but leaves both pointers unchanged. The pointers\nlive in kvm.ko, and therefore survive when a vendor module is unloaded\nwhile kvm.ko remains loaded.\n\nIf creation of pte_list_desc_cache fails during a subsequent vendor\nmodule load, its assignment sets pte_list_desc_cache to NULL and the\nerror path calls mmu_destroy_caches(). mmu_page_header_cache still\npoints to the cache destroyed during the preceding vendor module\nunload. Passing that stale pointer to kmem_cache_destroy() causes a\nslab use-after-free.\n\nReproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y,\nCONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A\none-shot test hook forces pte_list_desc_cache to NULL on the second\ninvocation of kvm_mmu_vendor_module_init():\n\n 1. Load kvm.ko and kvm-intel.ko, creating both caches.\n 2. Unload only kvm_intel, leaving kvm.ko loaded.\n 3. Reload kvm_intel and force initialization through the -ENOMEM path.\n\nKASAN reports:\n\n BUG: KASAN: slab-use-after-free in\n kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]\n ...\n kmem_cache_destroy+0x21/0x1d0\n kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]\n ...\n Allocated by task 16817:\n __kmem_cache_create_args+0x12c/0x3b0\n __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm]\n kvm_mmu_vendor_module_init+0x13b/0x170 [kvm]\n ...\n Freed by task 16820:\n kmem_cache_destroy+0x117/0x1d0\n kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]\n\nClear both pointers immediately after destroying their caches so that\nthe stored state reflects the caches\u0027 lifetime and repeated cleanup is\nsafe.\n\nWith the fix applied, the same injected vendor module reload fails with\n-ENOMEM as expected and produces no KASAN report."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:35:25.214Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/034b7fa1f5846d69eb51f12ce6d1c71871e83c2d"
},
{
"url": "https://git.kernel.org/stable/c/42272b0f239f3a89f9c26a01cc37aee06138b1b7"
},
{
"url": "https://git.kernel.org/stable/c/940950d5cd86f250dca578279ad5ca63b4e0986b"
},
{
"url": "https://git.kernel.org/stable/c/6f4be73880302d5642c83a0813fdfe1f5fd4b6e3"
},
{
"url": "https://git.kernel.org/stable/c/32b9f89ed9e6d7a45075d64089c254a7f6e13695"
},
{
"url": "https://git.kernel.org/stable/c/ec9daa8fd1b6f45545c9839dca55bd867fad9e13"
},
{
"url": "https://git.kernel.org/stable/c/43cfb20d62ffe49626d62beecfc32eb6f262191c"
},
{
"url": "https://git.kernel.org/stable/c/52f2f7c30126037975389aa04d24c506a5177c35"
}
],
"title": "KVM: x86/mmu: Fix use-after-free on vendor module reload",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68428",
"datePublished": "2026-08-10T12:04:48.905Z",
"dateReserved": "2026-07-30T09:28:09.393Z",
"dateUpdated": "2026-08-19T16:35:25.214Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72036 (GCVE-0-2026-72036)
Vulnerability from cvelistv5
Published
2026-08-15 05:51
Modified
2026-10-19 21:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
multiq_dequeue() takes a packet from a band's child with a direct
->dequeue() call after multiq_peek() peeked it. When the child is
non-work-conserving the peek stashes the skb in the child's gso_skb, so
the direct dequeue returns a different skb and orphans the stash,
desyncing the child's qlen/backlog. With a qfq child reached through a
peeking parent (e.g. tbf) this re-enters the child on an emptied list and
dereferences NULL, panicking the kernel from softirq on ordinary egress.
Take the packet through qdisc_dequeue_peeked(), as sch_prio already does
and as sch_red and sch_sfb were just fixed to do. The helper is a no-op
when the child has no stash, so a work-conserving child is unaffected.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72036",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:50:31.248558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:24.167Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_multiq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "eb1a9637f0bd84b5db8803af65dfb1f44785406f",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "7a5a1582710981ef6637de9f074a60a5b1d63222",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "86a61e46a1919e8abf4d227c204773dabb24068a",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "1b9cc255e8089606b92b2adf504e334573682821",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "5889064919a1e5c0a9469c54895000414fc46944",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "fffeb2ab5eeb823d4c2330571a098f63237c9049",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "54f6b0c843e228d499eb4b6bbb89df68cad9ad5d",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_multiq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked\n\nmultiq_dequeue() takes a packet from a band\u0027s child with a direct\n-\u003edequeue() call after multiq_peek() peeked it. When the child is\nnon-work-conserving the peek stashes the skb in the child\u0027s gso_skb, so\nthe direct dequeue returns a different skb and orphans the stash,\ndesyncing the child\u0027s qlen/backlog. With a qfq child reached through a\npeeking parent (e.g. tbf) this re-enters the child on an emptied list and\ndereferences NULL, panicking the kernel from softirq on ordinary egress.\n\nTake the packet through qdisc_dequeue_peeked(), as sch_prio already does\nand as sch_red and sch_sfb were just fixed to do. The helper is a no-op\nwhen the child has no stash, so a work-conserving child is unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires locally installing a tbf\u2192multiq\u2192qfq hierarchy on a multiqueue netdev via RTM_NEWQDISC/tc netlink before egress can hit multiq_dequeue(); per kernel CNA guidance, tc/qdisc configuration bugs are Local even though the panic fires from softirq during packet transmission.\nAC:L - Once the hierarchy exists, the peek/dequeue mismatch is a deterministic logic bug: tbf peek stashes the QFQ child\u0027s skb in gso_skb, then multiq_dequeue\u0027s direct child-\u003edequeue() bypasses that stash and re-enters QFQ on an emptied list; ping reproducers for sch_red/sfb show no race or layout dependency.\nPR:L - RTM_NEWQDISC and qdisc grafting are gated by netlink_net_capable(skb, CAP_NET_ADMIN) in rtnetlink_rcv_msg, evaluated against net-\u003euser_ns; unprivileged users obtain CAP_NET_ADMIN via user/network namespaces (unshare -Urn) without init-namespace root.\nUI:N - No victim interaction is needed after qdisc setup; triggering the NULL dereference requires only attacker-generated egress traffic (e.g., ping) through the defective tbf\u2192multiq\u2192qfq dequeue path.\nS:U - The qlen/backlog desync, orphaned gso_skb stash, and resulting kernel panic occur entirely within the host kernel packet scheduler; no VM, IOMMU, or sandbox security boundary is crossed.\nC:H - Peek stashes the skb in the non-work-conserving child\u0027s gso_skb while direct dequeue returns a different packet, desyncing qlen/backlog\u2014the same scheduler-accounting corruption primitive seen in prior net/sched CVEs and capable of exposing corrupted or freed kernel scheduler memory.\nI:H - Orphaning the gso_skb stash corrupts parent/child queue linkage and QFQ aggregate scheduling state; inconsistent qlen drives invalid list operations in qfq_dequeue, yielding attacker-influenced memory corruption beyond the demonstrated NULL dereference.\nA:H - The desync re-enters QFQ on an emptied aggregate list and dereferences NULL in qfq_dequeue from softirq during ordinary egress, panicking the kernel as documented in the fix commit and matching KASAN null-ptr-deref traces in the related sch_red/sch_sfb reports."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:39:39.361Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a"
},
{
"url": "https://git.kernel.org/stable/c/eb1a9637f0bd84b5db8803af65dfb1f44785406f"
},
{
"url": "https://git.kernel.org/stable/c/7a5a1582710981ef6637de9f074a60a5b1d63222"
},
{
"url": "https://git.kernel.org/stable/c/86a61e46a1919e8abf4d227c204773dabb24068a"
},
{
"url": "https://git.kernel.org/stable/c/1b9cc255e8089606b92b2adf504e334573682821"
},
{
"url": "https://git.kernel.org/stable/c/5889064919a1e5c0a9469c54895000414fc46944"
},
{
"url": "https://git.kernel.org/stable/c/fffeb2ab5eeb823d4c2330571a098f63237c9049"
},
{
"url": "https://git.kernel.org/stable/c/54f6b0c843e228d499eb4b6bbb89df68cad9ad5d"
}
],
"title": "net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72036",
"datePublished": "2026-08-15T05:51:57.012Z",
"dateReserved": "2026-08-09T03:40:39.901Z",
"dateUpdated": "2026-10-19T21:19:24.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74297 (GCVE-0-2026-74297)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix undefined shift of user RQ WQE size
set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on
the user-provided rq_wqe_shift, which is only checked to be greater than
32, so shifts of 32 are still accepted. A shift of 31 also overflows a
signed integer, leading to undefined behavior.
Use check_shl_overflow() to compute the RQ WQE size and reject any
invalid values.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c Version: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c Version: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c Version: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c Version: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c Version: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c Version: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c Version: e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74297",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:52:40.390681Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:31.425Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mlx5/qp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9fff54929cc00849d738faa99f06c32399aeb026",
"status": "affected",
"version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
"versionType": "git"
},
{
"lessThan": "b746f949c2ac2b041102836095d6d4a2ef21fa75",
"status": "affected",
"version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
"versionType": "git"
},
{
"lessThan": "c1dbf52d24a8cb1aa56780ba51b72e7d495f258c",
"status": "affected",
"version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
"versionType": "git"
},
{
"lessThan": "6fc874fdfb366bfb11c62e6af9a831c8be59ddda",
"status": "affected",
"version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
"versionType": "git"
},
{
"lessThan": "42f3d2c8c18b92ea33e506a38b64f1a8986c2823",
"status": "affected",
"version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
"versionType": "git"
},
{
"lessThan": "4b87a2497276a72fd63028e7419abf0fb7ed837b",
"status": "affected",
"version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
"versionType": "git"
},
{
"lessThan": "b732db02a2b04cde393638df19de6251ce62a74e",
"status": "affected",
"version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
"versionType": "git"
},
{
"lessThan": "d881d60223aac8fdc12b227d89c76e131e92a9cd",
"status": "affected",
"version": "e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mlx5/qp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.11"
},
{
"lessThan": "3.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix undefined shift of user RQ WQE size\n\nset_rq_size() computes the RQ WQE size as \"1 \u003c\u003c rq_wqe_shift\" based on\nthe user-provided rq_wqe_shift, which is only checked to be greater than\n32, so shifts of 32 are still accepted. A shift of 31 also overflows a\nsigned integer, leading to undefined behavior.\n\nUse check_shl_overflow() to compute the RQ WQE size and reject any\ninvalid values."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local ioctl on /dev/infiniband/uverbs to IB_USER_VERBS_CMD_CREATE_QP; malicious rq_wqe_shift is supplied in mlx5_ib_create_qp userspace data, not from remote RDMA/InfiniBand wire traffic.\nAC:L - An attacker with uverbs access can deterministically pass rq_wqe_shift values 31 or 32 in create_qp driver udata; no races or victim state beyond opening the device and issuing the ioctl are required.\nPR:L - Only local access to the RDMA character device is required (typically rdma group membership on HPC/AI cloud GPU nodes), not init-namespace root; this matches basic local user capability rather than administrator privilege.\nUI:N - No victim interaction is needed; the attacker triggers the flaw entirely through their own create_qp ioctl with crafted mlx5_ib_create_qp fields.\nS:U - Impact stays within the kernel and RDMA context of the attacking process/tenant; it is not a VM-hypervisor or cross-security-authority boundary escape despite using a network-capable NIC.\nC:H - Integer overflow/undefined shift can undersize ib_umem registration while hardware is programmed with a huge RQ stride, enabling out-of-bounds DMA reads and kernel/user memory disclosure beyond the registered queue buffer.\nI:H - Corrupted max_gs (e.g. negative from shift 31) bypasses scatter/gather limits in post_recv, and undersized buffers with oversized hardware stride allow out-of-bounds writes and exploitable memory corruption.\nA:H - Undefined signed shifts and inconsistent queue sizing can cause kernel oops/panic during QP setup or later queue operations, and misprogrammed hardware can hang or crash the host under active RDMA use."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:45:36.087Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9fff54929cc00849d738faa99f06c32399aeb026"
},
{
"url": "https://git.kernel.org/stable/c/b746f949c2ac2b041102836095d6d4a2ef21fa75"
},
{
"url": "https://git.kernel.org/stable/c/c1dbf52d24a8cb1aa56780ba51b72e7d495f258c"
},
{
"url": "https://git.kernel.org/stable/c/6fc874fdfb366bfb11c62e6af9a831c8be59ddda"
},
{
"url": "https://git.kernel.org/stable/c/42f3d2c8c18b92ea33e506a38b64f1a8986c2823"
},
{
"url": "https://git.kernel.org/stable/c/4b87a2497276a72fd63028e7419abf0fb7ed837b"
},
{
"url": "https://git.kernel.org/stable/c/b732db02a2b04cde393638df19de6251ce62a74e"
},
{
"url": "https://git.kernel.org/stable/c/d881d60223aac8fdc12b227d89c76e131e92a9cd"
}
],
"title": "RDMA/mlx5: Fix undefined shift of user RQ WQE size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74297",
"datePublished": "2026-08-15T05:58:01.414Z",
"dateReserved": "2026-08-15T05:44:03.882Z",
"dateUpdated": "2026-10-16T18:55:31.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68289 (GCVE-0-2026-68289)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-10-03 10:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
In tipc_recvmsg(), the copy length is computed as:
copy = min_t(int, dlen - offset, buflen);
buflen is size_t but min_t(int, ...) casts it to int. When buflen
exceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it
wraps negative, wins the comparison, and the negative copy length
propagates to simple_copy_to_iter() where int-to-size_t promotion
makes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the
same pattern.
Kernel panic - not syncing: kernel: panic_on_warn set ...
RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521)
Call Trace:
__skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402)
skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534)
tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934)
io_recvmsg+0x47e/0xda0
Fix by changing min_t(int, ...) to min_t(size_t, ...) in both
functions. The result is always <= (dlen - offset), which is bounded
by TIPC maximum message size (0x1ffff bytes), so the implicit
narrowing on assignment to int copy is always safe.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e9f8b10101c6da3ab000a2fb17162374c9bd2c69 Version: e9f8b10101c6da3ab000a2fb17162374c9bd2c69 Version: e9f8b10101c6da3ab000a2fb17162374c9bd2c69 Version: e9f8b10101c6da3ab000a2fb17162374c9bd2c69 Version: e9f8b10101c6da3ab000a2fb17162374c9bd2c69 Version: e9f8b10101c6da3ab000a2fb17162374c9bd2c69 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9fd4f92671146b068809b6c34b50346cb30cf8f7",
"status": "affected",
"version": "e9f8b10101c6da3ab000a2fb17162374c9bd2c69",
"versionType": "git"
},
{
"lessThan": "93580911f02d1f4a506ec0a6fc4354140c53ffe8",
"status": "affected",
"version": "e9f8b10101c6da3ab000a2fb17162374c9bd2c69",
"versionType": "git"
},
{
"lessThan": "1b6066313b9b8fac870483bf7a26d6bd56579747",
"status": "affected",
"version": "e9f8b10101c6da3ab000a2fb17162374c9bd2c69",
"versionType": "git"
},
{
"lessThan": "7364014fdc289225229eb08de8bcbf4580e78e4d",
"status": "affected",
"version": "e9f8b10101c6da3ab000a2fb17162374c9bd2c69",
"versionType": "git"
},
{
"lessThan": "fe9bf32bb18f2d35789d4960fb007d1059bbaa38",
"status": "affected",
"version": "e9f8b10101c6da3ab000a2fb17162374c9bd2c69",
"versionType": "git"
},
{
"lessThan": "47f42ff521b4eeb46e82f9a46a4783a99f7570d7",
"status": "affected",
"version": "e9f8b10101c6da3ab000a2fb17162374c9bd2c69",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()\n\nIn tipc_recvmsg(), the copy length is computed as:\n\n copy = min_t(int, dlen - offset, buflen);\n\nbuflen is size_t but min_t(int, ...) casts it to int. When buflen\nexceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it\nwraps negative, wins the comparison, and the negative copy length\npropagates to simple_copy_to_iter() where int-to-size_t promotion\nmakes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the\nsame pattern.\n\n Kernel panic - not syncing: kernel: panic_on_warn set ...\n RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521)\n Call Trace:\n __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402)\n skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534)\n tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934)\n io_recvmsg+0x47e/0xda0\n\nFix by changing min_t(int, ...) to min_t(size_t, ...) in both\nfunctions. The result is always \u003c= (dlen - offset), which is bounded\nby TIPC maximum message size (0x1ffff bytes), so the implicit\nnarrowing on assignment to int copy is always safe."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T10:55:45.132Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9fd4f92671146b068809b6c34b50346cb30cf8f7"
},
{
"url": "https://git.kernel.org/stable/c/93580911f02d1f4a506ec0a6fc4354140c53ffe8"
},
{
"url": "https://git.kernel.org/stable/c/1b6066313b9b8fac870483bf7a26d6bd56579747"
},
{
"url": "https://git.kernel.org/stable/c/7364014fdc289225229eb08de8bcbf4580e78e4d"
},
{
"url": "https://git.kernel.org/stable/c/fe9bf32bb18f2d35789d4960fb007d1059bbaa38"
},
{
"url": "https://git.kernel.org/stable/c/47f42ff521b4eeb46e82f9a46a4783a99f7570d7"
}
],
"title": "tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68289",
"datePublished": "2026-08-10T12:02:22.101Z",
"dateReserved": "2026-07-30T09:28:09.380Z",
"dateUpdated": "2026-10-03T10:55:45.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23443 (GCVE-0-2026-23443)
Vulnerability from cvelistv5
Published
2026-04-03 15:15
Modified
2026-05-11 22:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: processor: Fix previous acpi_processor_errata_piix4() fix
After commi f132e089fe89 ("ACPI: processor: Fix NULL-pointer dereference
in acpi_processor_errata_piix4()"), device pointers may be dereferenced
after dropping references to the device objects pointed to by them,
which may cause a use-after-free to occur.
Moreover, debug messages about enabling the errata may be printed
if the errata flags corresponding to them are unset.
Address all of these issues by moving message printing to the points
in the code where the errata flags are set.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 06724a60cfa9767ea90b0f5d3dfb5cdd251b64f5 Version: ad86ac604f8391c0212a91412d4f764c7a85f254 Version: 01e8751b37a366b1ca561add0042f2ceb18c03bf Version: b803811485ac0b2f774b6bf3abc8b999ba3b7033 Version: 29f60d3d06818d40118a30d663231f027ae87a05 Version: 0398b641be2b66c2fc7e0163c606ef19372e7ad5 Version: f132e089fe89cadc2098991f0a3cb05c3f824ac6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpi_processor.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68408e8f9e366ad9850a66ac65cb569f13bf6cd4",
"status": "affected",
"version": "06724a60cfa9767ea90b0f5d3dfb5cdd251b64f5",
"versionType": "git"
},
{
"lessThan": "2e369ba9eb7b8a06e9cc35a3e7fe73e59272f8c2",
"status": "affected",
"version": "ad86ac604f8391c0212a91412d4f764c7a85f254",
"versionType": "git"
},
{
"lessThan": "edf4c2aaee08e8fd503fbae705c801e92a0b55d7",
"status": "affected",
"version": "01e8751b37a366b1ca561add0042f2ceb18c03bf",
"versionType": "git"
},
{
"lessThan": "e0c470049344e9346fff79d7e2362212c216665e",
"status": "affected",
"version": "b803811485ac0b2f774b6bf3abc8b999ba3b7033",
"versionType": "git"
},
{
"lessThan": "98473309a36acc271009b85e0bb53a4c0dddf5c2",
"status": "affected",
"version": "29f60d3d06818d40118a30d663231f027ae87a05",
"versionType": "git"
},
{
"lessThan": "8583f62259e1b315d5239371adfb36939cdab741",
"status": "affected",
"version": "0398b641be2b66c2fc7e0163c606ef19372e7ad5",
"versionType": "git"
},
{
"lessThan": "bf504b229cb8d534eccbaeaa23eba34c05131e25",
"status": "affected",
"version": "f132e089fe89cadc2098991f0a3cb05c3f824ac6",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpi_processor.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5.15.203",
"status": "affected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThan": "6.1.167",
"status": "affected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThan": "6.6.130",
"status": "affected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThan": "6.12.78",
"status": "affected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThan": "6.18.20",
"status": "affected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThan": "6.19.10",
"status": "affected",
"version": "6.19.6",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15.202",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "6.1.165",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.6.128",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.12.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "6.18.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "6.19.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: processor: Fix previous acpi_processor_errata_piix4() fix\n\nAfter commi f132e089fe89 (\"ACPI: processor: Fix NULL-pointer dereference\nin acpi_processor_errata_piix4()\"), device pointers may be dereferenced\nafter dropping references to the device objects pointed to by them,\nwhich may cause a use-after-free to occur.\n\nMoreover, debug messages about enabling the errata may be printed\nif the errata flags corresponding to them are unset.\n\nAddress all of these issues by moving message printing to the points\nin the code where the errata flags are set."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:07:00.396Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/68408e8f9e366ad9850a66ac65cb569f13bf6cd4"
},
{
"url": "https://git.kernel.org/stable/c/2e369ba9eb7b8a06e9cc35a3e7fe73e59272f8c2"
},
{
"url": "https://git.kernel.org/stable/c/edf4c2aaee08e8fd503fbae705c801e92a0b55d7"
},
{
"url": "https://git.kernel.org/stable/c/e0c470049344e9346fff79d7e2362212c216665e"
},
{
"url": "https://git.kernel.org/stable/c/98473309a36acc271009b85e0bb53a4c0dddf5c2"
},
{
"url": "https://git.kernel.org/stable/c/8583f62259e1b315d5239371adfb36939cdab741"
},
{
"url": "https://git.kernel.org/stable/c/bf504b229cb8d534eccbaeaa23eba34c05131e25"
}
],
"title": "ACPI: processor: Fix previous acpi_processor_errata_piix4() fix",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23443",
"datePublished": "2026-04-03T15:15:27.698Z",
"dateReserved": "2026-01-13T15:37:46.018Z",
"dateUpdated": "2026-05-11T22:07:00.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52977 (GCVE-0-2026-52977)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
During wait-requeue-pi (task A) and requeue-PI (task B) the following
race can happen:
Task A Task B
futex_wait_requeue_pi()
futex_setup_timer()
futex_do_wait()
futex_requeue()
CLASS(hb, hb1)(&key1);
CLASS(hb, hb2)(&key2);
*timeout*
futex_requeue_pi_wakeup_sync()
requeue_state = Q_REQUEUE_PI_IGNORE
*blocks on hb->lock*
futex_proxy_trylock_atomic()
futex_requeue_pi_prepare()
Q_REQUEUE_PI_IGNORE => -EAGAIN
double_unlock_hb(hb1, hb2)
*retry*
Task B acquires both hb locks and attempts to acquire the PI-lock of the
top most waiter (task B). Task A is leaving early due to a signal/
timeout and started removing itself from the queue. It updates its
requeue_state but can not remove it from the list because this requires
the hb lock which is owned by task B.
Usually task A is able to swoop the lock after task B unlocked it.
However if task B is of higher priority then task A may not be able to
wake up in time and acquire the lock before task B gets it again.
Especially on a UP system where A is never scheduled.
As a result task A blocks on the lock and task B busy loops, trying to
make progress but live locks the system instead. Tragic.
This can be fixed by removing the top most waiter from the list in this
case. This allows task B to grab the next top waiter (if any) in the
next iteration and make progress.
Remove the top most waiter if futex_requeue_pi_prepare() fails.
Let the waiter conditionally remove itself from the list in
handle_early_requeue_pi_wakeup().
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/futex/requeue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e5dbae3572757cecc3d3ec7cf96cbcc9cd9f016c",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "4e0ed44e51727d56244a822ab941efe507c47966",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "e3f95b1ba242e37093305812df7fdbe7288a43ac",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "0aacb6d18f76552e3e0ee25d9f40d21b3486f4cf",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "69a7cfc66405aeaa2483147653d031b3592ffc9c",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "0304d60abb9dcc02bc7fe6d1850f4ca206e8f1a0",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "bc7304f3ae20972d11db6e0b1b541c63feda5f05",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/futex/requeue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Prevent lockup in requeue-PI during signal/ timeout wakeup\n\nDuring wait-requeue-pi (task A) and requeue-PI (task B) the following\nrace can happen:\n\n Task A Task B\n futex_wait_requeue_pi()\n futex_setup_timer()\n futex_do_wait()\n futex_requeue()\n CLASS(hb, hb1)(\u0026key1);\n CLASS(hb, hb2)(\u0026key2);\n *timeout*\n futex_requeue_pi_wakeup_sync()\n requeue_state = Q_REQUEUE_PI_IGNORE\n\n *blocks on hb-\u003elock*\n\n futex_proxy_trylock_atomic()\n futex_requeue_pi_prepare()\n Q_REQUEUE_PI_IGNORE =\u003e -EAGAIN\n double_unlock_hb(hb1, hb2)\n *retry*\n\nTask B acquires both hb locks and attempts to acquire the PI-lock of the\ntop most waiter (task B). Task A is leaving early due to a signal/\ntimeout and started removing itself from the queue. It updates its\nrequeue_state but can not remove it from the list because this requires\nthe hb lock which is owned by task B.\n\nUsually task A is able to swoop the lock after task B unlocked it.\nHowever if task B is of higher priority then task A may not be able to\nwake up in time and acquire the lock before task B gets it again.\nEspecially on a UP system where A is never scheduled.\n\nAs a result task A blocks on the lock and task B busy loops, trying to\nmake progress but live locks the system instead. Tragic.\n\nThis can be fixed by removing the top most waiter from the list in this\ncase. This allows task B to grab the next top waiter (if any) in the\nnext iteration and make progress.\n\nRemove the top most waiter if futex_requeue_pi_prepare() fails.\nLet the waiter conditionally remove itself from the list in\nhandle_early_requeue_pi_wakeup()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:04.076Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e5dbae3572757cecc3d3ec7cf96cbcc9cd9f016c"
},
{
"url": "https://git.kernel.org/stable/c/4e0ed44e51727d56244a822ab941efe507c47966"
},
{
"url": "https://git.kernel.org/stable/c/e3f95b1ba242e37093305812df7fdbe7288a43ac"
},
{
"url": "https://git.kernel.org/stable/c/0aacb6d18f76552e3e0ee25d9f40d21b3486f4cf"
},
{
"url": "https://git.kernel.org/stable/c/69a7cfc66405aeaa2483147653d031b3592ffc9c"
},
{
"url": "https://git.kernel.org/stable/c/0304d60abb9dcc02bc7fe6d1850f4ca206e8f1a0"
},
{
"url": "https://git.kernel.org/stable/c/bc7304f3ae20972d11db6e0b1b541c63feda5f05"
}
],
"title": "futex: Prevent lockup in requeue-PI during signal/ timeout wakeup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52977",
"datePublished": "2026-06-24T16:28:53.937Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-08-19T16:28:04.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-40277 (GCVE-0-2025-40277)
Vulnerability from cvelistv5
Published
2025-12-06 21:51
Modified
2026-08-05 12:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
This data originates from userspace and is used in buffer offset
calculations which could potentially overflow causing an out-of-bounds
access.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8ce75f8ab9044fe11caaaf2b2c82471023212f9f Version: 8ce75f8ab9044fe11caaaf2b2c82471023212f9f Version: 8ce75f8ab9044fe11caaaf2b2c82471023212f9f Version: 8ce75f8ab9044fe11caaaf2b2c82471023212f9f Version: 8ce75f8ab9044fe11caaaf2b2c82471023212f9f Version: 8ce75f8ab9044fe11caaaf2b2c82471023212f9f Version: 8ce75f8ab9044fe11caaaf2b2c82471023212f9f Version: 8ce75f8ab9044fe11caaaf2b2c82471023212f9f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-40277",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T19:51:12.603019Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T19:51:24.946Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e58559845021c3bad5e094219378b869157fad53",
"status": "affected",
"version": "8ce75f8ab9044fe11caaaf2b2c82471023212f9f",
"versionType": "git"
},
{
"lessThan": "54d458b244893e47bda52ec3943fdfbc8d7d068b",
"status": "affected",
"version": "8ce75f8ab9044fe11caaaf2b2c82471023212f9f",
"versionType": "git"
},
{
"lessThan": "709e5c088f9c99a5cf2c1d1c6ce58f2cca7ab173",
"status": "affected",
"version": "8ce75f8ab9044fe11caaaf2b2c82471023212f9f",
"versionType": "git"
},
{
"lessThan": "a3abb54c27b2c393c44362399777ad2f6e1ff17e",
"status": "affected",
"version": "8ce75f8ab9044fe11caaaf2b2c82471023212f9f",
"versionType": "git"
},
{
"lessThan": "b5df9e06eed3df6a4f5c6f8453013b0cabb927b4",
"status": "affected",
"version": "8ce75f8ab9044fe11caaaf2b2c82471023212f9f",
"versionType": "git"
},
{
"lessThan": "5aea2cde03d4247cdcf53f9ab7d0747c9dca1cfc",
"status": "affected",
"version": "8ce75f8ab9044fe11caaaf2b2c82471023212f9f",
"versionType": "git"
},
{
"lessThan": "f3f3a8eb3f0ba799fae057091d8c67cca12d6fa0",
"status": "affected",
"version": "8ce75f8ab9044fe11caaaf2b2c82471023212f9f",
"versionType": "git"
},
{
"lessThan": "32b415a9dc2c212e809b7ebc2b14bc3fbda2b9af",
"status": "affected",
"version": "8ce75f8ab9044fe11caaaf2b2c82471023212f9f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.302",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.247",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.197",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.159",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.117",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.302",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.247",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.197",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.159",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.117",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.59",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.9",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE\n\nThis data originates from userspace and is used in buffer offset\ncalculations which could potentially overflow causing an out-of-bounds\naccess."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through the DRM_IOCTL_VMW_EXECBUF ioctl on the local vmwgfx device/render node (/dev/dri/renderD*), requiring local system access. There is no network or remote path into the command verifier.\nAC:L - The attacker fully and deterministically controls header-\u003esize in the command stream they submit; setting it to 0xFFFFFFF8..0xFFFFFFFF reliably wraps the 32-bit size computation and bypasses the size_remaining check every time. No race, timing window, or uncontrollable precondition is involved.\nPR:L - VMW_EXECBUF is declared DRM_RENDER_ALLOW and vmwgfx sets DRIVER_RENDER, so no DRM master or authentication is needed \u2014 any unprivileged local user with access to the render node (standard for graphics/desktop users and containers in VMware guests) can submit commands.\nUI:N - The attacker triggers the flaw entirely on their own by issuing the execbuf ioctl with a crafted SVGA3D command header. No victim action or interaction is required.\nS:U - The integer overflow and the resulting out-of-bounds accesses occur within the guest kernel\u0027s own address space and are confined to the kernel\u0027s security authority. No hypervisor, IOMMU, or sandbox boundary is crossed by the kernel-side defect itself.\nC:H - The unchecked header-\u003esize drives pointer arithmetic in vmw_cmd_dma(), vmw_cmd_draw(), and vmw_cmd_tex_state(), producing large out-of-bounds reads of adjacent kernel memory whose contents are interpreted as resource handles; success/failure of vmw_user_resource_lookup_handle() forms a scanning oracle over kernel heap contents, so arbitrary kernel memory disclosure is achievable.\nI:H - The same overflow yields out-of-bounds writes \u2014 vmw_cmd_dma() writes bo_size into suffix-\u003emaximumOffset past the buffer, and OOB-derived relocation offsets cause vmw_resource_relocations_apply() to write 32-bit resource IDs outside the command buffer. Controlled heap corruption of this kind is a standard path to privilege escalation.\nA:H - A header-\u003esize of 0xFFFFFFF8 makes *size zero, causing vmw_cmd_check_all() to spin forever while holding dev_priv-\u003ecmdbuf_mutex, and the far out-of-bounds reads past a vmalloc\u0027d bounce buffer hit a guard page and oops the kernel. Either outcome is a full denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:09:09.886Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e58559845021c3bad5e094219378b869157fad53"
},
{
"url": "https://git.kernel.org/stable/c/54d458b244893e47bda52ec3943fdfbc8d7d068b"
},
{
"url": "https://git.kernel.org/stable/c/709e5c088f9c99a5cf2c1d1c6ce58f2cca7ab173"
},
{
"url": "https://git.kernel.org/stable/c/a3abb54c27b2c393c44362399777ad2f6e1ff17e"
},
{
"url": "https://git.kernel.org/stable/c/b5df9e06eed3df6a4f5c6f8453013b0cabb927b4"
},
{
"url": "https://git.kernel.org/stable/c/5aea2cde03d4247cdcf53f9ab7d0747c9dca1cfc"
},
{
"url": "https://git.kernel.org/stable/c/f3f3a8eb3f0ba799fae057091d8c67cca12d6fa0"
},
{
"url": "https://git.kernel.org/stable/c/32b415a9dc2c212e809b7ebc2b14bc3fbda2b9af"
}
],
"title": "drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40277",
"datePublished": "2025-12-06T21:51:00.437Z",
"dateReserved": "2025-04-16T07:20:57.184Z",
"dateUpdated": "2026-08-05T12:09:09.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64333 (GCVE-0-2026-64333)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: digi_acceleport: fix write buffer corruption
The digi_write_inb_command() is supposed to wait for the write urb to
become available or return an error, but instead it updates the transfer
buffer and tries to resubmit the urb on timeout.
To make things worse, for commands like break control where no timeout
is used, the driver would corrupt the urb immediately due to a broken
jiffies comparison (on 32-bit machines this takes five minutes of uptime
to trigger due to INITIAL_JIFFIES).
Fix this by adding the missing return on timeout and waiting
indefinitely when no timeout has been specified as intended.
This issue was (sort of) flagged by Sashiko when reviewing an unrelated
change to the driver.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64333",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:39:14.688855Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:24.312Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/digi_acceleport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5d9dc88bdf8897788b0eed57113e9eca7fd42ea9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2f296974acc279f05f284441bfe3064074958d11",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e60e4873e9178da9f4f2674e4c2ff085d5a84f79",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "699dfb6917503b3cda4d5da6941cf79c3c1b4c8b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a274b3794fe1852c3d9fe6d900b94053c0b03410",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1243f120790042c2ac92e84e797dacc75fff4366",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a3a13fdc53103b07335918e2cdeb465038a71725",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "24ca1fea8f2753bf33e1d458ec1ae5d9b7796a65",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/digi_acceleport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: digi_acceleport: fix write buffer corruption\n\nThe digi_write_inb_command() is supposed to wait for the write urb to\nbecome available or return an error, but instead it updates the transfer\nbuffer and tries to resubmit the urb on timeout.\n\nTo make things worse, for commands like break control where no timeout\nis used, the driver would corrupt the urb immediately due to a broken\njiffies comparison (on 32-bit machines this takes five minutes of uptime\nto trigger due to INITIAL_JIFFIES).\n\nFix this by adding the missing return on timeout and waiting\nindefinitely when no timeout has been specified as intended.\n\nThis issue was (sort of) flagged by Sashiko when reviewing an unrelated\nchange to the driver."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached locally through write() followed by ioctl(TIOCCBRK) on an open Digi ttyUSB device; the attached adapter is a platform prerequisite rather than the attack entry point.\nAC:L - The attacker controls both URB submission and the competing break command and can repeat the sequence or stall transmission to widen the window. No uncontrollable race or memory layout is required.\nPR:L - No capability check exists in the ioctl path; the attacker only needs ordinary user-level permission to access the tty device node.\nUI:N - The attacker can open, write to, and issue the ioctl without another user performing any action.\nS:U - Compromise remains within the host kernel\u0027s security authority and is a standard local kernel privilege escalation rather than a VM, IOMMU, or distinct-scope escape.\nC:H - On controller-local-memory HCDs, the changed length can make USB completion restore the transfer-buffer pointer from attacker-controlled payload bytes. The resulting kernel-write and code-execution primitive can expose arbitrary kernel memory.\nI:H - A subsequent tty write dereferences the attacker-selected transfer-buffer pointer, providing an attacker-directed kernel overwrite with largely controlled contents. This can corrupt control data and plausibly achieve kernel code execution.\nA:H - The corrupted kernel pointer can immediately cause an oops or panic, while exploitation of the arbitrary overwrite can crash or hang the entire kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:36.100Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5d9dc88bdf8897788b0eed57113e9eca7fd42ea9"
},
{
"url": "https://git.kernel.org/stable/c/2f296974acc279f05f284441bfe3064074958d11"
},
{
"url": "https://git.kernel.org/stable/c/e60e4873e9178da9f4f2674e4c2ff085d5a84f79"
},
{
"url": "https://git.kernel.org/stable/c/699dfb6917503b3cda4d5da6941cf79c3c1b4c8b"
},
{
"url": "https://git.kernel.org/stable/c/a274b3794fe1852c3d9fe6d900b94053c0b03410"
},
{
"url": "https://git.kernel.org/stable/c/1243f120790042c2ac92e84e797dacc75fff4366"
},
{
"url": "https://git.kernel.org/stable/c/a3a13fdc53103b07335918e2cdeb465038a71725"
},
{
"url": "https://git.kernel.org/stable/c/24ca1fea8f2753bf33e1d458ec1ae5d9b7796a65"
}
],
"title": "USB: serial: digi_acceleport: fix write buffer corruption",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64333",
"datePublished": "2026-07-25T08:49:59.616Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-10-19T20:38:24.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74495 (GCVE-0-2026-74495)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
igbvf: Fix leak in TX DMA error cleanup
If an error is encountered while mapping TX buffers, the driver should
unmap any buffers already mapped for that skb.
Because count is incremented before each frag mapping, it will always
match the correct number of unmappings needed when dma_error is reached.
Decrementing count before the while loop in dma_error causes an
off-by-one error. If any mapping was successful before an unsuccessful
mapping, exactly one DMA mapping (the head) would leak.
This bug was introduced by a 2010 fix for an endless loop in dma_error.
All other affected drivers have already been fixed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74495",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:58:15.486916Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:50.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/igbvf/netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e42b7225c45f57b42306b80cdd3bda202bae7293",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "e3ed89c257f6361f13df23023cd10ace830330ad",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "56726ff12cb6759ab90d6f5332c2377aeca7d249",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "31089f4eab42e0fc248ec80c26f9b0bad59ba4cc",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "bc25d56c03e41c10bc4b40e99ca5d7b941675c04",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "845a9cdd9b03b7b6fa8de3ee80579780350a7f65",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "df07003b5a6c6c9fce60d765d6a3da815a74c41c",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "0565052b7e2f436b7f1541f4849da96dc0aa7a0e",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/igbvf/netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.33"
},
{
"lessThan": "2.6.33",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigbvf: Fix leak in TX DMA error cleanup\n\nIf an error is encountered while mapping TX buffers, the driver should\nunmap any buffers already mapped for that skb.\n\nBecause count is incremented before each frag mapping, it will always\nmatch the correct number of unmappings needed when dma_error is reached.\nDecrementing count before the while loop in dma_error causes an\noff-by-one error. If any mapping was successful before an unsuccessful\nmapping, exactly one DMA mapping (the head) would leak.\n\nThis bug was introduced by a 2010 fix for an endless loop in dma_error.\nAll other affected drivers have already been fixed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the igbvf VF transmit path reached whenever egress skbs are queued, including fragmented replies or forwarded traffic from remote peers on SR-IOV cloud/tenant networks with internet-facing VFs.\nAC:L - No race is required; an attacker can repeatedly drive fragmented TX skbs and SWIOTLB/DMA-mapping pressure until skb_frag_dma_map fails after a successful head map, deterministically hitting the off-by-one dma_error cleanup.\nPR:N - Reaching ndo_start_xmit via normal sockets on the VF requires no kernel capabilities; co-tenant or internet-facing traffic can induce the leaky dma_error path without local credentials on the victim.\nUI:N - No victim interaction is needed beyond the VF carrying traffic; the leak occurs automatically in dma_error cleanup during transmit once mapping failure conditions are met.\nS:U - Impact is confined to the kernel/DMA resources of the guest or host running igbvf and does not by itself cross a hypervisor, IOMMU isolation, or separate security authority boundary.\nC:H - The error path frees the skb while its head DMA/IOMMU mapping remains in buffer_info, so freed pages can be reallocated while still mapped, enabling plausible kernel memory disclosure via stale DMA state.\nI:H - Reusing the descriptor slot without unmapping the leaked head mapping corrupts driver/IOMMU metadata and accumulates orphan mappings, a defensible path to driver heap corruption or write primitives.\nA:H - Each leaked TX DMA/IOMMU mapping consumes finite SWIOTLB/IOMMU resources; repeated triggering can exhaust mappings and break transmit or disable the VF entirely."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:53.097Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e42b7225c45f57b42306b80cdd3bda202bae7293"
},
{
"url": "https://git.kernel.org/stable/c/e3ed89c257f6361f13df23023cd10ace830330ad"
},
{
"url": "https://git.kernel.org/stable/c/56726ff12cb6759ab90d6f5332c2377aeca7d249"
},
{
"url": "https://git.kernel.org/stable/c/31089f4eab42e0fc248ec80c26f9b0bad59ba4cc"
},
{
"url": "https://git.kernel.org/stable/c/bc25d56c03e41c10bc4b40e99ca5d7b941675c04"
},
{
"url": "https://git.kernel.org/stable/c/845a9cdd9b03b7b6fa8de3ee80579780350a7f65"
},
{
"url": "https://git.kernel.org/stable/c/df07003b5a6c6c9fce60d765d6a3da815a74c41c"
},
{
"url": "https://git.kernel.org/stable/c/0565052b7e2f436b7f1541f4849da96dc0aa7a0e"
}
],
"title": "igbvf: Fix leak in TX DMA error cleanup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74495",
"datePublished": "2026-08-15T12:27:23.229Z",
"dateReserved": "2026-08-15T05:44:03.906Z",
"dateUpdated": "2026-10-16T19:05:50.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74705 (GCVE-0-2026-74705)
Vulnerability from cvelistv5
Published
2026-08-22 15:33
Modified
2026-10-16 19:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
udp: fix potential use-after-free in tunnel segmentation
__skb_udp_tunnel_segment() gets the UDP header before ensuring the
tunnel header is in the skb head. If the pull reallocates skb->head,
the saved UDP header pointer is no longer valid.
Get the UDP header after the pull to avoid a potential use-after-free.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74705",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:15:04.524382Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:10.609Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp_offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6a733a38b983d8c2e222f13968209010cf44de87",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "19d89b13a43640b2da2f277ee462d919d988cb6f",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "b3df61bb745eb5201eac22679a2839d4ccbf3442",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "1ae134c012e10384cdac420b5cc6e0615cde0b55",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "5161e67c561c4f28a5d9335a6e859b02511de92b",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "64d322c288577793eedd352b96ef75234ed380fe",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "588d4a6795d99d080f74ef0b5f391ea8c453ae5d",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "d0f86fb36eb260abd10007b62c9dcc1028e03e61",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp_offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: fix potential use-after-free in tunnel segmentation\n\n__skb_udp_tunnel_segment() gets the UDP header before ensuring the\ntunnel header is in the skb head. If the pull reallocates skb-\u003ehead,\nthe saved UDP header pointer is no longer valid.\n\nGet the UDP header after the pull to avoid a potential use-after-free."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Remote peers reach __skb_udp_tunnel_segment on egress when GRO-coalesced VXLAN/Geneve/FOU GSO superpackets are forwarded or re-encapsulated through dev_queue_xmit, and malicious virtio-net/cloud tenants can inject VIRTIO_NET_HDR_GSO_UDP_TUNNEL frames the host later segments on physical or overlay NICs.\nAC:L - Triggering is deterministic once a GSO UDP-tunnel skb has tunnel headers beyond skb_headlen so pskb_may_pull reallocates skb-\u003ehead; attackers control that layout via fragmented or GRO-built outer/encap headers and can repeat crafted sends until segmentation dereferences the stale UDP pointer.\nPR:N - No host authentication or credentials are required to send UDP tunnel traffic to listening overlay ports on cloud/DC nodes, and co-resident virtio-net guests or tenant VMs can emit GSO UDP-tunnel frames into the host datapath without CAP_NET_ADMIN on the victim host.\nUI:N - Exploitation needs only crafted encapsulated GSO traffic into an already-running overlay, bridge, IPVS, OVS, or virtio forwarding path; no victim file open, mount, link click, or other interactive action beyond normal network or VM I/O.\nS:C - In cloud/Kubernetes and virtio-net multitenant deployments, remote or guest/tenant senders can corrupt hypervisor kernel heap during host-side UDP-tunnel GSO segmentation on egress, crossing the VM/container-to-host security boundary rather than staying within the attacker\u0027s own namespace.\nC:H - After pskb_may_pull reallocates skb-\u003ehead, the pre-pull udp_hdr pointer is stale yet uh-\u003elen and uh-\u003echeck are read for checksum adjustment, yielding a classic heap use-after-free read primitive that can disclose kernel memory and support further exploitation.\nI:H - UAF on the UDP header allows attacker-influenced heap reuse and corruption of header fields and checksum state during tunnel GSO segmentation, providing a write/control primitive suitable for kernel code execution rather than a benign checksum miscalculation.\nA:H - Dereferencing the freed UDP header during GSO segmentation can immediately oops or panic the kernel, and repeated exploitation attempts against this UAF commonly crash or hang the host even when full control is not achieved."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:48.767Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87"
},
{
"url": "https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f"
},
{
"url": "https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442"
},
{
"url": "https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55"
},
{
"url": "https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b"
},
{
"url": "https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe"
},
{
"url": "https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d"
},
{
"url": "https://git.kernel.org/stable/c/d0f86fb36eb260abd10007b62c9dcc1028e03e61"
}
],
"title": "udp: fix potential use-after-free in tunnel segmentation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74705",
"datePublished": "2026-08-22T15:33:04.110Z",
"dateReserved": "2026-08-15T05:44:03.927Z",
"dateUpdated": "2026-10-16T19:16:10.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72296 (GCVE-0-2026-72296)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ife: require ETH_HLEN to be pullable in ife_decode()
ife decode may return after making only the outer IFE header and
metadata pullable. The caller then passes the decapsulated packet to
eth_type_trans(), which expects the inner Ethernet header to be
accessible from the linear data area.
With a malformed IFE frame, the inner Ethernet header may still be
shorter than ETH_HLEN in the linear area, which can lead to a crash in
the original code.
Fix this by extending the pull check in ife_decode() so that the inner
Ethernet header is also guaranteed to be pullable before returning.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ef6980b6becb1afd9d82a4f043749a10ae81bf14 Version: ef6980b6becb1afd9d82a4f043749a10ae81bf14 Version: ef6980b6becb1afd9d82a4f043749a10ae81bf14 Version: ef6980b6becb1afd9d82a4f043749a10ae81bf14 Version: ef6980b6becb1afd9d82a4f043749a10ae81bf14 Version: ef6980b6becb1afd9d82a4f043749a10ae81bf14 Version: ef6980b6becb1afd9d82a4f043749a10ae81bf14 Version: ef6980b6becb1afd9d82a4f043749a10ae81bf14 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72296",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:45:54.972693Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:15.361Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ife/ife.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "70013f9163bef7fbd9fa62f81cf91b2a7ba66163",
"status": "affected",
"version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
"versionType": "git"
},
{
"lessThan": "be272e159dfe1207b67332ad6e17adcf59b4ea4b",
"status": "affected",
"version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
"versionType": "git"
},
{
"lessThan": "8c8818e52fddb247ff3214622401a4de6ff8482e",
"status": "affected",
"version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
"versionType": "git"
},
{
"lessThan": "9433578bff9c100c466a6354574892e55293cb8f",
"status": "affected",
"version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
"versionType": "git"
},
{
"lessThan": "1cb42ec10294a55380e52e674b3df2b962648242",
"status": "affected",
"version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
"versionType": "git"
},
{
"lessThan": "5526d1997aea6c9bd865ca4d4894b52e799d735c",
"status": "affected",
"version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
"versionType": "git"
},
{
"lessThan": "b69ad768cd4a2ef4e07c18492ae85438ed17c7cb",
"status": "affected",
"version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
"versionType": "git"
},
{
"lessThan": "9406f6012b7343661efb516a11c62d4db2b62f75",
"status": "affected",
"version": "ef6980b6becb1afd9d82a4f043749a10ae81bf14",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ife/ife.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ife: require ETH_HLEN to be pullable in ife_decode()\n\nife decode may return after making only the outer IFE header and\nmetadata pullable. The caller then passes the decapsulated packet to\neth_type_trans(), which expects the inner Ethernet header to be\naccessible from the linear data area.\n\nWith a malformed IFE frame, the inner Ethernet header may still be\nshorter than ETH_HLEN in the linear area, which can lead to a crash in\nthe original code.\n\nFix this by extending the pull check in ife_decode() so that the inner\nEthernet header is also guaranteed to be pullable before returning."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is hit on the ingress packet receive path (__netif_receive_skb_core\u2192sch_handle_ingress\u2192tc_run\u2192tcf_ife_act\u2192ife_decode) when a remote peer sends a malformed IFE-encapsulated Ethernet frame to a netdev with clsact/ingress IFE decode, as in SDN/NFV/ForCES edge nodes.\nAC:L - Once ingress IFE decode is present, the attacker fully controls the crafted frame (metalen, metadata size, and skb layout) to leave the inner Ethernet header non-linear or shorter than ETH_HLEN, deterministically reaching eth_type_trans() without races or uncontrollable memory layout.\nPR:N - Remote exploitation needs no credentials or capabilities on the victim\u2014only delivery of a malformed frame to an interface already configured with IFE decode; CAP_NET_ADMIN is an operator deployment prerequisite, not attacker privilege (same model as pre-configured nftables offload bugs).\nUI:N - No victim user action is required beyond normal network delivery of attacker-crafted IFE traffic; exploitation does not depend on mounting, opening files, or administrator interaction at attack time.\nS:U - Impact is confined to kernel packet-processing memory within the same kernel security authority; this is not a VM escape, IOMMU bypass, or cross-namespace scope change.\nC:H - eth_type_trans() reads the inner struct ethhdr (h_dest/h_proto) via eth_skb_pull_mac()/eth_skb_pkt_type() without ensuring ETH_HLEN bytes are linear, causing an out-of-bounds kernel read that can disclose adjacent skb/page memory beyond a few bytes.\nI:N - The defect is a missing pskb_may_pull() bounds check leading to out-of-bounds reads and crash; there is no write, UAF, or demonstrated arbitrary modification or control-flow hijack primitive.\nA:H - The fix commit states malformed IFE frames can crash the kernel; accessing a non-linear or undersized inner Ethernet header in eth_type_trans() can trigger KASAN faults, oops, or panic on the softirq receive path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:42:29.172Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/70013f9163bef7fbd9fa62f81cf91b2a7ba66163"
},
{
"url": "https://git.kernel.org/stable/c/be272e159dfe1207b67332ad6e17adcf59b4ea4b"
},
{
"url": "https://git.kernel.org/stable/c/8c8818e52fddb247ff3214622401a4de6ff8482e"
},
{
"url": "https://git.kernel.org/stable/c/9433578bff9c100c466a6354574892e55293cb8f"
},
{
"url": "https://git.kernel.org/stable/c/1cb42ec10294a55380e52e674b3df2b962648242"
},
{
"url": "https://git.kernel.org/stable/c/5526d1997aea6c9bd865ca4d4894b52e799d735c"
},
{
"url": "https://git.kernel.org/stable/c/b69ad768cd4a2ef4e07c18492ae85438ed17c7cb"
},
{
"url": "https://git.kernel.org/stable/c/9406f6012b7343661efb516a11c62d4db2b62f75"
}
],
"title": "net: ife: require ETH_HLEN to be pullable in ife_decode()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72296",
"datePublished": "2026-08-15T05:55:17.250Z",
"dateReserved": "2026-08-09T03:40:39.917Z",
"dateUpdated": "2026-10-16T18:55:15.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31502 (GCVE-0-2026-31502)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-10-19 18:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
team: fix header_ops type confusion with non-Ethernet ports
Similar to commit 950803f72547 ("bonding: fix type confusion in
bond_setup_by_slave()") team has the same class of header_ops type
confusion.
For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops
directly. When the team device later calls dev_hard_header() or
dev_parse_header(), these callbacks can run with the team net_device
instead of the real lower device, so netdev_priv(dev) is interpreted as
the wrong private type and can crash.
The syzbot report shows a crash in bond_header_create(), but the root
cause is in team: the topology is gre -> bond -> team, and team calls
the inherited header_ops with its own net_device instead of the lower
device, so bond_header_create() receives a team device and interprets
netdev_priv() as bonding private data, causing a type confusion crash.
Fix this by introducing team header_ops wrappers for create/parse,
selecting a team port under RCU, and calling the lower device callbacks
with port->dev, so each callback always sees the correct net_device
context.
Also pass the selected lower device to the lower parse callback, so
recursion is bounded in stacked non-Ethernet topologies and parse
callbacks always run with the correct device context.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31502",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:10:14.938095Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:45:53.793Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53",
"status": "affected",
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"versionType": "git"
},
{
"lessThan": "6d3161fa3eee64d46b766fb0db33ec7f300ef52d",
"status": "affected",
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"versionType": "git"
},
{
"lessThan": "0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0",
"status": "affected",
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"versionType": "git"
},
{
"lessThan": "20491d384d973a63fbdaf7a71e38d69b0659ea55",
"status": "affected",
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"versionType": "git"
},
{
"lessThan": "425000dbf17373a4ab8be9428f5dc055ef870a56",
"status": "affected",
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix header_ops type confusion with non-Ethernet ports\n\nSimilar to commit 950803f72547 (\"bonding: fix type confusion in\nbond_setup_by_slave()\") team has the same class of header_ops type\nconfusion.\n\nFor non-Ethernet ports, team_setup_by_port() copies port_dev-\u003eheader_ops\ndirectly. When the team device later calls dev_hard_header() or\ndev_parse_header(), these callbacks can run with the team net_device\ninstead of the real lower device, so netdev_priv(dev) is interpreted as\nthe wrong private type and can crash.\n\nThe syzbot report shows a crash in bond_header_create(), but the root\ncause is in team: the topology is gre -\u003e bond -\u003e team, and team calls\nthe inherited header_ops with its own net_device instead of the lower\ndevice, so bond_header_create() receives a team device and interprets\nnetdev_priv() as bonding private data, causing a type confusion crash.\n\nFix this by introducing team header_ops wrappers for create/parse,\nselecting a team port under RCU, and calling the lower device callbacks\nwith port-\u003edev, so each callback always sees the correct net_device\ncontext.\n\nAlso pass the selected lower device to the lower parse callback, so\nrecursion is bounded in stacked non-Ethernet topologies and parse\ncallbacks always run with the correct device context."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An attacker reaches the vulnerable team header_ops path by locally creating/enslaving network devices through rtnetlink and then triggering dev_hard_header()/dev_parse_header() via local packet/socket or network-stack activity on the malformed team device. The required setup is a local kernel networking configuration path rather than an unauthenticated packet-processing path.\nAC:L - The vulnerable topology, such as GRE -\u003e bond -\u003e team, is fully attacker-controlled once the required namespace capabilities are available, and triggering the bad callback is deterministic. There is no race or external timing condition required.\nPR:L - Creating team/bond/GRE devices and enslaving them requires CAP_NET_ADMIN, and packet sockets require CAP_NET_RAW, but both are available to an unprivileged user inside a user and network namespace on systems permitting unprivileged user namespaces. This is therefore low privileges, not real init-namespace root.\nUI:N - No victim interaction is required after the attacker has local access and namespace capabilities. The attacker can configure the devices and trigger the callback directly.\nS:U - The impact is within the same kernel security authority. This is a kernel crash/type-confusion or privilege-impact issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a header_ops type confusion where callbacks interpret team private data as another subsystem\u0027s private structure, causing attacker-influenced kernel pointer dereferences and potential kernel memory exposure. Following the higher-severity rule for type confusion, confidentiality impact is high.\nI:H - Type confusion in kernel callback dispatch can lead to misinterpreted object pointers and potentially control-flow or write-primitive exploitation beyond the observed crash. Kernel type confusion is scored as high integrity impact.\nA:H - The reported and expected failure mode is a kernel oops/BUG/crash when the inherited callback uses the wrong net_device private layout. This gives high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:05.931Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53"
},
{
"url": "https://git.kernel.org/stable/c/6d3161fa3eee64d46b766fb0db33ec7f300ef52d"
},
{
"url": "https://git.kernel.org/stable/c/0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0"
},
{
"url": "https://git.kernel.org/stable/c/20491d384d973a63fbdaf7a71e38d69b0659ea55"
},
{
"url": "https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"
}
],
"title": "team: fix header_ops type confusion with non-Ethernet ports",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31502",
"datePublished": "2026-04-22T13:54:22.481Z",
"dateReserved": "2026-03-09T15:48:24.104Z",
"dateUpdated": "2026-10-19T18:45:53.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68198 (GCVE-0-2026-68198)
Vulnerability from cvelistv5
Published
2026-08-10 12:00
Modified
2026-10-19 18:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath6kl: fix use-after-free in aggr_reset_state()
The aggr_reset_state() function uses timer_delete() (non-synchronous)
for the aggregation timer before proceeding to delete TID state and
before the structure is freed by callers like aggr_module_destroy().
If the timer callback (aggr_timeout) is executing when aggr_reset_state()
is called, the callback will continue to access aggr_conn fields like
rx_tid[] and stat[] which may be freed immediately after by
kfree(aggr_info->aggr_conn) in aggr_module_destroy().
Additionally, the timer callback can re-arm itself via mod_timer() while
aggr_reset_state() is running, creating a more complex race condition.
Use timer_delete_sync() instead to ensure any running timer callback
has completed before returning.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bdcd81707973cf8aa9305337166f8ee842a050d4 Version: bdcd81707973cf8aa9305337166f8ee842a050d4 Version: bdcd81707973cf8aa9305337166f8ee842a050d4 Version: bdcd81707973cf8aa9305337166f8ee842a050d4 Version: bdcd81707973cf8aa9305337166f8ee842a050d4 Version: bdcd81707973cf8aa9305337166f8ee842a050d4 Version: bdcd81707973cf8aa9305337166f8ee842a050d4 Version: bdcd81707973cf8aa9305337166f8ee842a050d4 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68198",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:45:39.924585Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:00:24.933Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath6kl/txrx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a1bac650b2d6b1baab1f3e78e2e007a6e2948dde",
"status": "affected",
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
"versionType": "git"
},
{
"lessThan": "2132a6db05846dd2318857d00e0c1291f9e41b29",
"status": "affected",
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
"versionType": "git"
},
{
"lessThan": "17ff29cd8dbc977c97788a5f7c011ec807b58242",
"status": "affected",
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
"versionType": "git"
},
{
"lessThan": "64af6534a085f49d6ed33338a19ab9cf0d0523c9",
"status": "affected",
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
"versionType": "git"
},
{
"lessThan": "b5d618fd61b9069b4c0a6b487022dd3117ad5acc",
"status": "affected",
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
"versionType": "git"
},
{
"lessThan": "18965470d41e69d3fc10eb62afae29d10f4cdfd1",
"status": "affected",
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
"versionType": "git"
},
{
"lessThan": "a3313111b5d9046af60b370c93eec105b27380c1",
"status": "affected",
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
"versionType": "git"
},
{
"lessThan": "ba7debb4dd6427386862220e8335a53a4bfc235d",
"status": "affected",
"version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath6kl/txrx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\n\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\n\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info-\u003eaggr_conn) in aggr_module_destroy().\n\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - ath6kl is a WiFi driver; the race is driven by 802.11 frames from an adjacent attacker \u2014 a gapped A-MPDU sequence arms the reorder timer and a deauth/disassoc or connect/disconnect event drives aggr_reset_state() via ath6kl_disconnect_event()/ath6kl_connect_event()/ath6kl_sta_cleanup(). This requires radio proximity, not routable network access.\nAC:L - The attacker controls both sides of the race: transmitting out-of-order aggregated frames arms aggr_conn-\u003etimer, and a deauth/disassoc or reconnect immediately invokes aggr_reset_state(), which frees rx_tid[].hold_q and (via aggr_module_destroy) aggr_conn itself while aggr_timeout() may be running or re-arming via mod_timer(). The sequence can be repeated indefinitely until the window is hit.\nPR:N - No privileges or account on the target system are required; a rogue AP the client associates with, or an attacker injecting unprotected deauth/disassoc frames at a station with an active block-ack session, is sufficient. In AP mode, a station joining an open network can trigger the same path on disconnect.\nUI:N - The station already associated and receiving aggregated traffic is enough; deauth/disassoc handling and the resulting aggr_reset_state() run automatically in the driver with no action by the device owner.\nS:U - The use-after-free is on kernel heap memory owned by the ath6kl driver and stays within the kernel\u0027s own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed aggr_info_conn and hold_q allocations can be reclaimed and refilled with attacker-influenced data (e.g. sk_buff payloads from injected frames), so the concurrent callback reading rx_tid[]/stat[]/hold_q[] yields a controllable read primitive that can leak kernel memory contents.\nI:H - aggr_timeout() writes through the freed object \u2014 setting timer_scheduled, rxtid-\u003etimer_mon, dequeuing skbs from hold_q[] and calling mod_timer() on a freed timer_list \u2014 giving arbitrary writes into reclaimed heap objects and list corruption that is a classic path to control-flow hijack.\nA:H - Even without successful heap grooming, the use-after-free and the double-free/dangling-skb access in aggr_deque_frms() reliably produce slab corruption and a kernel oops or panic, and the attacker can repeat the trigger at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:06.548Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde"
},
{
"url": "https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29"
},
{
"url": "https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242"
},
{
"url": "https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9"
},
{
"url": "https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc"
},
{
"url": "https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1"
},
{
"url": "https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1"
},
{
"url": "https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d"
}
],
"title": "wifi: ath6kl: fix use-after-free in aggr_reset_state()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68198",
"datePublished": "2026-08-10T12:00:16.718Z",
"dateReserved": "2026-07-30T09:28:09.374Z",
"dateUpdated": "2026-10-19T18:00:24.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53388 (GCVE-0-2026-53388)
Vulnerability from cvelistv5
Published
2026-07-19 11:59
Modified
2026-10-19 20:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fuse: re-lock request before replacing page cache folio
fuse_try_move_folio() unlocks the request on entry but does not
re-lock it on the success path. This means fuse_chan_abort() can end the
request and free the fuse_io_args (eg fuse_readpages_end()) while the
subsequent copy chain logic after fuse_try_move_folio() accesses the
fuse_io_args, leading to use-after-free issues.
Fix this by calling lock_request() before replace_page_cache_folio().
This ensures the request is locked on the success path which will
prevent the fuse_io_args from being freed while the later copying logic
runs, and also ensures that the ap->folios[i]->mapping is never null
since ap->folios[i] will always point to the newfolio after
replace_page_cache_folio().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ce534fb052928ce556639d7ecf01cbf4e01321e1 Version: ce534fb052928ce556639d7ecf01cbf4e01321e1 Version: ce534fb052928ce556639d7ecf01cbf4e01321e1 Version: ce534fb052928ce556639d7ecf01cbf4e01321e1 Version: ce534fb052928ce556639d7ecf01cbf4e01321e1 Version: ce534fb052928ce556639d7ecf01cbf4e01321e1 Version: ce534fb052928ce556639d7ecf01cbf4e01321e1 Version: ce534fb052928ce556639d7ecf01cbf4e01321e1 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53388",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:30:00.282945Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:07:45.789Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7c18691e0cfda29672f79bafde8abdb7710674f6",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "5927b43a4f8d89e86930f524bf63e9c7e66f61b4",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "030fe3e9d8abdee303dd7e9e42f45082d382a407",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "46473ddccdc5065033e397d6e62c280dbcd3d9c2",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "af2892249d982a1c036ca456cc135374e68b6677",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "0223f452532d9cd8a5e87c45de828fd93c99bd25",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "e28db6ac4792d065ab32565fd9f0a2361c3d4666",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
},
{
"lessThan": "a078484921052d0badd827fcc2770b5cfc1d4120",
"status": "affected",
"version": "ce534fb052928ce556639d7ecf01cbf4e01321e1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: re-lock request before replacing page cache folio\n\nfuse_try_move_folio() unlocks the request on entry but does not\nre-lock it on the success path. This means fuse_chan_abort() can end the\nrequest and free the fuse_io_args (eg fuse_readpages_end()) while the\nsubsequent copy chain logic after fuse_try_move_folio() accesses the\nfuse_io_args, leading to use-after-free issues.\n\nFix this by calling lock_request() before replace_page_cache_folio().\nThis ensures the request is locked on the success path which will\nprevent the fuse_io_args from being freed while the later copying logic\nruns, and also ensures that the ap-\u003efolios[i]-\u003emapping is never null\nsince ap-\u003efolios[i] will always point to the newfolio after\nreplace_page_cache_folio()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local syscalls: mounting a FUSE filesystem, reading files to trigger readpages, and the FUSE daemon writing replies to /dev/fuse via splice_write with SPLICE_F_MOVE.\nAC:L - The race is between the attacker\u0027s own splice reply and a concurrent abort they trigger (e.g., via sysfs abort or unmount); the attacker controls both threads and can retry until the window is hit.\nPR:L - Exploitation requires mounting and operating a FUSE filesystem via /dev/fuse, which needs local user privileges; on typical systems this is reachable by unprivileged users via user namespaces (CAP_SYS_ADMIN in a user namespace) without init-namespace root.\nUI:N - No victim interaction is required; the attacker mounts the filesystem, runs the FUSE daemon, and triggers the concurrent abort themselves.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as guest-to-host or sandbox breakout.\nC:H - The vulnerability is a use-after-free of fuse_io_args and associated folio pointers in kernel heap memory, which can be leveraged for arbitrary kernel memory read via heap reuse.\nI:H - Use-after-free of fuse_io_args enables heap spraying and controlled reuse of freed kernel objects, providing a path to arbitrary kernel memory write or code execution.\nA:H - The UAF and the race with folio replacement can cause kernel oops/panic, including NULL pointer dereference when fuse_readpages_end accesses a folio with a NULL mapping."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:39.284Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7c18691e0cfda29672f79bafde8abdb7710674f6"
},
{
"url": "https://git.kernel.org/stable/c/5927b43a4f8d89e86930f524bf63e9c7e66f61b4"
},
{
"url": "https://git.kernel.org/stable/c/030fe3e9d8abdee303dd7e9e42f45082d382a407"
},
{
"url": "https://git.kernel.org/stable/c/46473ddccdc5065033e397d6e62c280dbcd3d9c2"
},
{
"url": "https://git.kernel.org/stable/c/af2892249d982a1c036ca456cc135374e68b6677"
},
{
"url": "https://git.kernel.org/stable/c/0223f452532d9cd8a5e87c45de828fd93c99bd25"
},
{
"url": "https://git.kernel.org/stable/c/e28db6ac4792d065ab32565fd9f0a2361c3d4666"
},
{
"url": "https://git.kernel.org/stable/c/a078484921052d0badd827fcc2770b5cfc1d4120"
}
],
"title": "fuse: re-lock request before replacing page cache folio",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53388",
"datePublished": "2026-07-19T11:59:34.456Z",
"dateReserved": "2026-06-09T07:44:35.402Z",
"dateUpdated": "2026-10-19T20:07:45.789Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72084 (GCVE-0-2026-72084)
Vulnerability from cvelistv5
Published
2026-08-15 05:52
Modified
2026-10-19 21:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: Bound PR-OUT TransportID parsing to the received buffer
core_scsi3_decode_spec_i_port() and core_scsi3_emulate_register_and_move()
hand the raw PERSISTENT RESERVE OUT parameter buffer to
target_parse_pr_out_transport_id() without telling it how many bytes are
valid. For an iSCSI TransportID (FORMAT CODE 01b),
iscsi_parse_pr_out_transport_id() locates the ",i,0x" ISID separator with
an unbounded strstr() (and on the error path prints the name with a further
unbounded "%s"). An initiator can submit a TransportID whose iSCSI name
contains neither a ",i,0x" substring nor a NUL terminator, filling the
parameter list to its end, so the scan runs off the end of the buffer.
When the parameter list spans more than one page the buffer is a multi-page
vmap (transport_kmap_data_sg()), so the over-read walks into the trailing
vmalloc guard page and oopses (KASAN: vmalloc-out-of-bounds in strstr). It
is reachable by any fabric that delivers a PR OUT to a device exported
through an iSCSI TPG, including a guest via vhost-scsi.
Pass the number of received bytes down to the parser and validate the iSCSI
TransportID's own self-described length (ADDITIONAL LENGTH + 4) once, up
front: reject it if it is below the spc4r17 minimum or larger than the
received buffer, then bound the separator search, the ISID walk and the
name copy by that length. This is the length check the callers already
perform after the parse (core_scsi3_decode_spec_i_port() compares tid_len
against tpdl, core_scsi3_emulate_register_and_move() validates it against
data_length), moved ahead of the scan. Also drop the unbounded "%s" of the
unterminated name.
Add per-format explicit name-length checks before copying into i_str,
rather than silently truncating with min_t: for FORMAT CODE 00b reject if
the descriptor body (tid_len - 4 bytes) cannot fit in
i_str[TRANSPORT_IQN_LEN]; for FORMAT CODE 01b reject if the name portion
(from &buf[4] up to the separator) cannot fit. Both checks make the bounds
intent explicit at each format branch.
While here, also reject a FORMAT CODE 01b TransportID whose ",i,0x"
separator sits at the very end of the descriptor: that leaves an empty ISID
and points the returned port nexus pointer at buf + tid_len, one past the
descriptor, which the registration code (__core_scsi3_locate_pr_reg(),
__core_scsi3_alloc_registration()) then dereferences as the ISID string --
the same over-read of the parameter buffer for a malformed descriptor.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 Version: c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72084",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:51:41.769272Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:27.063Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_fabric_lib.c",
"drivers/target/target_core_internal.h",
"drivers/target/target_core_pr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "88c67c3de914e19172e1d878a7625c5b06c20ec5",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "842248047ef28dbf3b3f7f49a0ec315054d4dab8",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "03fbc7de8d5e85fc8420e57e8304c855efd453ab",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "6ca5de8782e67573a61a6736b6dc0ffe58dcdf59",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "9298078a8f7d8181a04614a34ab655ccdf038204",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "004ccd2d3b4ac36a300e05e01df152e5c02a5a82",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "555a89846ed888d7401b3f7200934c0fbedcbb46",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
},
{
"lessThan": "d04a179085c262c9ed577d0a4cbc6482ff1fd9a3",
"status": "affected",
"version": "c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_fabric_lib.c",
"drivers/target/target_core_internal.h",
"drivers/target/target_core_pr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Bound PR-OUT TransportID parsing to the received buffer\n\ncore_scsi3_decode_spec_i_port() and core_scsi3_emulate_register_and_move()\nhand the raw PERSISTENT RESERVE OUT parameter buffer to\ntarget_parse_pr_out_transport_id() without telling it how many bytes are\nvalid. For an iSCSI TransportID (FORMAT CODE 01b),\niscsi_parse_pr_out_transport_id() locates the \",i,0x\" ISID separator with\nan unbounded strstr() (and on the error path prints the name with a further\nunbounded \"%s\"). An initiator can submit a TransportID whose iSCSI name\ncontains neither a \",i,0x\" substring nor a NUL terminator, filling the\nparameter list to its end, so the scan runs off the end of the buffer.\n\nWhen the parameter list spans more than one page the buffer is a multi-page\nvmap (transport_kmap_data_sg()), so the over-read walks into the trailing\nvmalloc guard page and oopses (KASAN: vmalloc-out-of-bounds in strstr). It\nis reachable by any fabric that delivers a PR OUT to a device exported\nthrough an iSCSI TPG, including a guest via vhost-scsi.\n\nPass the number of received bytes down to the parser and validate the iSCSI\nTransportID\u0027s own self-described length (ADDITIONAL LENGTH + 4) once, up\nfront: reject it if it is below the spc4r17 minimum or larger than the\nreceived buffer, then bound the separator search, the ISID walk and the\nname copy by that length. This is the length check the callers already\nperform after the parse (core_scsi3_decode_spec_i_port() compares tid_len\nagainst tpdl, core_scsi3_emulate_register_and_move() validates it against\ndata_length), moved ahead of the scan. Also drop the unbounded \"%s\" of the\nunterminated name.\n\nAdd per-format explicit name-length checks before copying into i_str,\nrather than silently truncating with min_t: for FORMAT CODE 00b reject if\nthe descriptor body (tid_len - 4 bytes) cannot fit in\ni_str[TRANSPORT_IQN_LEN]; for FORMAT CODE 01b reject if the name portion\n(from \u0026buf[4] up to the separator) cannot fit. Both checks make the bounds\nintent explicit at each format branch.\n\nWhile here, also reject a FORMAT CODE 01b TransportID whose \",i,0x\"\nseparator sits at the very end of the descriptor: that leaves an empty ISID\nand points the returned port nexus pointer at buf + tid_len, one past the\ndescriptor, which the registration code (__core_scsi3_locate_pr_reg(),\n__core_scsi3_alloc_registration()) then dereferences as the ISID string --\nthe same over-read of the parameter buffer for a malformed descriptor."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is triggered by a PERSISTENT RESERVE OUT SCSI command delivered over the LIO iSCSI target fabric (TCP/3260); remote initiators reach `iscsi_parse_pr_out_transport_id()` after login and normal SCSI command processing, and the fix commit notes the same path via vhost-scsi-backed exports.\nAC:L - An attacker fully controls the PR-OUT parameter list and can reliably supply a FORMAT CODE 01b iSCSI TransportID without a \",i,0x\" separator or NUL terminator and size it past one page so `strstr()` over-reads into the vmalloc guard page; no races or victim-specific memory layout are required.\nPR:N - Exploitation requires only completing iSCSI login to an exported LUN as any initiator client, not host administrator privileges; LIO demo mode auto-provisions initiator ACLs and many storage appliances expose iSCSI targets to the network without mapping this to elevated OS credentials.\nUI:N - No end-user or administrator action beyond normal automated iSCSI target operation is needed; a remote initiator can send the malicious PR OUT command directly once a session to the LUN exists.\nS:U - The flaw corrupts or reads kernel memory and crashes the target host kernel within the same kernel security boundary; it does not by itself cross a VM, container, or IOMMU isolation boundary to another authority.\nC:H - Unbounded `strstr()` and an unbounded `%s` on the error path perform out-of-bounds reads past the received PR-OUT buffer, potentially disclosing adjacent kernel memory before the fault, matching CVSS guidance for out-of-bounds reads beyond a few bytes.\nI:H - A malformed TransportID can leave the ISID pointer one byte past the descriptor so subsequent registration code dereferences out of bounds, and the ISID normalization loop can write with `tolower()` beyond the buffer, giving a memory-corruption primitive in kernel context.\nA:H - The over-read into a multi-page vmalloc mapping hits the guard page and triggers a KASAN vmalloc-out-of-bounds fault and kernel oops, remotely denying service to the host and all consumers of the iSCSI target."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:46.221Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/88c67c3de914e19172e1d878a7625c5b06c20ec5"
},
{
"url": "https://git.kernel.org/stable/c/842248047ef28dbf3b3f7f49a0ec315054d4dab8"
},
{
"url": "https://git.kernel.org/stable/c/03fbc7de8d5e85fc8420e57e8304c855efd453ab"
},
{
"url": "https://git.kernel.org/stable/c/6ca5de8782e67573a61a6736b6dc0ffe58dcdf59"
},
{
"url": "https://git.kernel.org/stable/c/9298078a8f7d8181a04614a34ab655ccdf038204"
},
{
"url": "https://git.kernel.org/stable/c/004ccd2d3b4ac36a300e05e01df152e5c02a5a82"
},
{
"url": "https://git.kernel.org/stable/c/555a89846ed888d7401b3f7200934c0fbedcbb46"
},
{
"url": "https://git.kernel.org/stable/c/d04a179085c262c9ed577d0a4cbc6482ff1fd9a3"
}
],
"title": "scsi: target: Bound PR-OUT TransportID parsing to the received buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72084",
"datePublished": "2026-08-15T05:52:32.789Z",
"dateReserved": "2026-08-09T03:40:39.904Z",
"dateUpdated": "2026-10-19T21:19:27.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72086 (GCVE-0-2026-72086)
Vulnerability from cvelistv5
Published
2026-08-15 05:52
Modified
2026-08-17 05:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
scsiback_device_action() obtains a command tag in
scsiback_get_pend_req() and submits a task-management request with
target_submit_tmr(). When target_submit_tmr() fails it returns < 0 and
scsiback jumps to the err: label, which sends a response but frees
nothing, leaking the tag.
Impact: a pvSCSI guest can leak the command tags of a LUN's session,
stopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or RESET requests
whenever target_submit_tmr() fails.
transport_generic_free_cmd() cannot be used here. By the time
target_submit_tmr() returns an error it has already run
__target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on its
target_get_sess_cmd() error path it has freed se_cmd->se_tmr_req via
core_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and the
pointer dangling. Letting the command release run target_free_cmd_mem()
would then double-free se_tmr_req.
Use the same helper, which returns just the tag, on this path too.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2dbcdf33dbf61f44b29adb52338282c3d7840d0e Version: 2dbcdf33dbf61f44b29adb52338282c3d7840d0e Version: 2dbcdf33dbf61f44b29adb52338282c3d7840d0e Version: 2dbcdf33dbf61f44b29adb52338282c3d7840d0e Version: 2dbcdf33dbf61f44b29adb52338282c3d7840d0e Version: 2dbcdf33dbf61f44b29adb52338282c3d7840d0e Version: 2dbcdf33dbf61f44b29adb52338282c3d7840d0e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/xen/xen-scsiback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4567ce79fe2f84c3dcc3a91b22a377cf482d33ad",
"status": "affected",
"version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
"versionType": "git"
},
{
"lessThan": "6c01f0439098f00a64b246dc27479602201382f7",
"status": "affected",
"version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
"versionType": "git"
},
{
"lessThan": "18d4f86816592586b38513543b5e1f9553bc271f",
"status": "affected",
"version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
"versionType": "git"
},
{
"lessThan": "fbc1bdede66d0f2cde83b75d6524ce1a815bb69f",
"status": "affected",
"version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
"versionType": "git"
},
{
"lessThan": "255fb7b0cdc947b1c01929c7f133281342a3a6b5",
"status": "affected",
"version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
"versionType": "git"
},
{
"lessThan": "1357fb32d42ad8da193e6da285f09e6452feabda",
"status": "affected",
"version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
"versionType": "git"
},
{
"lessThan": "66aefc277ebb796ec285d550305535dc3fc0179f",
"status": "affected",
"version": "2dbcdf33dbf61f44b29adb52338282c3d7840d0e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/xen/xen-scsiback.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: xen: scsiback: Free the command tag on the TMR submit-failure path\n\nscsiback_device_action() obtains a command tag in\nscsiback_get_pend_req() and submits a task-management request with\ntarget_submit_tmr(). When target_submit_tmr() fails it returns \u003c 0 and\nscsiback jumps to the err: label, which sends a response but frees\nnothing, leaking the tag.\n\nImpact: a pvSCSI guest can leak the command tags of a LUN\u0027s session,\nstopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or RESET requests\nwhenever target_submit_tmr() fails.\n\ntransport_generic_free_cmd() cannot be used here. By the time\ntarget_submit_tmr() returns an error it has already run\n__target_init_cmd() (so se_cmd-\u003ecmd_kref is one, not zero), and on its\ntarget_get_sess_cmd() error path it has freed se_cmd-\u003ese_tmr_req via\ncore_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and the\npointer dangling. Letting the command release run target_free_cmd_mem()\nwould then double-free se_tmr_req.\n\nUse the same helper, which returns just the tag, on this path too."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:07:56.806Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4567ce79fe2f84c3dcc3a91b22a377cf482d33ad"
},
{
"url": "https://git.kernel.org/stable/c/6c01f0439098f00a64b246dc27479602201382f7"
},
{
"url": "https://git.kernel.org/stable/c/18d4f86816592586b38513543b5e1f9553bc271f"
},
{
"url": "https://git.kernel.org/stable/c/fbc1bdede66d0f2cde83b75d6524ce1a815bb69f"
},
{
"url": "https://git.kernel.org/stable/c/255fb7b0cdc947b1c01929c7f133281342a3a6b5"
},
{
"url": "https://git.kernel.org/stable/c/1357fb32d42ad8da193e6da285f09e6452feabda"
},
{
"url": "https://git.kernel.org/stable/c/66aefc277ebb796ec285d550305535dc3fc0179f"
}
],
"title": "scsi: xen: scsiback: Free the command tag on the TMR submit-failure path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72086",
"datePublished": "2026-08-15T05:52:34.822Z",
"dateReserved": "2026-08-09T03:40:39.905Z",
"dateUpdated": "2026-08-17T05:07:56.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64109 (GCVE-0-2026-64109)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without
holding any lock that prevents SKBs on that queue from being dequeued and
freed.
This has been the case since commit 79f632c71bea ("unix/stream: fix
peeking with an offset larger than data in queue").
The first consequence of this is that the pointer comparison
`tail != last` can be false even if `last` semantically refers to an
already-freed SKB while `tail` is a new SKB allocated at the same address;
which can cause unix_stream_data_wait() to wrongly keep blocking after new
data has arrived, but only in a weird scenario where a peeking recv() and
a normal recv() on the same socket are racing, which is probably not a
real problem.
But since commit 2b514574f7e8 ("net: af_unix: implement splice for stream
af_unix sockets"), `tail` is actually dereferenced, which can cause UAF in
the following race scenario (where test_setup() runs single-threaded,
and afterwards, test_thread1() and test_thread2() run concurrently in
two threads:
```
static int socks[2];
void test_setup(void) {
socketpair(AF_UNIX, SOCK_STREAM, 0, socks);
send(socks[1], "A", 1, 0);
int peekoff = 1;
setsockopt(socks[0], SOL_SOCKET, SO_PEEK_OFF, &peekoff, sizeof(peekoff));
}
void test_thread1(void) {
char dummy;
recv(socks[0], &dummy, 1, MSG_PEEK);
}
void test_thread2(void) {
char dummy;
recv(socks[0], &dummy, 1, 0);
shutdown(socks[1], SHUT_WR);
}
```
when racing like this:
```
thread1 thread2
unix_stream_read_generic
mutex_lock(&u->iolock)
skb_peek(&sk->sk_receive_queue)
skb_peek_next(skb, &sk->sk_receive_queue)
mutex_unlock(&u->iolock)
unix_stream_read_generic
unix_state_lock(sk)
skb_peek(&sk->sk_receive_queue)
unix_state_unlock(sk)
unix_stream_data_wait
unix_state_lock(sk)
tail = skb_peek_tail(&sk->sk_receive_queue)
spin_lock(&sk->sk_receive_queue.lock)
__skb_unlink(skb, &sk->sk_receive_queue)
spin_unlock(&sk->sk_receive_queue.lock)
consume_skb(skb) [frees the SKB]
`tail != last`: false
`tail`: true
`tail->len != last_len` ***UAF***
```
Fix the UAF by removing the read of tail->len; checking tail->len would
only make sense if SKBs in the receive queue of a UNIX socket could grow,
which can no longer happen.
Kuniyuki explained:
> When commit 869e7c62486e ("net: af_unix: implement stream sendpage
> support") added sendpage() support, data could be appended to the last
> skb in the receiver's queue.
>
> That's why we needed to check if the length of the last skb was changed
> while waiting for new data in unix_stream_data_wait().
>
> However, commit a0dbf5f818f9 ("af_unix: Support MSG_SPLICE_PAGES") and
> commit 57d44a354a43 ("unix: Convert unix_stream_sendpage() to use
> MSG_SPLICE_PAGES") refactored sendmsg(), and now data is always added
> to a new skb.
That means this fix is not suitable for kernels before 6.5.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:36:24.265690Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:12.212Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "26342087fac93b3932e6af61dc91ec029cb8a623",
"status": "affected",
"version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
"versionType": "git"
},
{
"lessThan": "38bccb927d83d7d52e5b20015a172a0b6101d11e",
"status": "affected",
"version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
"versionType": "git"
},
{
"lessThan": "acdff9907478e82208475b1151700d0b71dcdc63",
"status": "affected",
"version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
"versionType": "git"
},
{
"lessThan": "5f162f95a95834f06a8ec6140889272ad12e842f",
"status": "affected",
"version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
"versionType": "git"
},
{
"lessThan": "be309f8eae8b474a4a617eaae01324da996fc719",
"status": "affected",
"version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait()\n\nunix_stream_data_wait() does skb_peek_tail(\u0026sk-\u003esk_receive_queue) without\nholding any lock that prevents SKBs on that queue from being dequeued and\nfreed.\nThis has been the case since commit 79f632c71bea (\"unix/stream: fix\npeeking with an offset larger than data in queue\").\nThe first consequence of this is that the pointer comparison\n`tail != last` can be false even if `last` semantically refers to an\nalready-freed SKB while `tail` is a new SKB allocated at the same address;\nwhich can cause unix_stream_data_wait() to wrongly keep blocking after new\ndata has arrived, but only in a weird scenario where a peeking recv() and\na normal recv() on the same socket are racing, which is probably not a\nreal problem.\n\nBut since commit 2b514574f7e8 (\"net: af_unix: implement splice for stream\naf_unix sockets\"), `tail` is actually dereferenced, which can cause UAF in\nthe following race scenario (where test_setup() runs single-threaded,\nand afterwards, test_thread1() and test_thread2() run concurrently in\ntwo threads:\n```\nstatic int socks[2];\nvoid test_setup(void) {\n socketpair(AF_UNIX, SOCK_STREAM, 0, socks);\n send(socks[1], \"A\", 1, 0);\n int peekoff = 1;\n setsockopt(socks[0], SOL_SOCKET, SO_PEEK_OFF, \u0026peekoff, sizeof(peekoff));\n}\nvoid test_thread1(void) {\n char dummy;\n recv(socks[0], \u0026dummy, 1, MSG_PEEK);\n}\nvoid test_thread2(void) {\n char dummy;\n recv(socks[0], \u0026dummy, 1, 0);\n shutdown(socks[1], SHUT_WR);\n}\n```\n\nwhen racing like this:\n```\nthread1 thread2\nunix_stream_read_generic\n mutex_lock(\u0026u-\u003eiolock)\n skb_peek(\u0026sk-\u003esk_receive_queue)\n skb_peek_next(skb, \u0026sk-\u003esk_receive_queue)\n mutex_unlock(\u0026u-\u003eiolock)\n unix_stream_read_generic\n unix_state_lock(sk)\n skb_peek(\u0026sk-\u003esk_receive_queue)\n unix_state_unlock(sk)\n unix_stream_data_wait\n unix_state_lock(sk)\n tail = skb_peek_tail(\u0026sk-\u003esk_receive_queue)\n spin_lock(\u0026sk-\u003esk_receive_queue.lock)\n __skb_unlink(skb, \u0026sk-\u003esk_receive_queue)\n spin_unlock(\u0026sk-\u003esk_receive_queue.lock)\n consume_skb(skb) [frees the SKB]\n `tail != last`: false\n `tail`: true\n `tail-\u003elen != last_len` ***UAF***\n```\n\nFix the UAF by removing the read of tail-\u003elen; checking tail-\u003elen would\nonly make sense if SKBs in the receive queue of a UNIX socket could grow,\nwhich can no longer happen.\n\nKuniyuki explained:\n\n\u003e When commit 869e7c62486e (\"net: af_unix: implement stream sendpage\n\u003e support\") added sendpage() support, data could be appended to the last\n\u003e skb in the receiver\u0027s queue.\n\u003e\n\u003e That\u0027s why we needed to check if the length of the last skb was changed\n\u003e while waiting for new data in unix_stream_data_wait().\n\u003e\n\u003e However, commit a0dbf5f818f9 (\"af_unix: Support MSG_SPLICE_PAGES\") and\n\u003e commit 57d44a354a43 (\"unix: Convert unix_stream_sendpage() to use\n\u003e MSG_SPLICE_PAGES\") refactored sendmsg(), and now data is always added\n\u003e to a new skb.\n\nThat means this fix is not suitable for kernels before 6.5."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local syscalls on AF_UNIX SOCK_STREAM sockets (recvmsg, splice_read, setsockopt SO_PEEK_OFF), not via any network protocol handler.\nAC:L - The attacker controls both racing threads on the same socket fd and can retry the peek/normal-recv interleaving; this is a self-induced race, not one dependent on uncontrollable kernel state.\nPR:L - Any unprivileged local user can create AF_UNIX socketpairs, set SO_PEEK_OFF, and run concurrent recv operations without capabilities, including from within user namespaces.\nUI:N - Exploitation requires no victim interaction; the attacker sets up and races their own socket endpoints programmatically.\nS:C - Successful kernel heap UAF exploitation from an unprivileged container, Android app sandbox, or user-namespace tenant crosses the sandbox boundary to compromise the host kernel.\nC:H - This is a slab use-after-free read of sk_buff-\u003elen on freed memory, which per UAF guidance enables arbitrary kernel memory disclosure and heap layout leaks.\nI:H - UAF on sk_buff objects in the kernel heap can be leveraged through heap grooming and spraying to obtain arbitrary write and kernel code execution primitives.\nA:H - The UAF read can trigger KASAN slab-use-after-free faults, kernel oops, or panic during the dereference, and repeated triggering causes denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:18.983Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/26342087fac93b3932e6af61dc91ec029cb8a623"
},
{
"url": "https://git.kernel.org/stable/c/38bccb927d83d7d52e5b20015a172a0b6101d11e"
},
{
"url": "https://git.kernel.org/stable/c/acdff9907478e82208475b1151700d0b71dcdc63"
},
{
"url": "https://git.kernel.org/stable/c/5f162f95a95834f06a8ec6140889272ad12e842f"
},
{
"url": "https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719"
}
],
"title": "af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64109",
"datePublished": "2026-07-19T15:40:11.510Z",
"dateReserved": "2026-07-19T07:54:57.034Z",
"dateUpdated": "2026-10-19T20:28:12.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72282 (GCVE-0-2026-72282)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
kvm_io_bus_get_dev() returns a device that is only matched by the
address, and nothing else. This can cause a lifetime issue if
the matched device is not the expected type, as by the time
the caller can introspect the object, it might be gone (the srcu
lock having been dropped).
Given that there is only a single user of this helper, the simplest
option is to move the locking responsibility to the caller, which
can keep the srcu lock held for as long as it wants.
Note that this aligns with other kvm_io_bus*() helpers, which
already require the srcu lock to be held by the callers.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8a39d00670f0792c1186e442e1dd28fe0326f2ee Version: 8a39d00670f0792c1186e442e1dd28fe0326f2ee Version: 8a39d00670f0792c1186e442e1dd28fe0326f2ee Version: 8a39d00670f0792c1186e442e1dd28fe0326f2ee Version: 8a39d00670f0792c1186e442e1dd28fe0326f2ee Version: 8a39d00670f0792c1186e442e1dd28fe0326f2ee Version: 8a39d00670f0792c1186e442e1dd28fe0326f2ee Version: 8a39d00670f0792c1186e442e1dd28fe0326f2ee |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72282",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:45:38.940544Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:14.491Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic-its.c",
"virt/kvm/kvm_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f398b7d92cd999191249830b9171c9bd787a9a91",
"status": "affected",
"version": "8a39d00670f0792c1186e442e1dd28fe0326f2ee",
"versionType": "git"
},
{
"lessThan": "1b4a3c2f0509e7b0e65667f3c36676a849ee2755",
"status": "affected",
"version": "8a39d00670f0792c1186e442e1dd28fe0326f2ee",
"versionType": "git"
},
{
"lessThan": "cfe107b02a3c3f049e0dc15b6a36625f048eda2a",
"status": "affected",
"version": "8a39d00670f0792c1186e442e1dd28fe0326f2ee",
"versionType": "git"
},
{
"lessThan": "90d35d2b8e47afd68fe2a4dd0eeb60bc71641775",
"status": "affected",
"version": "8a39d00670f0792c1186e442e1dd28fe0326f2ee",
"versionType": "git"
},
{
"lessThan": "e01071ea006c9b952125ed8b0cc90ac7bd356cce",
"status": "affected",
"version": "8a39d00670f0792c1186e442e1dd28fe0326f2ee",
"versionType": "git"
},
{
"lessThan": "7099e7148f81c605bbc319b16ce0131540341560",
"status": "affected",
"version": "8a39d00670f0792c1186e442e1dd28fe0326f2ee",
"versionType": "git"
},
{
"lessThan": "0cbae0e296d27ce4c4cce83e34d40c2bfd8133aa",
"status": "affected",
"version": "8a39d00670f0792c1186e442e1dd28fe0326f2ee",
"versionType": "git"
},
{
"lessThan": "3a07249981629ace483ebbef81ef6b34c2d2afec",
"status": "affected",
"version": "8a39d00670f0792c1186e442e1dd28fe0326f2ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic-its.c",
"virt/kvm/kvm_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Move kvm_io_bus_get_dev() locking responsibilities to callers\n\nkvm_io_bus_get_dev() returns a device that is only matched by the\naddress, and nothing else. This can cause a lifetime issue if\nthe matched device is not the expected type, as by the time\nthe caller can introspect the object, it might be gone (the srcu\nlock having been dropped).\n\nGiven that there is only a single user of this helper, the simplest\noption is to move the locking responsibility to the caller, which\ncan keep the srcu lock held for as long as it wants.\n\nNote that this aligns with other kvm_io_bus*() helpers, which\nalready require the srcu lock to be held by the callers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via host-local KVM VM file descriptor ioctls (KVM_SIGNAL_MSI, KVM_IRQFD/eventfd MSI routing) and related in-kernel MSI injection paths on arm64 GICv3 ITS; there is no network, adjacent-radio, or physical-device packet path to kvm_io_bus_get_dev() or __vgic_doorbell_to_its().\nAC:L - Exploitation is a race where the attacker runs concurrent KVM_SIGNAL_MSI/irqfd MSI injection against vCPU teardown or VM shutdown that unregisters the matched MMIO device; the attacker controls both threads and can retry until the window is hit, so success does not depend on conditions outside attacker influence.\nPR:L - Triggering requires local access to a KVM VM fd (typically via /dev/kvm membership or equivalent host-local VM management rights), not remote authentication; this is low-privilege local access comparable to other namespace-reachable capabilities, not init-namespace root exclusively.\nUI:N - Exploitation is fully automated through concurrent ioctl/eventfd activity and does not require any victim user action such as opening files, mounting filesystems, or interacting with the guest.\nS:U - The vulnerable code runs in the host kernel on behalf of the VM owner/VMM; impact is host kernel memory corruption and privilege escalation within the same host security authority, not a direct guest-to-host VM escape across the guest/host boundary without prior host-side KVM access.\nC:H - This is a kernel use-after-free on a returned kvm_io_device/vgic_io_device pointer accessed after SRCU is dropped (ops pointer and container_of introspection), which can disclose kernel heap contents and be weaponized into arbitrary read primitives.\nI:H - UAF on emulated GIC MMIO device objects allows corrupting freed heap objects and hijacking function pointers/structure fields during type checking and follow-on ITS MSI handling, enabling arbitrary kernel write and local privilege escalation.\nA:H - The UAF can cause immediate kernel oops/panic from dereferencing freed kvm_io_device memory during concurrent device unregistration, and repeated triggering can reliably deny availability even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:42:17.093Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f398b7d92cd999191249830b9171c9bd787a9a91"
},
{
"url": "https://git.kernel.org/stable/c/1b4a3c2f0509e7b0e65667f3c36676a849ee2755"
},
{
"url": "https://git.kernel.org/stable/c/cfe107b02a3c3f049e0dc15b6a36625f048eda2a"
},
{
"url": "https://git.kernel.org/stable/c/90d35d2b8e47afd68fe2a4dd0eeb60bc71641775"
},
{
"url": "https://git.kernel.org/stable/c/e01071ea006c9b952125ed8b0cc90ac7bd356cce"
},
{
"url": "https://git.kernel.org/stable/c/7099e7148f81c605bbc319b16ce0131540341560"
},
{
"url": "https://git.kernel.org/stable/c/0cbae0e296d27ce4c4cce83e34d40c2bfd8133aa"
},
{
"url": "https://git.kernel.org/stable/c/3a07249981629ace483ebbef81ef6b34c2d2afec"
}
],
"title": "KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72282",
"datePublished": "2026-08-15T05:55:06.307Z",
"dateReserved": "2026-08-09T03:40:39.916Z",
"dateUpdated": "2026-10-16T18:55:14.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68141 (GCVE-0-2026-68141)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC.
If the allocation fails, nsk is NULL.
The connection-refused path is entered when the listen state check
fails, the accept backlog is full, or nsk is NULL. The code
unconditionally calls iucv_sock_kill(nsk) in that path.
iucv_sock_kill() does not accept a NULL socket pointer and immediately
dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL,
calling iucv_sock_kill(nsk) results in a NULL pointer dereference.
Only call iucv_sock_kill() when a child socket was successfully
allocated.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68141",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:44:37.607380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:53.262Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/iucv/af_iucv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6a1eb5b46c19073f8153b7e2c19b408cf353aaf1",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "c0b6e2ae90613c2fea7eaf3faa20985c6c2a1953",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "07e21deb3664001995e0a456dd627ab7dbe127ec",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "8bb111f87ded6acb9837ec9b45d6f02cda94c51f",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "46453b16f38ec7147351f7447e2aec6ea330f7b3",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "33736ff5e7c97d3348ce812e8bd2e125d840743c",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "0e857185591fe79934427c9c0c1c31dc776be134",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "47a5116e56a6b6fe1e909f244e39cd0fc26ceee4",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/iucv/af_iucv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/af_iucv: fix NULL deref in afiucv_hs_callback_syn()\n\nafiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC.\nIf the allocation fails, nsk is NULL.\n\nThe connection-refused path is entered when the listen state check\nfails, the accept backlog is full, or nsk is NULL. The code\nunconditionally calls iucv_sock_kill(nsk) in that path.\n\niucv_sock_kill() does not accept a NULL socket pointer and immediately\ndereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL,\ncalling iucv_sock_kill(nsk) results in a NULL pointer dereference.\n\nOnly call iucv_sock_kill() when a child socket was successfully\nallocated."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is reached from afiucv_hs_rcv() via dev_add_pack() when ETH_P_AF_IUCV SYN frames arrive on a HiperSockets netdev in netif RX softirq; a remote LPAR/guest on the IBM Z HiperSockets fabric can send these connection requests without local access.\nAC:L - An attacker can repeatedly send SYN packets to a listening AF_IUCV service to pressure GFP_ATOMIC socket allocations until iucv_sock_alloc() fails and the broken connection-refused path runs; no timing race or victim-specific state beyond routine memory pressure is required.\nPR:N - Exploitation requires only sending unauthenticated HiperSockets SYN traffic to a bound/listening AF_IUCV socket; the handshake path has no credential checks and the af_iucv code performs no capability or permission validation before reaching afiucv_hs_callback_syn().\nUI:N - Triggering the NULL dereference needs no action from an end user beyond a service already listening on HiperSockets; the attacker can initiate SYN packets remotely without victim interaction.\nS:U - Impact is a kernel NULL pointer dereference and likely oops/panic in the victim LPAR kernel; it does not cross a VM/host, IOMMU, or sandbox boundary to compromise a different security authority.\nC:N - The failure is an immediate NULL pointer dereference in sock_flag() inside iucv_sock_kill(); there is no memory corruption, out-of-bounds access, or use-after-free that could yield information disclosure.\nI:N - The bug does not write attacker-controlled data or corrupt kernel structures; it only dereferences a NULL socket pointer during cleanup, so no integrity impact or code-execution primitive is created.\nA:H - A NULL dereference in afiucv_hs_callback_syn() during softirq packet processing can cause a kernel oops or panic, denying all service on the affected IBM Z LPAR until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:59.584Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6a1eb5b46c19073f8153b7e2c19b408cf353aaf1"
},
{
"url": "https://git.kernel.org/stable/c/c0b6e2ae90613c2fea7eaf3faa20985c6c2a1953"
},
{
"url": "https://git.kernel.org/stable/c/07e21deb3664001995e0a456dd627ab7dbe127ec"
},
{
"url": "https://git.kernel.org/stable/c/8bb111f87ded6acb9837ec9b45d6f02cda94c51f"
},
{
"url": "https://git.kernel.org/stable/c/46453b16f38ec7147351f7447e2aec6ea330f7b3"
},
{
"url": "https://git.kernel.org/stable/c/33736ff5e7c97d3348ce812e8bd2e125d840743c"
},
{
"url": "https://git.kernel.org/stable/c/0e857185591fe79934427c9c0c1c31dc776be134"
},
{
"url": "https://git.kernel.org/stable/c/47a5116e56a6b6fe1e909f244e39cd0fc26ceee4"
}
],
"title": "net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68141",
"datePublished": "2026-08-10T11:59:05.051Z",
"dateReserved": "2026-07-30T09:28:09.370Z",
"dateUpdated": "2026-10-19T20:58:53.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64178 (GCVE-0-2026-64178)
Vulnerability from cvelistv5
Published
2026-07-19 15:41
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: bnep: Fix UAF read of dev->name
bnep_add_connection() needs to keep holding the bnep_session_sem while
reading dev->name (just like bnep_get_connlist() does); otherwise the
bnep_session() thread can concurrently free the net_device, which can for
example be triggered by a concurrent bnep_del_connection().
(This UAF is fairly uninteresting from a security perspective;
calling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN)
check. It also requires completely tearing down a netdev during a fairly
tight race window.)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:37:17.723299Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:14.749Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/bnep/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a75bbcb10cb21acc169b785e9804f57d97873a9c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4907596f25b1720fa948371ac5f6c1f8da10a5bc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "915a92182e2cda9cd7d2479020a44c6eda986f7c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fe69f634b076ae3ca81c5a5b845d9bba527036f7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b21805258d7e926adfd455fc820a447b90da3b82",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5506aec795135cdd4cbf4e845929155663b25055",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e7578529b97e5d4e439cf8f3e637c2303015338f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "59e932ded949fa6f0340bf7c6d7818f962fa4fd2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/bnep/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: Fix UAF read of dev-\u003ename\n\nbnep_add_connection() needs to keep holding the bnep_session_sem while\nreading dev-\u003ename (just like bnep_get_connlist() does); otherwise the\nbnep_session() thread can concurrently free the net_device, which can for\nexample be triggered by a concurrent bnep_del_connection().\n\n(This UAF is fairly uninteresting from a security perspective;\ncalling bnep_add_connection() requires passing a capable(CAP_NET_ADMIN)\ncheck. It also requires completely tearing down a netdev during a fairly\ntight race window.)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is in BNEP session setup for Bluetooth PAN; the highest-impact scenario is an adjacent Bluetooth peer on a phone or laptop whose stack calls BNEPCONNADD during PAN bridging, not a generic local syscall path.\nAC:L - The attacker controls disconnect/reconnect timing on the established L2CAP socket and can repeatedly race teardown against bnep_add_connection()\u0027s unprotected strcpy window; UAF races with attacker-controlled concurrency are AC:L.\nPR:N - Exploitation does not require attacker privileges on the victim\u2014only adjacency as the connected Bluetooth peer while the victim\u0027s privileged bluetoothd issues BNEPCONNADD; CAP_NET_ADMIN gates the ioctl on the victim side, not the attacker.\nUI:N - Once Bluetooth PAN/tethering is available, the attacker initiates and tears down the connection to drive the race without requiring additional victim action during exploitation.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the host kernel, not crossing into another security authority such as a VM guest or separate sandbox domain.\nC:H - This is a use-after-free read of freed net_device memory via strcpy(dev-\u003ename); UAF reads can expose reclaimed slab contents and support further kernel memory disclosure.\nI:H - UAF on a heap-allocated net_device can be leveraged with heap grooming for control-flow or data corruption beyond the immediate bounded name copy.\nA:H - Concurrent free of the net_device during the UAF read can cause kernel oops/panic and denial of service, consistent with UAF availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:55.555Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a75bbcb10cb21acc169b785e9804f57d97873a9c"
},
{
"url": "https://git.kernel.org/stable/c/4907596f25b1720fa948371ac5f6c1f8da10a5bc"
},
{
"url": "https://git.kernel.org/stable/c/915a92182e2cda9cd7d2479020a44c6eda986f7c"
},
{
"url": "https://git.kernel.org/stable/c/fe69f634b076ae3ca81c5a5b845d9bba527036f7"
},
{
"url": "https://git.kernel.org/stable/c/b21805258d7e926adfd455fc820a447b90da3b82"
},
{
"url": "https://git.kernel.org/stable/c/5506aec795135cdd4cbf4e845929155663b25055"
},
{
"url": "https://git.kernel.org/stable/c/e7578529b97e5d4e439cf8f3e637c2303015338f"
},
{
"url": "https://git.kernel.org/stable/c/59e932ded949fa6f0340bf7c6d7818f962fa4fd2"
}
],
"title": "Bluetooth: bnep: Fix UAF read of dev-\u003ename",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64178",
"datePublished": "2026-07-19T15:41:02.293Z",
"dateReserved": "2026-07-19T07:54:57.039Z",
"dateUpdated": "2026-10-19T20:28:14.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64266 (GCVE-0-2026-64266)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fuse: re-lock request before returning from fuse_ref_folio()
fuse_ref_folio() unlocks the request but does not re-lock it before
returning. fuse_chan_abort() can end the request and the async end
callback (eg fuse_writepage_free()) can free the args while the
subsequent copy chain logic after fuse_ref_folio() accesses them,
leading to use-after-free issues.
Fix this by locking the request in fuse_ref_folio() before returning.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c3021629a0d820247ee12b6c5192a1d5380e21c6 Version: c3021629a0d820247ee12b6c5192a1d5380e21c6 Version: c3021629a0d820247ee12b6c5192a1d5380e21c6 Version: c3021629a0d820247ee12b6c5192a1d5380e21c6 Version: c3021629a0d820247ee12b6c5192a1d5380e21c6 Version: c3021629a0d820247ee12b6c5192a1d5380e21c6 Version: c3021629a0d820247ee12b6c5192a1d5380e21c6 Version: c3021629a0d820247ee12b6c5192a1d5380e21c6 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64266",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:38:01.546912Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:16.797Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1f9156714592356b4fda57beac7eab9c2a462dd3",
"status": "affected",
"version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
"versionType": "git"
},
{
"lessThan": "5630da218a45ba80f0aba0846cbe8aa655da122b",
"status": "affected",
"version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
"versionType": "git"
},
{
"lessThan": "1ca605cfa59377f0143fb35b5b01360f37d1b7c4",
"status": "affected",
"version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
"versionType": "git"
},
{
"lessThan": "0e4a5a000123d81234e27a2f8187688cf608f755",
"status": "affected",
"version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
"versionType": "git"
},
{
"lessThan": "e6aa539720c3d8def69683ed0c07cf9faea4e8be",
"status": "affected",
"version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
"versionType": "git"
},
{
"lessThan": "be353caffa8640f5e25fb3714ce8b0cef5e410e5",
"status": "affected",
"version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
"versionType": "git"
},
{
"lessThan": "65a1c2551f7e16085acbb54aedde1feaa559ba7a",
"status": "affected",
"version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
"versionType": "git"
},
{
"lessThan": "b5befa80fdbe287a98480effed9564712924add5",
"status": "affected",
"version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: re-lock request before returning from fuse_ref_folio()\n\nfuse_ref_folio() unlocks the request but does not re-lock it before\nreturning. fuse_chan_abort() can end the request and the async end\ncallback (eg fuse_writepage_free()) can free the args while the\nsubsequent copy chain logic after fuse_ref_folio() accesses them,\nleading to use-after-free issues.\n\nFix this by locking the request in fuse_ref_folio() before returning."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A local attacker reaches the flaw by serving a self-created FUSE mount and invoking splice() on its associated /dev/fuse descriptor.\nAC:L - The attacker controls writeback generation, splice processing, and concurrent connection abort, allowing repeated attempts at the race without an uncontrollable prerequisite.\nPR:L - FUSE supports user-namespace mounts, and an unprivileged mount owner can operate /dev/fuse and abort their own connection without init-namespace root.\nUI:N - The attacker can create and exercise their own FUSE connection without any victim action.\nS:U - Exploitation compromises the kernel within the same operating-system security authority and does not inherently cross a virtualization boundary.\nC:H - The freed argument and folio arrays are subsequently dereferenced, permitting attacker-influenced stale folio pointers and potential arbitrary kernel-memory disclosure through pipe buffers.\nI:H - Heap reclamation can replace the freed folio pointers and loop metadata, enabling attacker-directed memory or refcount operations that may support arbitrary writes and kernel code execution.\nA:H - The repeatable use-after-free and invalid folio operations can cause an oops, panic, or other complete system failure."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:20.108Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1f9156714592356b4fda57beac7eab9c2a462dd3"
},
{
"url": "https://git.kernel.org/stable/c/5630da218a45ba80f0aba0846cbe8aa655da122b"
},
{
"url": "https://git.kernel.org/stable/c/1ca605cfa59377f0143fb35b5b01360f37d1b7c4"
},
{
"url": "https://git.kernel.org/stable/c/0e4a5a000123d81234e27a2f8187688cf608f755"
},
{
"url": "https://git.kernel.org/stable/c/e6aa539720c3d8def69683ed0c07cf9faea4e8be"
},
{
"url": "https://git.kernel.org/stable/c/be353caffa8640f5e25fb3714ce8b0cef5e410e5"
},
{
"url": "https://git.kernel.org/stable/c/65a1c2551f7e16085acbb54aedde1feaa559ba7a"
},
{
"url": "https://git.kernel.org/stable/c/b5befa80fdbe287a98480effed9564712924add5"
}
],
"title": "fuse: re-lock request before returning from fuse_ref_folio()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64266",
"datePublished": "2026-07-25T08:49:15.142Z",
"dateReserved": "2026-07-19T15:36:31.775Z",
"dateUpdated": "2026-10-19T20:28:16.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64315 (GCVE-0-2026-64315)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-08-17 04:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: caam - use print_hex_dump_devel to guard key hex dumps
Use print_hex_dump_devel() for dumping sensitive key material in
*_setkey() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG
is enabled.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8d818c1055013d355d36188f21c7535687374f6c Version: 8d818c1055013d355d36188f21c7535687374f6c Version: 8d818c1055013d355d36188f21c7535687374f6c Version: 8d818c1055013d355d36188f21c7535687374f6c Version: 8d818c1055013d355d36188f21c7535687374f6c Version: 8d818c1055013d355d36188f21c7535687374f6c Version: 8d818c1055013d355d36188f21c7535687374f6c Version: 8d818c1055013d355d36188f21c7535687374f6c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/caam/caamalg_qi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1ec775f6a124cce6278ae58b7d1c78a3bc6eef23",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "bcf3cf74dfb6981e18b22cbf561f859a0f7faa26",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "6407dc85d0a4306681cf6c9be7f05e05dcb67a37",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "c8cfe11e48b2a4646fa662fcaa92e14810a28d46",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "8904b425cfcafe6a820c94b9bdf4b10f7d70f9d7",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "d0b8cafd529b4ec759190c6081f7a76efb563a8f",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "59057f5d4e9a195c6dd61695ad3bc4481ddf4f14",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
},
{
"lessThan": "8005dc808bcce7d6cc2ae015a3cde1683bee602d",
"status": "affected",
"version": "8d818c1055013d355d36188f21c7535687374f6c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/caam/caamalg_qi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: caam - use print_hex_dump_devel to guard key hex dumps\n\nUse print_hex_dump_devel() for dumping sensitive key material in\n*_setkey() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG\nis enabled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The exposed keys are obtained through local kernel-log interfaces such as /dev/kmsg or syslog; network consumers can cause key installation, but the secret is not returned remotely.\nAC:H - The DPAA2 CAAM implementation must be selected and its normally disabled dynamic-debug callsite must have been enabled by boot configuration or an administrator, a condition an unprivileged attacker cannot create.\nPR:L - On systems with dmesg_restrict disabled, an ordinary local user can read the global kernel log and can invoke the affected callbacks through AF_ALG without capabilities.\nUI:N - No victim action is required after the vulnerable logging configuration is active; services and protocol stacks install keys during normal operation.\nS:U - The disclosure and resulting compromise of kernel-protected cryptographic sessions remain within the host kernel\u0027s security authority.\nC:H - The dumps contain complete encryption and authentication keys, including RFC4106/RFC4543 salt material, enabling decryption of protected IPsec, SMB, or other traffic.\nI:H - Disclosed AEAD or authentication keys permit valid ciphertexts and authentication tags to be forged, enabling unauthorized modification of protected communications.\nA:H - An AF_ALG caller can trigger the unratelimited dumps continuously, potentially stalling systems using slow debug consoles, while stolen authentication keys can also sustain disruption of protected IPsec or SMB sessions."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:15.471Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1ec775f6a124cce6278ae58b7d1c78a3bc6eef23"
},
{
"url": "https://git.kernel.org/stable/c/bcf3cf74dfb6981e18b22cbf561f859a0f7faa26"
},
{
"url": "https://git.kernel.org/stable/c/6407dc85d0a4306681cf6c9be7f05e05dcb67a37"
},
{
"url": "https://git.kernel.org/stable/c/c8cfe11e48b2a4646fa662fcaa92e14810a28d46"
},
{
"url": "https://git.kernel.org/stable/c/8904b425cfcafe6a820c94b9bdf4b10f7d70f9d7"
},
{
"url": "https://git.kernel.org/stable/c/d0b8cafd529b4ec759190c6081f7a76efb563a8f"
},
{
"url": "https://git.kernel.org/stable/c/59057f5d4e9a195c6dd61695ad3bc4481ddf4f14"
},
{
"url": "https://git.kernel.org/stable/c/8005dc808bcce7d6cc2ae015a3cde1683bee602d"
}
],
"title": "crypto: caam - use print_hex_dump_devel to guard key hex dumps",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64315",
"datePublished": "2026-07-25T08:49:45.787Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-08-17T04:53:15.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74296 (GCVE-0-2026-74296)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
Free the UAR index returned by the hardware.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4ed131d0bb1597ce12fff22d9d7fc9720a6e8cf0 Version: 4ed131d0bb1597ce12fff22d9d7fc9720a6e8cf0 Version: 4ed131d0bb1597ce12fff22d9d7fc9720a6e8cf0 Version: 4ed131d0bb1597ce12fff22d9d7fc9720a6e8cf0 Version: 4ed131d0bb1597ce12fff22d9d7fc9720a6e8cf0 Version: 4ed131d0bb1597ce12fff22d9d7fc9720a6e8cf0 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74296",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:52:36.442847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:31.271Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mlx5/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "80f1f49f53a42733e60c90e0ec545e647969214d",
"status": "affected",
"version": "4ed131d0bb1597ce12fff22d9d7fc9720a6e8cf0",
"versionType": "git"
},
{
"lessThan": "aabfc845838ef453f1d22d7665596f9cc48be7dd",
"status": "affected",
"version": "4ed131d0bb1597ce12fff22d9d7fc9720a6e8cf0",
"versionType": "git"
},
{
"lessThan": "6f83de384ca582fa87b4c2b0d03bd1ed3bf9a2ee",
"status": "affected",
"version": "4ed131d0bb1597ce12fff22d9d7fc9720a6e8cf0",
"versionType": "git"
},
{
"lessThan": "d3ff718c0c7153e2641e6a09507bace14fc5c402",
"status": "affected",
"version": "4ed131d0bb1597ce12fff22d9d7fc9720a6e8cf0",
"versionType": "git"
},
{
"lessThan": "ef369446f62903ea079e8a7954b5bf8bb8300fe3",
"status": "affected",
"version": "4ed131d0bb1597ce12fff22d9d7fc9720a6e8cf0",
"versionType": "git"
},
{
"lessThan": "449ae7927152e46acbe5f19f97eafdae6d3a96b1",
"status": "affected",
"version": "4ed131d0bb1597ce12fff22d9d7fc9720a6e8cf0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mlx5/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Release the HW\u2011provided UAR index rather than the SW one\n\nFree the UAR index returned by the hardware."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local mmap(2) on an opened mlx5 uverbs file descriptor (/dev/infiniband/uverbs*); the bug is in uar_mmap() error cleanup and is not reachable via remote RDMA/network packet handling.\nAC:L - An attacker who can open uverbs and issue MLX5_IB_MMAP_ALLOC_WC can reliably reach the faulty cleanup by forcing rdma_user_mmap_io()/io_remap_pfn_range() to fail (e.g., memory or VMA map pressure), and controls all syscall parameters for the race-free trigger.\nPR:L - Any unprivileged local user with access to the mlx5 RDMA character device (default 0666 uverbs nodes on shared HPC/cloud compute nodes with ConnectX NICs) can alloc a context and mmap; no real-root or CAP_SYS_ADMIN capability is required.\nUI:N - Exploitation is fully attacker-driven through uverbs open, alloc_ucontext, and mmap syscalls; no victim interaction such as mounting filesystems or opening files is needed.\nS:U - Impact is confined to kernel/driver and RDMA device resource integrity on the host; it does not cross a VM-hypervisor or IOMMU security boundary into a different authority.\nC:H - Deallocating the wrong hardware UAR index frees another context\u0027s live UAR while the attacker-allocated UAR leaks, creating a cross-context UAR use-after-free that can expose other users\u0027 MMIO doorbell/register mappings and device state.\nI:H - UAR pages provide userspace MMIO write access to mlx5 doorbells and control registers; corrupting or reassigning UAR ownership enables arbitrary device register/DMA manipulation and is exploitable for privilege escalation beyond simple data tampering.\nA:H - Freeing an in-use hardware UAR from another context can cause kernel oops/panic, NIC hangs, or repeated crashes when victims continue doorbell/MMIO access through stale mappings."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:45:34.579Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/80f1f49f53a42733e60c90e0ec545e647969214d"
},
{
"url": "https://git.kernel.org/stable/c/aabfc845838ef453f1d22d7665596f9cc48be7dd"
},
{
"url": "https://git.kernel.org/stable/c/6f83de384ca582fa87b4c2b0d03bd1ed3bf9a2ee"
},
{
"url": "https://git.kernel.org/stable/c/d3ff718c0c7153e2641e6a09507bace14fc5c402"
},
{
"url": "https://git.kernel.org/stable/c/ef369446f62903ea079e8a7954b5bf8bb8300fe3"
},
{
"url": "https://git.kernel.org/stable/c/449ae7927152e46acbe5f19f97eafdae6d3a96b1"
}
],
"title": "RDMA/mlx5: Release the HW\u2011provided UAR index rather than the SW one",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74296",
"datePublished": "2026-08-15T05:58:00.758Z",
"dateReserved": "2026-08-15T05:44:03.882Z",
"dateUpdated": "2026-10-16T18:55:31.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53223 (GCVE-0-2026-53223)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-19 19:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: guard timestamp cmsgs to real error queue skbs
skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb
from sk_error_queue. That assumption is not true for AF_PACKET sockets:
outgoing packet taps are also delivered to packet sockets with
skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET
instead of struct sock_exterr_skb.
If such an skb is received with timestamping enabled, the generic
timestamp cmsg path can read AF_PACKET control-buffer state as
sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop
counter overlaps opt_stats. An odd drop count makes the path emit
SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear
skbs this copies past the linear head and can trigger hardened usercopy or
disclose adjacent heap contents.
Keep skb_is_err_queue() local to net/socket.c, but make it verify that
the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor
installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal
receive ownership and no longer pass as error-queue skbs, while legitimate
sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free
ownership.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: cdaf15b43bd31003220cb080bcbbd57787a2fca9 Version: 4.10.14 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:22:48.324Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53223",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:27:08.585638Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:57:29.682Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/sock.h",
"net/core/skbuff.c",
"net/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "24a0d548d3a765cd4558224e4f8e06e14cba26e3",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "71ff5cdd5da61d0438e902aa0fd68c28bc901abe",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "ad9a0374ee6d11048e1f74cd5180bad58b9848b4",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "b903e9b5629ec8dd6db92174070045bf81ad7060",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "e0665b2a8e90bb08bd205062c75662b502d31797",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "3dde4fb941fa5649ab809f6cd3e20e0c424a4e31",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "1ee90b77b727df903033db873c75caac5c27ec98",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"status": "affected",
"version": "cdaf15b43bd31003220cb080bcbbd57787a2fca9",
"versionType": "git"
},
{
"lessThan": "4.11",
"status": "affected",
"version": "4.10.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/sock.h",
"net/core/skbuff.c",
"net/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.10.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: guard timestamp cmsgs to real error queue skbs\n\nskb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb\nfrom sk_error_queue. That assumption is not true for AF_PACKET sockets:\noutgoing packet taps are also delivered to packet sockets with\nskb-\u003epkt_type == PACKET_OUTGOING, but their skb-\u003ecb is owned by AF_PACKET\ninstead of struct sock_exterr_skb.\n\nIf such an skb is received with timestamping enabled, the generic\ntimestamp cmsg path can read AF_PACKET control-buffer state as\nsock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop\ncounter overlaps opt_stats. An odd drop count makes the path emit\nSCM_TIMESTAMPING_OPT_STATS with skb-\u003elen and skb-\u003edata. For non-linear\nskbs this copies past the linear head and can trigger hardened usercopy or\ndisclose adjacent heap contents.\n\nKeep skb_is_err_queue() local to net/socket.c, but make it verify that\nthe PACKET_OUTGOING marker is paired with the sock_rmem_free destructor\ninstalled by sock_queue_err_skb(). AF_PACKET receive skbs use normal\nreceive ownership and no longer pass as error-queue skbs, while legitimate\nsk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free\nownership."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local socket syscalls on an AF_PACKET socket, including setsockopt(), sending traffic that is tapped as PACKET_OUTGOING, and recvmsg(). Remote packets alone do not reach the bug without a local attacker-controlled packet socket.\nAC:L - The attacker controls the socket options, packet-socket receive queue pressure/drop count, and outgoing traffic needed to make the timestamp cmsg path run. No uncontrollable race or rare environmental condition is required for the highest-impact disclosure/crash scenario.\nPR:L - Creating AF_PACKET sockets requires CAP_NET_RAW in the governing user namespace. Because this capability can be obtained by an unprivileged local user in user/network namespaces on common deployments, this is Low rather than High.\nUI:N - No victim action is required after the attacker has local execution; the attacker can configure the socket and trigger recvmsg() themselves. The bug is not dependent on opening a file, mounting media, or other user-assisted behavior.\nS:U - The impact remains within the kernel and the local host security authority. It does not cross a hypervisor, VM, IOMMU, or other separate security scope boundary.\nC:H - The bogus SCM_TIMESTAMPING_OPT_STATS cmsg can copy skb-\u003elen bytes from skb-\u003edata even when the skb is non-linear, reading past the linear head. That can disclose adjacent kernel heap contents to userspace, which is a high confidentiality impact.\nI:N - The investigated bug is an out-of-bounds read/copy-to-user and misclassification of skb metadata, not a kernel write primitive. I found no direct modification of kernel memory or protected data.\nA:H - The same invalid copy can trigger hardened usercopy failures or kernel oops/panic on hardened deployments. The local attacker can repeat the trigger, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:15.752Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/24a0d548d3a765cd4558224e4f8e06e14cba26e3"
},
{
"url": "https://git.kernel.org/stable/c/71ff5cdd5da61d0438e902aa0fd68c28bc901abe"
},
{
"url": "https://git.kernel.org/stable/c/ad9a0374ee6d11048e1f74cd5180bad58b9848b4"
},
{
"url": "https://git.kernel.org/stable/c/b903e9b5629ec8dd6db92174070045bf81ad7060"
},
{
"url": "https://git.kernel.org/stable/c/e0665b2a8e90bb08bd205062c75662b502d31797"
},
{
"url": "https://git.kernel.org/stable/c/3dde4fb941fa5649ab809f6cd3e20e0c424a4e31"
},
{
"url": "https://git.kernel.org/stable/c/eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a"
},
{
"url": "https://git.kernel.org/stable/c/1ee90b77b727df903033db873c75caac5c27ec98"
}
],
"title": "net: guard timestamp cmsgs to real error queue skbs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53223",
"datePublished": "2026-06-25T08:39:24.588Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-10-19T19:57:29.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46070 (GCVE-0-2026-46070)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-10-19 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md/raid5: validate payload size before accessing journal metadata
r5c_recovery_analyze_meta_block() and
r5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a
journal metadata block using on-disk payload size fields without
validating them against the remaining space in the metadata block.
A corrupted journal contains payload sizes extending beyond the PAGE_SIZE
boundary can cause out-of-bounds reads when accessing payload fields or
computing offsets.
Add bounds validation for each payload type to ensure the full payload
fits within meta_size before processing.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b4c625c67362b3940f619c1a836b4e8329106658 Version: b4c625c67362b3940f619c1a836b4e8329106658 Version: b4c625c67362b3940f619c1a836b4e8329106658 Version: b4c625c67362b3940f619c1a836b4e8329106658 Version: b4c625c67362b3940f619c1a836b4e8329106658 Version: b4c625c67362b3940f619c1a836b4e8329106658 Version: b4c625c67362b3940f619c1a836b4e8329106658 Version: b4c625c67362b3940f619c1a836b4e8329106658 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:20:21.951Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46070",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:19:24.995306Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:26:42.780Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/raid5-cache.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c96c6f01d84b5c67db1bf1cc8591c0b7146826fc",
"status": "affected",
"version": "b4c625c67362b3940f619c1a836b4e8329106658",
"versionType": "git"
},
{
"lessThan": "ef4851d8324fd978ca1ff9ec76a275438f887743",
"status": "affected",
"version": "b4c625c67362b3940f619c1a836b4e8329106658",
"versionType": "git"
},
{
"lessThan": "28d3ff7109c66e99dc1b7cddacb5c760849620ef",
"status": "affected",
"version": "b4c625c67362b3940f619c1a836b4e8329106658",
"versionType": "git"
},
{
"lessThan": "33698bd1b2db9764a29df7751533d33967ff5c98",
"status": "affected",
"version": "b4c625c67362b3940f619c1a836b4e8329106658",
"versionType": "git"
},
{
"lessThan": "c3a1cf78bd1bbb51b2cc5189b4743056553c1e0e",
"status": "affected",
"version": "b4c625c67362b3940f619c1a836b4e8329106658",
"versionType": "git"
},
{
"lessThan": "73ce72edd113374801045924d4417199963f73a3",
"status": "affected",
"version": "b4c625c67362b3940f619c1a836b4e8329106658",
"versionType": "git"
},
{
"lessThan": "406aa86394ead347c47428fb51b6359bdaa2257d",
"status": "affected",
"version": "b4c625c67362b3940f619c1a836b4e8329106658",
"versionType": "git"
},
{
"lessThan": "b0cc3ae97e893bf54bbce447f4e9fd2e0b88bff9",
"status": "affected",
"version": "b4c625c67362b3940f619c1a836b4e8329106658",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/raid5-cache.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: validate payload size before accessing journal metadata\n\nr5c_recovery_analyze_meta_block() and\nr5l_recovery_verify_data_checksum_for_mb() iterate over payloads in a\njournal metadata block using on-disk payload size fields without\nvalidating them against the remaining space in the metadata block.\n\nA corrupted journal contains payload sizes extending beyond the PAGE_SIZE\nboundary can cause out-of-bounds reads when accessing payload fields or\ncomputing offsets.\n\nAdd bounds validation for each payload type to ensure the full payload\nfits within meta_size before processing."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The malicious input is the on-disk journal metadata processed during local MD array assembly/start; it is not a network-facing service. Even when the journal sits on remote storage, the vulnerable recovery code runs locally against a block device, so the vector is Local.\nAC:L - A crafted journal block deterministically triggers the OOB read on every assembly; the required CRC is fully attacker-computable from the publicly-stored array UUID, and there is no race or uncontrolled condition.\nPR:L - Exploitation only requires planting crafted bytes on the journal block device (e.g. disk-group/device write access), after which routine or boot-time auto-assembly processes it; this is a low-privilege primitive rather than full init-namespace root.\nUI:N - Array assembly/journal recovery runs automatically at boot or device hot-plug, so no human interaction is needed once the corrupted journal is in place.\nS:U - The OOB read stays within the kernel\u0027s own memory and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The flaw is a large, unbounded out-of-bounds read of adjacent kernel memory (FLUSH count up to ~500M entries), which per scoring guidance for unbounded OOB reads is treated as a high confidentiality impact.\nI:N - The fix adds only read-bounds validation; the vulnerability provides no out-of-bounds write or corruption primitive against system data, so there is no integrity impact.\nA:H - OOB access to unmapped memory (or the int overflow / BUG_ON in the read path) causes a kernel oops/panic, crashing the host during array assembly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:28.864Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c96c6f01d84b5c67db1bf1cc8591c0b7146826fc"
},
{
"url": "https://git.kernel.org/stable/c/ef4851d8324fd978ca1ff9ec76a275438f887743"
},
{
"url": "https://git.kernel.org/stable/c/28d3ff7109c66e99dc1b7cddacb5c760849620ef"
},
{
"url": "https://git.kernel.org/stable/c/33698bd1b2db9764a29df7751533d33967ff5c98"
},
{
"url": "https://git.kernel.org/stable/c/c3a1cf78bd1bbb51b2cc5189b4743056553c1e0e"
},
{
"url": "https://git.kernel.org/stable/c/73ce72edd113374801045924d4417199963f73a3"
},
{
"url": "https://git.kernel.org/stable/c/406aa86394ead347c47428fb51b6359bdaa2257d"
},
{
"url": "https://git.kernel.org/stable/c/b0cc3ae97e893bf54bbce447f4e9fd2e0b88bff9"
}
],
"title": "md/raid5: validate payload size before accessing journal metadata",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46070",
"datePublished": "2026-05-27T12:57:54.345Z",
"dateReserved": "2026-05-13T15:03:33.095Z",
"dateUpdated": "2026-10-19T19:26:42.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74557 (GCVE-0-2026-74557)
Vulnerability from cvelistv5
Published
2026-08-15 12:28
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer
iscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the
target-supplied data segment. The segment carries a 2-byte sense length
followed by the sense bytes, so it must hold 2 + senselen bytes, but the
bounds check only requires datalen >= senselen:
senselen = get_unaligned_be16(data);
if (datalen < senselen)
goto invalid_datalen;
memcpy(sc->sense_buffer, data + 2,
min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));
A target that returns a SCSI Response whose datalen equals senselen
(with senselen <= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +
2 read up to two bytes past the received data. Those bytes are stale
conn->data contents and end up in the command's sense buffer, which is
returned to userspace.
Account for the 2-byte sense length prefix in the check.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 Version: 7996a778ff8c717cb1a7a294475c59cc8f1e9fb8 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74557",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:00:09.303445Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:55.724Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "812f1ae95b22419422972748f173b0916ee4d621",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "fef6167e8149896cd81bea333fd51b1c91239149",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "baa04572673125e4d5bc309b4077d1cb46cc78d1",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "7567f06abdefb1caf2d836107c4d08c5185c650e",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "60499924faf4ef97e84228c20515218ef121facf",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "3ef209ca0b4b68c75e9a814d90cc916026b5a6ac",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "1f07a897d43c63e6c9458bf77450defef39b5833",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
},
{
"lessThan": "98b87885de4b7f605533a2860685f5689fce8e82",
"status": "affected",
"version": "7996a778ff8c717cb1a7a294475c59cc8f1e9fb8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi: Fix stale-data leak into the SCSI sense buffer\n\niscsi_scsi_cmd_rsp() copies the sense data of a SCSI Response from the\ntarget-supplied data segment. The segment carries a 2-byte sense length\nfollowed by the sense bytes, so it must hold 2 + senselen bytes, but the\nbounds check only requires datalen \u003e= senselen:\n\n\tsenselen = get_unaligned_be16(data);\n\tif (datalen \u003c senselen)\n\t\tgoto invalid_datalen;\n\tmemcpy(sc-\u003esense_buffer, data + 2,\n\t min_t(uint16_t, senselen, SCSI_SENSE_BUFFERSIZE));\n\nA target that returns a SCSI Response whose datalen equals senselen\n(with senselen \u003c= SCSI_SENSE_BUFFERSIZE) makes the memcpy() from data +\n2 read up to two bytes past the received data. Those bytes are stale\nconn-\u003edata contents and end up in the command\u0027s sense buffer, which is\nreturned to userspace.\n\nAccount for the 2-byte sense length prefix in the check."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote malicious or compromised iSCSI target can trigger the bug by sending a crafted SCSI Command Response over the standard iSCSI/TCP session to a Linux kernel initiator, with no local access required on the victim host.\nAC:L - The attacker fully controls the response PDU fields (datalen, sense length, CHECK_CONDITION status) and can reliably set datalen equal to senselen so the flawed bounds check passes and stale conn-\u003edata bytes are copied into the sense buffer.\nPR:N - Exploitation requires only the ability to act as the iSCSI target on the network; the attacker needs no local account, capabilities, or privileges on the victim system initiating the connection.\nUI:N - Once an iSCSI session exists, the leak is triggered automatically on SCSI command responses with no further victim action; the attacker does not rely on a user opening a file, clicking a link, or performing any interactive step at exploit time.\nS:U - The flaw discloses kernel memory contents into a SCSI sense buffer returned within the same host security domain; it does not cross VM, hypervisor, or IOMMU boundaries and is a standard kernel-to-userspace information leak.\nC:H - The out-of-bounds memcpy reads up to two bytes per response from stale conn-\u003edata kernel heap memory into sc-\u003esense_buffer, which is copied to userspace via SCSI completion, ioctl, and BSG paths, enabling repeated kernel information disclosure.\nI:N - The vulnerability is a read-only out-of-bounds memcpy from the receive buffer into the sense buffer; it does not corrupt kernel structures, overwrite memory, or provide a write or code-execution primitive.\nA:N - The bug causes no kernel panic, oops, or hang; invalid responses are handled gracefully and exploitation only leaks data into the sense buffer without disrupting system availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:38:59.951Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/812f1ae95b22419422972748f173b0916ee4d621"
},
{
"url": "https://git.kernel.org/stable/c/fef6167e8149896cd81bea333fd51b1c91239149"
},
{
"url": "https://git.kernel.org/stable/c/baa04572673125e4d5bc309b4077d1cb46cc78d1"
},
{
"url": "https://git.kernel.org/stable/c/7567f06abdefb1caf2d836107c4d08c5185c650e"
},
{
"url": "https://git.kernel.org/stable/c/60499924faf4ef97e84228c20515218ef121facf"
},
{
"url": "https://git.kernel.org/stable/c/3ef209ca0b4b68c75e9a814d90cc916026b5a6ac"
},
{
"url": "https://git.kernel.org/stable/c/1f07a897d43c63e6c9458bf77450defef39b5833"
},
{
"url": "https://git.kernel.org/stable/c/98b87885de4b7f605533a2860685f5689fce8e82"
}
],
"title": "scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74557",
"datePublished": "2026-08-15T12:28:01.988Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-10-16T19:05:55.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53149 (GCVE-0-2026-53149)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-10-15 01:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Bound root directory content to block size
__tb_property_parse_dir() does not check that content_offset +
content_len fits within block_len for the root directory case.
When rootdir->length equals or exceeds block_len - 2, the entry
loop reads past the allocated property block.
Add a bounds check after computing content_offset and content_len
to reject directories whose content extends past the block.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:22:28.808Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c7657d38d07268124782f03519f07c22a5814fb",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "b212bc161d8a9937b42153723a4a3f2f74fab528",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "1912be23daf4afc8d24ce916021ab68ca4c679db",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "4d0b1524caadb04c10a71f3f88692c63dcb39115",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "0a32040a48db8cf35de48b85d6115df5623e4964",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "60ba6217460792356a238299edd675d91d46bab4",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "cbeb68cbaa0a6f979ef428a7f2d0268c082ba166",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "65423079c7420e3dbf9a7aa345c243a3f5752e5d",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Bound root directory content to block size\n\n__tb_property_parse_dir() does not check that content_offset +\ncontent_len fits within block_len for the root directory case.\nWhen rootdir-\u003elength equals or exceeds block_len - 2, the entry\nloop reads past the allocated property block.\n\nAdd a bounds check after computing content_offset and content_len\nto reject directories whose content extends past the block."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:34.869Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c7657d38d07268124782f03519f07c22a5814fb"
},
{
"url": "https://git.kernel.org/stable/c/b212bc161d8a9937b42153723a4a3f2f74fab528"
},
{
"url": "https://git.kernel.org/stable/c/1912be23daf4afc8d24ce916021ab68ca4c679db"
},
{
"url": "https://git.kernel.org/stable/c/4d0b1524caadb04c10a71f3f88692c63dcb39115"
},
{
"url": "https://git.kernel.org/stable/c/0a32040a48db8cf35de48b85d6115df5623e4964"
},
{
"url": "https://git.kernel.org/stable/c/60ba6217460792356a238299edd675d91d46bab4"
},
{
"url": "https://git.kernel.org/stable/c/cbeb68cbaa0a6f979ef428a7f2d0268c082ba166"
},
{
"url": "https://git.kernel.org/stable/c/65423079c7420e3dbf9a7aa345c243a3f5752e5d"
}
],
"title": "thunderbolt: Bound root directory content to block size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53149",
"datePublished": "2026-06-25T08:38:34.869Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-10-15T01:22:28.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68328 (GCVE-0-2026-68328)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-08-19 16:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfp: Check resource mutex allocation
nfp_cpp_resource_find() allocates a CPP mutex handle for the matching
resource-table entry and then reports success. nfp_resource_try_acquire()
immediately passes that handle to nfp_cpp_mutex_trylock().
However, nfp_cpp_mutex_alloc() returns NULL on failure. If that happens
for a matching table entry, the resource lookup still returns success and
the following trylock dereferences a NULL mutex pointer while opening the
resource.
nfp_resource_acquire() already treats failure to allocate the table mutex
as -ENOMEM. Do the same for the resource mutex and fail the lookup before
publishing the rest of the resource handle.
This issue was found by a static analysis checker and confirmed by
manual source review.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f01a2161577d31b14581e0db3bbbdfa963f145b6 Version: f01a2161577d31b14581e0db3bbbdfa963f145b6 Version: f01a2161577d31b14581e0db3bbbdfa963f145b6 Version: f01a2161577d31b14581e0db3bbbdfa963f145b6 Version: f01a2161577d31b14581e0db3bbbdfa963f145b6 Version: f01a2161577d31b14581e0db3bbbdfa963f145b6 Version: f01a2161577d31b14581e0db3bbbdfa963f145b6 Version: f01a2161577d31b14581e0db3bbbdfa963f145b6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/netronome/nfp/nfpcore/nfp_resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18737a48acc87e4cbe41d6fea9a3f44eae490e24",
"status": "affected",
"version": "f01a2161577d31b14581e0db3bbbdfa963f145b6",
"versionType": "git"
},
{
"lessThan": "423523f96a681428ce6e214eaf47f0d8242319de",
"status": "affected",
"version": "f01a2161577d31b14581e0db3bbbdfa963f145b6",
"versionType": "git"
},
{
"lessThan": "0dbd85a8cc35c14bd26e686fa5fae8c64a7958ae",
"status": "affected",
"version": "f01a2161577d31b14581e0db3bbbdfa963f145b6",
"versionType": "git"
},
{
"lessThan": "6dbd428119cb1fd1b73cf6968c711f4ea964dc8b",
"status": "affected",
"version": "f01a2161577d31b14581e0db3bbbdfa963f145b6",
"versionType": "git"
},
{
"lessThan": "cfa119aa781c4044dab5b4c1e5864600f53a26bc",
"status": "affected",
"version": "f01a2161577d31b14581e0db3bbbdfa963f145b6",
"versionType": "git"
},
{
"lessThan": "3b1d4fc3b73ea6faf008a0996ce6190c6e43efc3",
"status": "affected",
"version": "f01a2161577d31b14581e0db3bbbdfa963f145b6",
"versionType": "git"
},
{
"lessThan": "a7dc30b6828c3a30252892827b12b676749f250f",
"status": "affected",
"version": "f01a2161577d31b14581e0db3bbbdfa963f145b6",
"versionType": "git"
},
{
"lessThan": "a61b4db34a753bdf5c9e77a7f3d3dddd41dcfacc",
"status": "affected",
"version": "f01a2161577d31b14581e0db3bbbdfa963f145b6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/netronome/nfp/nfpcore/nfp_resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfp: Check resource mutex allocation\n\nnfp_cpp_resource_find() allocates a CPP mutex handle for the matching\nresource-table entry and then reports success. nfp_resource_try_acquire()\nimmediately passes that handle to nfp_cpp_mutex_trylock().\n\nHowever, nfp_cpp_mutex_alloc() returns NULL on failure. If that happens\nfor a matching table entry, the resource lookup still returns success and\nthe following trylock dereferences a NULL mutex pointer while opening the\nresource.\n\nnfp_resource_acquire() already treats failure to allocate the table mutex\nas -ENOMEM. Do the same for the resource mutex and fail the lookup before\npublishing the rest of the resource handle.\n\nThis issue was found by a static analysis checker and confirmed by\nmanual source review."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:33:25.716Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18737a48acc87e4cbe41d6fea9a3f44eae490e24"
},
{
"url": "https://git.kernel.org/stable/c/423523f96a681428ce6e214eaf47f0d8242319de"
},
{
"url": "https://git.kernel.org/stable/c/0dbd85a8cc35c14bd26e686fa5fae8c64a7958ae"
},
{
"url": "https://git.kernel.org/stable/c/6dbd428119cb1fd1b73cf6968c711f4ea964dc8b"
},
{
"url": "https://git.kernel.org/stable/c/cfa119aa781c4044dab5b4c1e5864600f53a26bc"
},
{
"url": "https://git.kernel.org/stable/c/3b1d4fc3b73ea6faf008a0996ce6190c6e43efc3"
},
{
"url": "https://git.kernel.org/stable/c/a7dc30b6828c3a30252892827b12b676749f250f"
},
{
"url": "https://git.kernel.org/stable/c/a61b4db34a753bdf5c9e77a7f3d3dddd41dcfacc"
}
],
"title": "nfp: Check resource mutex allocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68328",
"datePublished": "2026-08-10T12:03:04.560Z",
"dateReserved": "2026-07-30T09:28:09.382Z",
"dateUpdated": "2026-08-19T16:33:25.716Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63962 (GCVE-0-2026-63962)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()
svdm_consume_modes() checks pmdata->altmodes against the array size once
before the loop over the count, but forgot to check the bound at every
point in the loop.
In the well-behaved SVDM discovery flow this is harmless because each of
at most SVID_DISCOVERY_MAX SVIDs contributes at most MODE_DISCOVERY_MAX
modes, exactly filling altmode_desc[ALTMODE_DISCOVERY_MAX]. But the
CMDT_RSP_ACK handler in tcpm_pd_svdm() does not correlate an incoming
ACK with any request the port actually sent. Once port->partner is set,
an unsolicited Discover Modes ACK is consumed unconditionally. A broken
or malicious port partner can therefore drive altmodes to
ALTMODE_DISCOVERY_MAX - 1 via the normal flow, and then send one extra
Discover Modes ACK with seven VDOs. Because the pre-loop check passes,
the loop could then writes up to five entries past altmode_desc[]. For
mode_data_prime the next field in struct tcpm_port is the
partner_altmode[] pointer array, which then receives partner-chosen
SVID/VDO bytes.
Move the bound check inside the loop so the array can never be indexed
past ALTMODE_DISCOVERY_MAX regardless of how many VDOs the partner
supplies or how the function was reached.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/tcpm/tcpm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "816c6251409db28f1b875988fcbd2ff1764a81f0",
"status": "affected",
"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237",
"versionType": "git"
},
{
"lessThan": "845598b154b9a92e9d279fafafa9405c121ae805",
"status": "affected",
"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237",
"versionType": "git"
},
{
"lessThan": "4505f33dab56c274e82f47f94bf60a8cbf8f4b42",
"status": "affected",
"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237",
"versionType": "git"
},
{
"lessThan": "cbad85b446c06adbc5e5bed565871bb918ce9d32",
"status": "affected",
"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237",
"versionType": "git"
},
{
"lessThan": "3389c149c68c3fea61910ad5d34f7bf3bff44e32",
"status": "affected",
"version": "4ab8c18d4d67321cc7b660559de17511d4fc0237",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/typec/tcpm/tcpm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()\n\nsvdm_consume_modes() checks pmdata-\u003ealtmodes against the array size once\nbefore the loop over the count, but forgot to check the bound at every\npoint in the loop.\n\nIn the well-behaved SVDM discovery flow this is harmless because each of\nat most SVID_DISCOVERY_MAX SVIDs contributes at most MODE_DISCOVERY_MAX\nmodes, exactly filling altmode_desc[ALTMODE_DISCOVERY_MAX]. But the\nCMDT_RSP_ACK handler in tcpm_pd_svdm() does not correlate an incoming\nACK with any request the port actually sent. Once port-\u003epartner is set,\nan unsolicited Discover Modes ACK is consumed unconditionally. A broken\nor malicious port partner can therefore drive altmodes to\nALTMODE_DISCOVERY_MAX - 1 via the normal flow, and then send one extra\nDiscover Modes ACK with seven VDOs. Because the pre-loop check passes,\nthe loop could then writes up to five entries past altmode_desc[]. For\nmode_data_prime the next field in struct tcpm_port is the\npartner_altmode[] pointer array, which then receives partner-chosen\nSVID/VDO bytes.\n\nMove the bound check inside the loop so the array can never be indexed\npast ALTMODE_DISCOVERY_MAX regardless of how many VDOs the partner\nsupplies or how the function was reached."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:45.904Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/816c6251409db28f1b875988fcbd2ff1764a81f0"
},
{
"url": "https://git.kernel.org/stable/c/845598b154b9a92e9d279fafafa9405c121ae805"
},
{
"url": "https://git.kernel.org/stable/c/4505f33dab56c274e82f47f94bf60a8cbf8f4b42"
},
{
"url": "https://git.kernel.org/stable/c/cbad85b446c06adbc5e5bed565871bb918ce9d32"
},
{
"url": "https://git.kernel.org/stable/c/3389c149c68c3fea61910ad5d34f7bf3bff44e32"
}
],
"title": "usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63962",
"datePublished": "2026-07-19T14:55:51.682Z",
"dateReserved": "2026-07-19T07:54:57.024Z",
"dateUpdated": "2026-10-21T12:42:45.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64436 (GCVE-0-2026-64436)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: af_key: initialize alg_key_len for IPComp states
pfkey_msg2xfrm_state() handles the IPComp (SADB_X_SATYPE_IPCOMP) case by
allocating x->calg and copying only the algorithm name:
x->calg = kmalloc_obj(*x->calg);
if (!x->calg) {
err = -ENOMEM;
goto out;
}
strcpy(x->calg->alg_name, a->name);
x->props.calgo = sa->sadb_sa_encrypt;
Unlike the authentication (x->aalg) and encryption (x->ealg) branches of
the same function, the compression branch never initializes
calg->alg_key_len. IPComp carries no key and the allocation only
reserves sizeof(struct xfrm_algo) (i.e. no room for a key), so the field
is left containing uninitialized slab data.
calg->alg_key_len is later used as a length by xfrm_algo_clone() when an
IPComp state is cloned during XFRM_MSG_MIGRATE:
xfrm_state_migrate()
xfrm_state_clone_and_setup()
x->calg = xfrm_algo_clone(orig->calg);
kmemdup(orig, xfrm_alg_len(orig));
where xfrm_alg_len() returns sizeof(*alg) + (alg_key_len + 7) / 8. With
a non-zero garbage alg_key_len, kmemdup() reads past the end of the
68-byte calg object. Adding an IPComp SA via PF_KEY and then migrating
it triggers (net-next, KASAN, init_on_alloc=0):
BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x44/0x60
Read of size 4164 at addr ff11000025a74980 by task diag2/9287
CPU: 3 UID: 0 PID: 9287 Comm: diag2 7.1.0-rc6-g903db046d557 #1
Call Trace:
<TASK>
dump_stack_lvl+0x10e/0x1f0
print_report+0xf7/0x600
kasan_report+0xe4/0x120
kasan_check_range+0x105/0x1b0
__asan_memcpy+0x23/0x60
kmemdup_noprof+0x44/0x60
xfrm_state_migrate+0x70a/0x1da0
xfrm_migrate+0x753/0x18a0
xfrm_do_migrate+0xb47/0xf10
xfrm_user_rcv_msg+0x411/0xb50
netlink_rcv_skb+0x158/0x420
xfrm_netlink_rcv+0x71/0x90
netlink_unicast+0x584/0x850
netlink_sendmsg+0x8b0/0xdc0
____sys_sendmsg+0x9f7/0xb90
___sys_sendmsg+0x134/0x1d0
__sys_sendmsg+0x16d/0x220
do_syscall_64+0x116/0x7d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 9287:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
pfkey_add+0x2652/0x2ea0
pfkey_process+0x6d0/0x830
pfkey_sendmsg+0x42c/0x850
__sys_sendto+0x461/0x4b0
__x64_sys_sendto+0xe0/0x1c0
do_syscall_64+0x116/0x7d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ff11000025a74980
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 0 bytes inside of
allocated 68-byte region [ff11000025a74980, ff11000025a749c4)
Depending on the uninitialized value the same field can instead request
an oversized kmemdup() allocation and make the migration clone fail.
The XFRM netlink path is not affected: verify_one_alg() rejects an
XFRMA_ALG_COMP attribute shorter than xfrm_alg_len(), so a calg added via
XFRM_MSG_NEWSA is always self-consistent.
Initialize calg->alg_key_len to 0, matching the aalg/ealg branches.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 80c9abaabf4283f7cf4a0b3597cd302506635b7f Version: 80c9abaabf4283f7cf4a0b3597cd302506635b7f Version: 80c9abaabf4283f7cf4a0b3597cd302506635b7f Version: 80c9abaabf4283f7cf4a0b3597cd302506635b7f Version: 80c9abaabf4283f7cf4a0b3597cd302506635b7f Version: 80c9abaabf4283f7cf4a0b3597cd302506635b7f Version: 80c9abaabf4283f7cf4a0b3597cd302506635b7f Version: 80c9abaabf4283f7cf4a0b3597cd302506635b7f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:40:40.992032Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:28.893Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/key/af_key.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "58e82fc3dedb57b1432292504415b224fd2d6acb",
"status": "affected",
"version": "80c9abaabf4283f7cf4a0b3597cd302506635b7f",
"versionType": "git"
},
{
"lessThan": "01b9115b55018123ef2449ac4951f89147a8428e",
"status": "affected",
"version": "80c9abaabf4283f7cf4a0b3597cd302506635b7f",
"versionType": "git"
},
{
"lessThan": "3f63d1752d90c0e28be931a48ab5d89bc97d637d",
"status": "affected",
"version": "80c9abaabf4283f7cf4a0b3597cd302506635b7f",
"versionType": "git"
},
{
"lessThan": "273c06b81d2e902b21acc801ae18c8276c8a9b69",
"status": "affected",
"version": "80c9abaabf4283f7cf4a0b3597cd302506635b7f",
"versionType": "git"
},
{
"lessThan": "6de2a650917bedaaefd65b17cede83c5e2c1dedd",
"status": "affected",
"version": "80c9abaabf4283f7cf4a0b3597cd302506635b7f",
"versionType": "git"
},
{
"lessThan": "e8417353cbd078d10531ba3928e609c84ab09e6b",
"status": "affected",
"version": "80c9abaabf4283f7cf4a0b3597cd302506635b7f",
"versionType": "git"
},
{
"lessThan": "cea34abc94b0a81e3a8b5cfb41cf45af37c2c67e",
"status": "affected",
"version": "80c9abaabf4283f7cf4a0b3597cd302506635b7f",
"versionType": "git"
},
{
"lessThan": "d129c3177d7b1138fd5066fcc63a698b3ba415b0",
"status": "affected",
"version": "80c9abaabf4283f7cf4a0b3597cd302506635b7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/key/af_key.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.21"
},
{
"lessThan": "2.6.21",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: af_key: initialize alg_key_len for IPComp states\n\npfkey_msg2xfrm_state() handles the IPComp (SADB_X_SATYPE_IPCOMP) case by\nallocating x-\u003ecalg and copying only the algorithm name:\n\n\tx-\u003ecalg = kmalloc_obj(*x-\u003ecalg);\n\tif (!x-\u003ecalg) {\n\t\terr = -ENOMEM;\n\t\tgoto out;\n\t}\n\tstrcpy(x-\u003ecalg-\u003ealg_name, a-\u003ename);\n\tx-\u003eprops.calgo = sa-\u003esadb_sa_encrypt;\n\nUnlike the authentication (x-\u003eaalg) and encryption (x-\u003eealg) branches of\nthe same function, the compression branch never initializes\ncalg-\u003ealg_key_len. IPComp carries no key and the allocation only\nreserves sizeof(struct xfrm_algo) (i.e. no room for a key), so the field\nis left containing uninitialized slab data.\n\ncalg-\u003ealg_key_len is later used as a length by xfrm_algo_clone() when an\nIPComp state is cloned during XFRM_MSG_MIGRATE:\n\n\txfrm_state_migrate()\n\t xfrm_state_clone_and_setup()\n\t x-\u003ecalg = xfrm_algo_clone(orig-\u003ecalg);\n\t kmemdup(orig, xfrm_alg_len(orig));\n\nwhere xfrm_alg_len() returns sizeof(*alg) + (alg_key_len + 7) / 8. With\na non-zero garbage alg_key_len, kmemdup() reads past the end of the\n68-byte calg object. Adding an IPComp SA via PF_KEY and then migrating\nit triggers (net-next, KASAN, init_on_alloc=0):\n\n BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x44/0x60\n Read of size 4164 at addr ff11000025a74980 by task diag2/9287\n CPU: 3 UID: 0 PID: 9287 Comm: diag2 7.1.0-rc6-g903db046d557 #1\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x10e/0x1f0\n print_report+0xf7/0x600\n kasan_report+0xe4/0x120\n kasan_check_range+0x105/0x1b0\n __asan_memcpy+0x23/0x60\n kmemdup_noprof+0x44/0x60\n xfrm_state_migrate+0x70a/0x1da0\n xfrm_migrate+0x753/0x18a0\n xfrm_do_migrate+0xb47/0xf10\n xfrm_user_rcv_msg+0x411/0xb50\n netlink_rcv_skb+0x158/0x420\n xfrm_netlink_rcv+0x71/0x90\n netlink_unicast+0x584/0x850\n netlink_sendmsg+0x8b0/0xdc0\n ____sys_sendmsg+0x9f7/0xb90\n ___sys_sendmsg+0x134/0x1d0\n __sys_sendmsg+0x16d/0x220\n do_syscall_64+0x116/0x7d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\n Allocated by task 9287:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n pfkey_add+0x2652/0x2ea0\n pfkey_process+0x6d0/0x830\n pfkey_sendmsg+0x42c/0x850\n __sys_sendto+0x461/0x4b0\n __x64_sys_sendto+0xe0/0x1c0\n do_syscall_64+0x116/0x7d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n The buggy address belongs to the object at ff11000025a74980\n which belongs to the cache kmalloc-96 of size 96\n The buggy address is located 0 bytes inside of\n allocated 68-byte region [ff11000025a74980, ff11000025a749c4)\n\nDepending on the uninitialized value the same field can instead request\nan oversized kmemdup() allocation and make the migration clone fail.\n\nThe XFRM netlink path is not affected: verify_one_alg() rejects an\nXFRMA_ALG_COMP attribute shorter than xfrm_alg_len(), so a calg added via\nXFRM_MSG_NEWSA is always self-consistent.\n\nInitialize calg-\u003ealg_key_len to 0, matching the aalg/ealg branches."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local PF_KEY and XFRM netlink messages; received IPComp network packets cannot create or migrate the vulnerable state.\nAC:L - The attacker can deterministically prime the same kmalloc-96 cache and control the stale length before triggering migration. No race or victim-controlled condition is required.\nPR:L - Both paths require CAP_NET_ADMIN relative to the network namespace\u0027s owning user namespace. An unprivileged user can obtain this capability in a newly created user and network namespace.\nUI:N - No victim action is required after the attacker gains local execution and submits the crafted state and migration messages.\nS:U - The vulnerability affects the host kernel within its existing security authority and does not cross a VM, IOMMU, or equivalent scope boundary.\nC:H - The controlled length causes a potentially large out-of-bounds read across adjacent kernel heap objects, which can capture sensitive kernel memory and is not tightly bounded.\nI:N - kmemdup allocates a destination matching the computed length, and the vulnerable operation only over-reads the source. No out-of-bounds write or control-flow modification path was identified.\nA:H - The over-read can trigger a kernel fault or panic under memory-safety enforcement. Controlled oversized clone allocations can also be repeated across states to exhaust kernel memory."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:37.549Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/58e82fc3dedb57b1432292504415b224fd2d6acb"
},
{
"url": "https://git.kernel.org/stable/c/01b9115b55018123ef2449ac4951f89147a8428e"
},
{
"url": "https://git.kernel.org/stable/c/3f63d1752d90c0e28be931a48ab5d89bc97d637d"
},
{
"url": "https://git.kernel.org/stable/c/273c06b81d2e902b21acc801ae18c8276c8a9b69"
},
{
"url": "https://git.kernel.org/stable/c/6de2a650917bedaaefd65b17cede83c5e2c1dedd"
},
{
"url": "https://git.kernel.org/stable/c/e8417353cbd078d10531ba3928e609c84ab09e6b"
},
{
"url": "https://git.kernel.org/stable/c/cea34abc94b0a81e3a8b5cfb41cf45af37c2c67e"
},
{
"url": "https://git.kernel.org/stable/c/d129c3177d7b1138fd5066fcc63a698b3ba415b0"
}
],
"title": "net: af_key: initialize alg_key_len for IPComp states",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64436",
"datePublished": "2026-07-25T08:51:10.370Z",
"dateReserved": "2026-07-19T15:36:31.787Z",
"dateUpdated": "2026-10-19T20:38:28.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68425 (GCVE-0-2026-68425)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/mad: Drop unmatched RMPP responses before reassembly
Kernel-handled RMPP receive processing starts reassembly for active
DATA responses before the response is matched to an outstanding send.
The normal match happens later, after ib_process_rmpp_recv_wc() has
either assembled a complete message or consumed the segment.
That ordering lets an unsolicited response that routes to a kernel
RMPP agent by the high TID bits allocate or extend RMPP receive state
before the full TID and source address are checked against a real
request. A reordered burst can therefore reach the receive-side
insertion path even though the response would not match any send.
For kernel-handled RMPP DATA responses, require the existing
ib_find_send_mad() match before entering RMPP reassembly. The matcher
already checks the full TID, management class and source address/GID
against the agent wait, backlog and in-flight send lists. If there is
no match, drop the response without creating RMPP state.
This leaves the RMPP window behavior unchanged and only rejects
responses that have no corresponding request.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fa619a77046bef30478697aba0553991033afb8e Version: fa619a77046bef30478697aba0553991033afb8e Version: fa619a77046bef30478697aba0553991033afb8e Version: fa619a77046bef30478697aba0553991033afb8e Version: fa619a77046bef30478697aba0553991033afb8e Version: fa619a77046bef30478697aba0553991033afb8e Version: fa619a77046bef30478697aba0553991033afb8e Version: fa619a77046bef30478697aba0553991033afb8e |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68425",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:42.836474Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:09.668Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/mad.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "45416c87ebcece1e90f3bc5bc172d106b77c6b69",
"status": "affected",
"version": "fa619a77046bef30478697aba0553991033afb8e",
"versionType": "git"
},
{
"lessThan": "9634fb1f4d404f36a20ffbcb8797369db69b06bb",
"status": "affected",
"version": "fa619a77046bef30478697aba0553991033afb8e",
"versionType": "git"
},
{
"lessThan": "bfb9e8243fd2099d1080d09222964d988f991d9b",
"status": "affected",
"version": "fa619a77046bef30478697aba0553991033afb8e",
"versionType": "git"
},
{
"lessThan": "dfa535c94406c03d3f0c869ef3ba5528e395737c",
"status": "affected",
"version": "fa619a77046bef30478697aba0553991033afb8e",
"versionType": "git"
},
{
"lessThan": "6e1bd7f590b0ccfee07f7fe1d48b92059bd37d72",
"status": "affected",
"version": "fa619a77046bef30478697aba0553991033afb8e",
"versionType": "git"
},
{
"lessThan": "98d2d468b4faa1fdc68c0c6c238389906ee3490c",
"status": "affected",
"version": "fa619a77046bef30478697aba0553991033afb8e",
"versionType": "git"
},
{
"lessThan": "ad9c9ad3204f63a46f0f7de29687a8e512f05e29",
"status": "affected",
"version": "fa619a77046bef30478697aba0553991033afb8e",
"versionType": "git"
},
{
"lessThan": "d2e52d610b9b09694261632340b801a421e0b0c5",
"status": "affected",
"version": "fa619a77046bef30478697aba0553991033afb8e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/mad.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.13"
},
{
"lessThan": "2.6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mad: Drop unmatched RMPP responses before reassembly\n\nKernel-handled RMPP receive processing starts reassembly for active\nDATA responses before the response is matched to an outstanding send.\nThe normal match happens later, after ib_process_rmpp_recv_wc() has\neither assembled a complete message or consumed the segment.\n\nThat ordering lets an unsolicited response that routes to a kernel\nRMPP agent by the high TID bits allocate or extend RMPP receive state\nbefore the full TID and source address are checked against a real\nrequest. A reordered burst can therefore reach the receive-side\ninsertion path even though the response would not match any send.\n\nFor kernel-handled RMPP DATA responses, require the existing\nib_find_send_mad() match before entering RMPP reassembly. The matcher\nalready checks the full TID, management class and source address/GID\nagainst the agent wait, backlog and in-flight send lists. If there is\nno match, drop the response without creating RMPP state.\n\nThis leaves the RMPP window behavior unchanged and only rejects\nresponses that have no corresponding request."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The attacker must be a node on the same InfiniBand fabric, sending unsolicited GSI (QP1) management datagrams to the victim port; MAD/SA traffic is subnet-local, matching the CVSS \"shared physical or logical network\" definition rather than routable network reach.\nAC:L - No race or unusual precondition is needed: the attacker just sends active RMPP DATA response MADs whose high TID bits name a kernel RMPP agent, and hi_tid is a small cyclic xarray index in [0,2^24) that is trivially enumerated or brute-forced.\nPR:N - The MAD receive path accepts unsolicited datagrams from any fabric peer with no authentication; the only gate is ib_mad_enforce_security() P_Key membership, which the default partition typically grants to every node on the subnet.\nUI:N - Reassembly state is created entirely from attacker-sent packets in the completion handler; no action by a local user or administrator is needed, and the always-registered ib_sa kernel agent is the target.\nS:U - The injected RMPP state, allocations and AH objects all live inside the kernel\u0027s own IB MAD layer on the same host, so the impact stays within a single security authority.\nC:N - The flaw creates unmatched reassembly state; it provides no out-of-bounds read, no kernel memory disclosure, and the ACKs the kernel emits echo only attacker-supplied header fields.\nI:L - An unauthenticated fabric peer can insert arbitrary unsolicited entries into the kernel agent\u0027s RMPP reassembly lists and make the kernel emit ACKs, and a colliding entry (SA TIDs come from a predictable tid++ counter) diverts and drops a legitimate SA response\u0027s segments \u2014 limited, bounded modification of kernel protocol state.\nA:H - Each unmatched segment allocates a mad_rmpp_recv, an AH and a retained ~1-2 KB MAD buffer held for 40 seconds with no matching request, so a burst causes unbounded memory/resource exhaustion, while the O(N) rmpp_list walks under an IRQ-disabled spinlock stall MAD processing and break SA/path resolution for the node."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:35:19.996Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/45416c87ebcece1e90f3bc5bc172d106b77c6b69"
},
{
"url": "https://git.kernel.org/stable/c/9634fb1f4d404f36a20ffbcb8797369db69b06bb"
},
{
"url": "https://git.kernel.org/stable/c/bfb9e8243fd2099d1080d09222964d988f991d9b"
},
{
"url": "https://git.kernel.org/stable/c/dfa535c94406c03d3f0c869ef3ba5528e395737c"
},
{
"url": "https://git.kernel.org/stable/c/6e1bd7f590b0ccfee07f7fe1d48b92059bd37d72"
},
{
"url": "https://git.kernel.org/stable/c/98d2d468b4faa1fdc68c0c6c238389906ee3490c"
},
{
"url": "https://git.kernel.org/stable/c/ad9c9ad3204f63a46f0f7de29687a8e512f05e29"
},
{
"url": "https://git.kernel.org/stable/c/d2e52d610b9b09694261632340b801a421e0b0c5"
}
],
"title": "IB/mad: Drop unmatched RMPP responses before reassembly",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68425",
"datePublished": "2026-08-10T12:04:45.947Z",
"dateReserved": "2026-07-30T09:28:09.392Z",
"dateUpdated": "2026-10-19T21:09:09.668Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68123 (GCVE-0-2026-68123)
Vulnerability from cvelistv5
Published
2026-08-10 11:58
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: fix GSO userspace truncation underflow
OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb
length in OVS_CB(skb)->cutlen. When a later userspace action segments a
GSO skb, queue_gso_packets() reuses that delta for each smaller segment.
A segment can then reach queue_userspace_packet() with cutlen greater
than skb->len, underflowing the length passed to skb_zerocopy().
Store the maximum preserved length instead and bound each consumer
against the current skb length. Use U32_MAX as the no-truncation
sentinel so the value remains valid if skb geometry changes before a
consumer handles it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:44:13.520896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:51.936Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/actions.c",
"net/openvswitch/datapath.c",
"net/openvswitch/datapath.h",
"net/openvswitch/vport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "50a6a85f3d6b1d22d8436848606cdef5d2c490b4",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "2623c48cc3a8da9a1886fd8f65c0e348f4406fd6",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "e211b081901ffca76674082c73eeaed53524c369",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "a16eaaf7c0b0ccdef6166707d90ffbc6eebf6855",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "fbfa3ad2ad6f3a5624aba5211c46290fb98cc9dc",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "100a23b1613e9218e0af654ef102352c713f0263",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "ea85dbcbe8d4056ecb54352f97743d138ea4c407",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "4032f8ed10fcb84d41c508dfb04be96589f78dfe",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/actions.c",
"net/openvswitch/datapath.c",
"net/openvswitch/datapath.h",
"net/openvswitch/vport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix GSO userspace truncation underflow\n\nOVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb\nlength in OVS_CB(skb)-\u003ecutlen. When a later userspace action segments a\nGSO skb, queue_gso_packets() reuses that delta for each smaller segment.\nA segment can then reach queue_userspace_packet() with cutlen greater\nthan skb-\u003elen, underflowing the length passed to skb_zerocopy().\n\nStore the maximum preserved length instead and bound each consumer\nagainst the current skb length. Use U32_MAX as the no-truncation\nsentinel so the value remains valid if skb geometry changes before a\nconsumer handles it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Ingress packets reach ovs_vport_receive() through netdev rx_handlers or tunnel vports; GRO-coalesced GSO skbs from remote senders traverse this path into queue_gso_packets(), so the underflow is reachable from the network without physical access.\nAC:L - The attacker chooses truncation max_len relative to GSO super-skb size and sends traffic that GRO segments predictably; no timing race or fragile heap layout is required to make cutlen exceed a child segment length after __skb_gso_segment().\nPR:N - In multi-tenant cloud/OVN deployments, a remote VM or container can send crafted GSO traffic into the host OVS datapath to hit provider-installed TRUNC+USERSPACE sampling flows without possessing any Linux capabilities on the host.\nUI:N - Triggering the flaw requires only network traffic matching existing OVS flow actions; no victim login, file open, mount, or other interactive step is needed.\nS:U - Impact is kernel memory corruption and crash/escalation within the host kernel security domain; it does not cross a guest-to-hypervisor, VM, or hardware IOMMU trust boundary by itself.\nC:H - Unsigned underflow makes skb-\u003elen-cutlen enormous for skb_zerocopy()/skb_copy_bits(), enabling out-of-bounds reads from the source skb and adjacent slab data, i.e., an exploitable information-disclosure primitive.\nI:H - The same underflowed length can expand destination skbs via skb_len_add()/nlattr sizing, corrupting kernel heap metadata and yielding a write primitive suitable for control-flow hijacking.\nA:H - The miscopied lengths can BUG the skb helpers or cause immediate kernel oops/panic during zerocopy/trim handling, and corrupted metadata can crash the system even if exploitation is not completed."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:34.391Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/50a6a85f3d6b1d22d8436848606cdef5d2c490b4"
},
{
"url": "https://git.kernel.org/stable/c/2623c48cc3a8da9a1886fd8f65c0e348f4406fd6"
},
{
"url": "https://git.kernel.org/stable/c/e211b081901ffca76674082c73eeaed53524c369"
},
{
"url": "https://git.kernel.org/stable/c/a16eaaf7c0b0ccdef6166707d90ffbc6eebf6855"
},
{
"url": "https://git.kernel.org/stable/c/fbfa3ad2ad6f3a5624aba5211c46290fb98cc9dc"
},
{
"url": "https://git.kernel.org/stable/c/100a23b1613e9218e0af654ef102352c713f0263"
},
{
"url": "https://git.kernel.org/stable/c/ea85dbcbe8d4056ecb54352f97743d138ea4c407"
},
{
"url": "https://git.kernel.org/stable/c/4032f8ed10fcb84d41c508dfb04be96589f78dfe"
}
],
"title": "openvswitch: fix GSO userspace truncation underflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68123",
"datePublished": "2026-08-10T11:58:43.727Z",
"dateReserved": "2026-07-30T09:28:09.369Z",
"dateUpdated": "2026-10-19T20:58:51.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64164 (GCVE-0-2026-64164)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-07-19 15:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()
The trace event btrfs_sync_file() is called in an atomic context (all trace
events are) and its call to dput(), which is needed due to the call to
dget_parent(), can sleep, triggering a kernel splat.
This can be reproduced by enabling the trace event and running btrfs/056
from fstests for example. The splat shown in dmesg is the following:
[53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970
[53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io
[53.988] preempt_count: 2, expected: 0
[53.967] RCU nest depth: 0, expected: 0
[53.943] Preemption disabled at:
[53.944] [<0000000000000000>] 0x0
[54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full)
[54.070] Tainted: [W]=WARN
[54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
[54.072] Call Trace:
[54.074] <TASK>
[54.076] dump_stack_lvl+0x56/0x80
[54.079] __might_resched.cold+0xd6/0x10f
[54.072] dput.part.0+0x24/0x110
[54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs]
[54.089] btrfs_sync_file+0x1ed/0x530 [btrfs]
[54.087] ? __handle_mm_fault+0x8ae/0xed0
[54.089] btrfs_do_write_iter+0x172/0x210 [btrfs]
[54.091] vfs_write+0x21f/0x450
[54.094] __x64_sys_pwrite64+0x8d/0xc0
[54.096] ? do_user_addr_fault+0x20c/0x670
[54.099] do_syscall_64+0x60/0xf20
[54.092] ? clear_bhb_loop+0x60/0xb0
[54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e
So stop using dget_parent() and dput() and access the parent dentry
directly as dentry->d_parent. This is also what ext4 is doing in
its equivalent trace event ext4_sync_file_enter().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4a7bab35fad5251c8cb738161152578cd83b6b9c Version: 520e8b4bcf872a534a7bf61ccf880047642df296 Version: e252db8ca2a01f82d472091f35d549b313278636 Version: c09a7446aab5773f38d6abb25fce99b8e1dfbc97 Version: 32372781d664a9b03c40343e96c29d0a6139f97d Version: 2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a Version: a85b46db143fda5869e7d8df8f258ccef5fa1719 Version: a85b46db143fda5869e7d8df8f258ccef5fa1719 Version: d110d7cdb045715c0b45b0dfd974525bb38f653d Version: 6.6.136 ≤ Version: 6.12.83 ≤ Version: 6.18.24 ≤ Version: 6.19.14 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/trace/events/btrfs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d78b0a80eac36879ef5478707135c446920e134b",
"status": "affected",
"version": "4a7bab35fad5251c8cb738161152578cd83b6b9c",
"versionType": "git"
},
{
"lessThan": "4361954f0e158af0530caa1e57f12b531be4658f",
"status": "affected",
"version": "520e8b4bcf872a534a7bf61ccf880047642df296",
"versionType": "git"
},
{
"lessThan": "6279992c9ba2774901c9d4dd4a481162e2534714",
"status": "affected",
"version": "e252db8ca2a01f82d472091f35d549b313278636",
"versionType": "git"
},
{
"lessThan": "26b2290baaf6da6add0f782a100766e686a33f4f",
"status": "affected",
"version": "c09a7446aab5773f38d6abb25fce99b8e1dfbc97",
"versionType": "git"
},
{
"lessThan": "12a0487945c09760a5968d9333383014ea294117",
"status": "affected",
"version": "32372781d664a9b03c40343e96c29d0a6139f97d",
"versionType": "git"
},
{
"lessThan": "c32a7e0e3c73c1c0768556a56bd78de9f7b83780",
"status": "affected",
"version": "2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a",
"versionType": "git"
},
{
"lessThan": "0a96d9a85cd2240481297156b9bb72e10b7a8036",
"status": "affected",
"version": "a85b46db143fda5869e7d8df8f258ccef5fa1719",
"versionType": "git"
},
{
"lessThan": "c73370c677646e86fc4b1780fb07027bdf847375",
"status": "affected",
"version": "a85b46db143fda5869e7d8df8f258ccef5fa1719",
"versionType": "git"
},
{
"status": "affected",
"version": "d110d7cdb045715c0b45b0dfd974525bb38f653d",
"versionType": "git"
},
{
"lessThan": "6.6.142",
"status": "affected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThan": "6.12.92",
"status": "affected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThan": "6.18.34",
"status": "affected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/trace/events/btrfs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "6.6.136",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "6.12.83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.18.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()\n\nThe trace event btrfs_sync_file() is called in an atomic context (all trace\nevents are) and its call to dput(), which is needed due to the call to\ndget_parent(), can sleep, triggering a kernel splat.\n\nThis can be reproduced by enabling the trace event and running btrfs/056\nfrom fstests for example. The splat shown in dmesg is the following:\n\n [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970\n [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io\n [53.988] preempt_count: 2, expected: 0\n [53.967] RCU nest depth: 0, expected: 0\n [53.943] Preemption disabled at:\n [53.944] [\u003c0000000000000000\u003e] 0x0\n [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full)\n [54.070] Tainted: [W]=WARN\n [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n [54.072] Call Trace:\n [54.074] \u003cTASK\u003e\n [54.076] dump_stack_lvl+0x56/0x80\n [54.079] __might_resched.cold+0xd6/0x10f\n [54.072] dput.part.0+0x24/0x110\n [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs]\n [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs]\n [54.087] ? __handle_mm_fault+0x8ae/0xed0\n [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs]\n [54.091] vfs_write+0x21f/0x450\n [54.094] __x64_sys_pwrite64+0x8d/0xc0\n [54.096] ? do_user_addr_fault+0x20c/0x670\n [54.099] do_syscall_64+0x60/0xf20\n [54.092] ? clear_bhb_loop+0x60/0xb0\n [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nSo stop using dget_parent() and dput() and access the parent dentry\ndirectly as dentry-\u003ed_parent. This is also what ext4 is doing in\nits equivalent trace event ext4_sync_file_enter()."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T15:40:49.894Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d78b0a80eac36879ef5478707135c446920e134b"
},
{
"url": "https://git.kernel.org/stable/c/4361954f0e158af0530caa1e57f12b531be4658f"
},
{
"url": "https://git.kernel.org/stable/c/6279992c9ba2774901c9d4dd4a481162e2534714"
},
{
"url": "https://git.kernel.org/stable/c/26b2290baaf6da6add0f782a100766e686a33f4f"
},
{
"url": "https://git.kernel.org/stable/c/12a0487945c09760a5968d9333383014ea294117"
},
{
"url": "https://git.kernel.org/stable/c/c32a7e0e3c73c1c0768556a56bd78de9f7b83780"
},
{
"url": "https://git.kernel.org/stable/c/0a96d9a85cd2240481297156b9bb72e10b7a8036"
},
{
"url": "https://git.kernel.org/stable/c/c73370c677646e86fc4b1780fb07027bdf847375"
}
],
"title": "btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64164",
"datePublished": "2026-07-19T15:40:49.894Z",
"dateReserved": "2026-07-19T07:54:57.038Z",
"dateUpdated": "2026-07-19T15:40:49.894Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53238 (GCVE-0-2026-53238)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netlabel: validate unlabeled address and mask attribute lengths
netlbl_unlabel_addrinfo_get() used the address attribute length to
determine whether the attribute data could be read as an IPv4 or IPv6
address, but did not independently validate the corresponding mask
attribute length. A crafted Generic Netlink request could therefore
provide a valid IPv4/IPv6 address attribute with a shorter mask
attribute, which would later be read as a full struct in_addr or
struct in6_addr.
NLA_BINARY policy lengths are maximum lengths by default, so use
NLA_POLICY_EXACT_LEN() for the unlabeled IPv4/IPv6 address and mask
attributes. This rejects short attributes during policy validation and
also exposes the exact length requirements through policy introspection.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd Version: 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd Version: 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd Version: 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd Version: 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd Version: 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd Version: 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd Version: 8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netlabel/netlabel_unlabeled.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "975a84fd741440853380d37465b6e226cf47254c",
"status": "affected",
"version": "8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd",
"versionType": "git"
},
{
"lessThan": "672f0f3b8f875ffe6525a37847eafa7648c4c0c6",
"status": "affected",
"version": "8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd",
"versionType": "git"
},
{
"lessThan": "95bda3eac0b1454c2cee98d58d9ba6dd8391e843",
"status": "affected",
"version": "8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd",
"versionType": "git"
},
{
"lessThan": "07a18f5c90dd3d586b73242f5a5bbf0a72f2fdc6",
"status": "affected",
"version": "8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd",
"versionType": "git"
},
{
"lessThan": "71c52da13c3737493b42d20d9f33de34e03b3156",
"status": "affected",
"version": "8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd",
"versionType": "git"
},
{
"lessThan": "0c4bb32ad7fdc2dc6a8050f41eb04d4bda56b6c8",
"status": "affected",
"version": "8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd",
"versionType": "git"
},
{
"lessThan": "ccfe292a966079c61ea68a2da303b2a336170993",
"status": "affected",
"version": "8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd",
"versionType": "git"
},
{
"lessThan": "9772589b57e44aedc240211c5c3f7a684a034d3a",
"status": "affected",
"version": "8cc44579d1bd77ba3a32f2cb76fd9669c229c5fd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netlabel/netlabel_unlabeled.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlabel: validate unlabeled address and mask attribute lengths\n\nnetlbl_unlabel_addrinfo_get() used the address attribute length to\ndetermine whether the attribute data could be read as an IPv4 or IPv6\naddress, but did not independently validate the corresponding mask\nattribute length. A crafted Generic Netlink request could therefore\nprovide a valid IPv4/IPv6 address attribute with a shorter mask\nattribute, which would later be read as a full struct in_addr or\nstruct in6_addr.\n\nNLA_BINARY policy lengths are maximum lengths by default, so use\nNLA_POLICY_EXACT_LEN() for the unlabeled IPv4/IPv6 address and mask\nattributes. This rejects short attributes during policy validation and\nalso exposes the exact length requirements through policy introspection."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:34.492Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/975a84fd741440853380d37465b6e226cf47254c"
},
{
"url": "https://git.kernel.org/stable/c/672f0f3b8f875ffe6525a37847eafa7648c4c0c6"
},
{
"url": "https://git.kernel.org/stable/c/95bda3eac0b1454c2cee98d58d9ba6dd8391e843"
},
{
"url": "https://git.kernel.org/stable/c/07a18f5c90dd3d586b73242f5a5bbf0a72f2fdc6"
},
{
"url": "https://git.kernel.org/stable/c/71c52da13c3737493b42d20d9f33de34e03b3156"
},
{
"url": "https://git.kernel.org/stable/c/0c4bb32ad7fdc2dc6a8050f41eb04d4bda56b6c8"
},
{
"url": "https://git.kernel.org/stable/c/ccfe292a966079c61ea68a2da303b2a336170993"
},
{
"url": "https://git.kernel.org/stable/c/9772589b57e44aedc240211c5c3f7a684a034d3a"
}
],
"title": "netlabel: validate unlabeled address and mask attribute lengths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53238",
"datePublished": "2026-06-25T08:39:34.492Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-06-25T08:39:34.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74615 (GCVE-0-2026-74615)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-10-16 19:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vxlan: do not arm the ageing timer on a device that is down
vxlan_changelink() arms vxlan->age_timer whenever the requested ageing
interval differs from the configured one:
if (conf.age_interval != vxlan->cfg.age_interval)
mod_timer(&vxlan->age_timer, jiffies);
There is no netif_running() test, so the timer is armed even on a device
that was never brought up. The only synchronous cancel in the driver is
the timer_delete_sync() in vxlan_stop(), which is .ndo_stop.
netif_close_many() drops devices without IFF_UP before
__dev_close_many() runs, so that cancel is skipped for such a device.
vxlan_setup() sets dev->needs_free_netdev = true and age_timer is a
member of struct vxlan_dev, so free_netdev() releases the allocation the
timer lives in while it is still queued on a timer_base.
expire_timers() unlinks the entry before it loads timer->function, so
the timer core writes through the freed object's list pointers:
BUG: KASAN: slab-use-after-free in __run_timers+0x208/0x654
Write of size 8 at addr ffff00001adace68 by task true/192
__asan_store8+0x84/0xac
__run_timers+0x208/0x654
run_timer_softirq+0x154/0x18c
Allocated by task 189:
alloc_netdev_mqs+0x64/0x720
rtnl_create_link+0x4ac/0x520
rtnl_newlink+0x758/0xd00
Freed by task 191:
netdev_release+0x40/0x58
netdev_run_todo+0x4a4/0x8c0
rtnl_dellink+0x200/0x4e8
The rtnl operations involved are netns-scoped, so an unprivileged user
can perform them in a new user and network namespace.
Arming the timer on a down device never had an effect: vxlan_cleanup()
returns early on !netif_running(), and vxlan_open() arms the timer for
any non-zero interval once the device is brought up. Add the missing
test.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 40051c4dcad5b374156ad9cceae8d15c0ef1cb95 Version: 40051c4dcad5b374156ad9cceae8d15c0ef1cb95 Version: 40051c4dcad5b374156ad9cceae8d15c0ef1cb95 Version: 40051c4dcad5b374156ad9cceae8d15c0ef1cb95 Version: 40051c4dcad5b374156ad9cceae8d15c0ef1cb95 Version: 40051c4dcad5b374156ad9cceae8d15c0ef1cb95 Version: 40051c4dcad5b374156ad9cceae8d15c0ef1cb95 Version: 40051c4dcad5b374156ad9cceae8d15c0ef1cb95 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74615",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:02:29.628278Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:06:02.032Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be44d79d14d7f9ae7c8ffb7272142005341b5123",
"status": "affected",
"version": "40051c4dcad5b374156ad9cceae8d15c0ef1cb95",
"versionType": "git"
},
{
"lessThan": "26c179d47403d2f919ee914cc02c31d896b59fee",
"status": "affected",
"version": "40051c4dcad5b374156ad9cceae8d15c0ef1cb95",
"versionType": "git"
},
{
"lessThan": "9dc561f0522c35bdd66e0646a748814a138ec4ca",
"status": "affected",
"version": "40051c4dcad5b374156ad9cceae8d15c0ef1cb95",
"versionType": "git"
},
{
"lessThan": "619dd29045e439d0b0f8c6d4fec1af447a050680",
"status": "affected",
"version": "40051c4dcad5b374156ad9cceae8d15c0ef1cb95",
"versionType": "git"
},
{
"lessThan": "6b095e99b9e67ea31f0c4b00260e010898253519",
"status": "affected",
"version": "40051c4dcad5b374156ad9cceae8d15c0ef1cb95",
"versionType": "git"
},
{
"lessThan": "46bb297ad77680e009244f067f27d51cf5b8c7cf",
"status": "affected",
"version": "40051c4dcad5b374156ad9cceae8d15c0ef1cb95",
"versionType": "git"
},
{
"lessThan": "6b4119af544996a545cf84b16f1dbce829ba0de8",
"status": "affected",
"version": "40051c4dcad5b374156ad9cceae8d15c0ef1cb95",
"versionType": "git"
},
{
"lessThan": "b37971686ec59fb027fa4910ba16805e68fddb97",
"status": "affected",
"version": "40051c4dcad5b374156ad9cceae8d15c0ef1cb95",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vxlan/vxlan_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: do not arm the ageing timer on a device that is down\n\nvxlan_changelink() arms vxlan-\u003eage_timer whenever the requested ageing\ninterval differs from the configured one:\n\n\tif (conf.age_interval != vxlan-\u003ecfg.age_interval)\n\t\tmod_timer(\u0026vxlan-\u003eage_timer, jiffies);\n\nThere is no netif_running() test, so the timer is armed even on a device\nthat was never brought up. The only synchronous cancel in the driver is\nthe timer_delete_sync() in vxlan_stop(), which is .ndo_stop.\nnetif_close_many() drops devices without IFF_UP before\n__dev_close_many() runs, so that cancel is skipped for such a device.\n\nvxlan_setup() sets dev-\u003eneeds_free_netdev = true and age_timer is a\nmember of struct vxlan_dev, so free_netdev() releases the allocation the\ntimer lives in while it is still queued on a timer_base.\nexpire_timers() unlinks the entry before it loads timer-\u003efunction, so\nthe timer core writes through the freed object\u0027s list pointers:\n\n BUG: KASAN: slab-use-after-free in __run_timers+0x208/0x654\n Write of size 8 at addr ffff00001adace68 by task true/192\n __asan_store8+0x84/0xac\n __run_timers+0x208/0x654\n run_timer_softirq+0x154/0x18c\n Allocated by task 189:\n alloc_netdev_mqs+0x64/0x720\n rtnl_create_link+0x4ac/0x520\n rtnl_newlink+0x758/0xd00\n Freed by task 191:\n netdev_release+0x40/0x58\n netdev_run_todo+0x4a4/0x8c0\n rtnl_dellink+0x200/0x4e8\n\nThe rtnl operations involved are netns-scoped, so an unprivileged user\ncan perform them in a new user and network namespace.\n\nArming the timer on a down device never had an effect: vxlan_cleanup()\nreturns early on !netif_running(), and vxlan_open() arms the timer for\nany non-zero interval once the device is brought up. Add the missing\ntest.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local RTNETLINK on AF_NETLINK: RTM_NEWLINK creates a vxlan netdev, changelink with IFLA_VXLAN_AGEING arms age_timer, and RTM_DELLINK frees it; remote VXLAN encapsulation/packet receive is not involved.\nAC:L - The attacker fully controls a deterministic sequence on a never-up device: changelink calls mod_timer(jiffies) and dellink frees netdev while the timer stays queued because netif_close_many skips IFF_UP-less devices so vxlan_stop/timer_delete_sync never runs.\nPR:L - rtnetlink_rcv_msg requires CAP_NET_ADMIN for RTM_NEWLINK, RTM_SETLINK, and RTM_DELLINK; unprivileged local users obtain this capability inside a new user and network namespace (unshare -Urn), as stated in the fix commit.\nUI:N - No victim interaction is required; the attacker alone issues netlink create/changelink/delete operations on their own down vxlan interface without bringing the device up or requiring mounts or file access.\nS:C - Slab UAF corruption triggered from CAP_NET_ADMIN inside an unprivileged user/network namespace affects host kernel timer-list memory outside the namespace sandbox, crossing the container-to-host security boundary.\nC:H - KASAN reports slab-use-after-free with an 8-byte write through freed vxlan_dev-\u003eage_timer list pointers in __run_timers; UAF on kernel timer structures enables arbitrary kernel memory disclosure via slab heap reuse.\nI:H - expire_timers() writes to freed timer_list entry fields before loading the callback, providing controlled slab corruption; UAF on embedded vxlan_dev timers is exploitable for arbitrary kernel writes and privilege escalation.\nA:H - Confirmed KASAN slab-use-after-free in run_timer_softirq can kernel oops/panic; the dangling timer remains armed after rtnl_dellink and the sequence can be repeated for reliable denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:42.219Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be44d79d14d7f9ae7c8ffb7272142005341b5123"
},
{
"url": "https://git.kernel.org/stable/c/26c179d47403d2f919ee914cc02c31d896b59fee"
},
{
"url": "https://git.kernel.org/stable/c/9dc561f0522c35bdd66e0646a748814a138ec4ca"
},
{
"url": "https://git.kernel.org/stable/c/619dd29045e439d0b0f8c6d4fec1af447a050680"
},
{
"url": "https://git.kernel.org/stable/c/6b095e99b9e67ea31f0c4b00260e010898253519"
},
{
"url": "https://git.kernel.org/stable/c/46bb297ad77680e009244f067f27d51cf5b8c7cf"
},
{
"url": "https://git.kernel.org/stable/c/6b4119af544996a545cf84b16f1dbce829ba0de8"
},
{
"url": "https://git.kernel.org/stable/c/b37971686ec59fb027fa4910ba16805e68fddb97"
}
],
"title": "vxlan: do not arm the ageing timer on a device that is down",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74615",
"datePublished": "2026-08-22T15:32:00.588Z",
"dateReserved": "2026-08-15T05:44:03.920Z",
"dateUpdated": "2026-10-16T19:06:02.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43134 (GCVE-0-2026-43134)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-10-19 19:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
This adds a check for encryption key size upon receiving
L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which
expects L2CAP_CR_LE_BAD_KEY_SIZE.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:15:03.252855Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "CWE-326 Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:16:21.882Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "335071c0c3637064ec250481f589075db44fe4e6",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "fa6ad76fa8623c0a50d529cd5726fa5d819a3be4",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "9118601ff90b79e8df3c0c98f48ae00c1b02ecef",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "481ea39b342c347b6ac029f3d418486280be4e45",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "ec91078e132179b04e0c3906b599816c056ceaad",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "96581749c7c14fbec32c35728520867929600041",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "8dd43f9a9323f9c01bc8246da8d81a4c783c9e97",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "138d7eca445ef37a0333425d269ee59900ca1104",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ\n\nThis adds a check for encryption key size upon receiving\nL2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which\nexpects L2CAP_CR_LE_BAD_KEY_SIZE."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable request is an incoming Bluetooth LE L2CAP signaling packet from a nearby Bluetooth peer, so exploitation requires adjacent radio proximity rather than IP network or local shell access.\nAC:L - An attacker who can establish an LE link can send an L2CAP_LE_CONN_REQ with an insufficient encryption key size and reliably reach the missing check; there is no race or condition outside attacker control.\nPR:N - The attacker does not need privileges on the target system; Bluetooth pairing/encryption is a protocol precondition, not an OS privilege, and the vulnerable authorization decision is made from received peer traffic.\nUI:N - In a reasonable deployment with a listening LE L2CAP service and connectable device, exploitation is triggered by the adjacent peer\u2019s protocol messages without requiring the victim to open a file, mount anything, or perform an action.\nS:U - The issue bypasses Bluetooth/L2CAP security policy within the same kernel and host Bluetooth service security authority, with no VM, sandbox, or hardware boundary escape.\nC:H - Accepting a channel despite an insufficient encryption key can expose all data carried by a protected LE Credit Based L2CAP service; for high-impact Bluetooth deployments, that can disclose sensitive application or device-control data.\nI:H - The same security bypass can allow an adjacent peer using inadequate encryption strength to send commands or modify state over a service that should have rejected the connection, giving high integrity impact in the protected service context.\nA:N - The bug is a missing key-size enforcement check and does not indicate memory corruption, panic, deadlock, resource exhaustion, or another availability failure."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:10.307Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/335071c0c3637064ec250481f589075db44fe4e6"
},
{
"url": "https://git.kernel.org/stable/c/fa6ad76fa8623c0a50d529cd5726fa5d819a3be4"
},
{
"url": "https://git.kernel.org/stable/c/9118601ff90b79e8df3c0c98f48ae00c1b02ecef"
},
{
"url": "https://git.kernel.org/stable/c/481ea39b342c347b6ac029f3d418486280be4e45"
},
{
"url": "https://git.kernel.org/stable/c/ec91078e132179b04e0c3906b599816c056ceaad"
},
{
"url": "https://git.kernel.org/stable/c/96581749c7c14fbec32c35728520867929600041"
},
{
"url": "https://git.kernel.org/stable/c/8dd43f9a9323f9c01bc8246da8d81a4c783c9e97"
},
{
"url": "https://git.kernel.org/stable/c/138d7eca445ef37a0333425d269ee59900ca1104"
}
],
"title": "Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43134",
"datePublished": "2026-05-06T11:27:21.541Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-10-19T19:16:21.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64512 (GCVE-0-2026-64512)
Vulnerability from cvelistv5
Published
2026-07-25 08:52
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: CPPC: Suppress UBSAN warning caused by field misuse
The definition of reg->access_width changes depending on the
reg->space_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses
access_width to indicate the PCC region, which can result in a UBSAN
if the value is greater than 4.
For example:
UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9
shift exponent 32 is too large for 32-bit type 'int'
CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy)
Hardware name: To be filled by O.E.M.
Call trace:
...(trimming)
ubsan_epilogue+0x10/0x48
__ubsan_handle_shift_out_of_bounds+0xdc/0x1e0
cpc_write+0x4d0/0x670
cppc_set_perf+0x18c/0x490
cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq]
... (trimming)
Lets fix this by validating the region type, as well as whether
access_width has a value. Then since we are returning bit_width
directly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting
the size.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4949affd5288b867cdf115f5b08d6166b2027f87 Version: 01fc53be672acae37e611c80cc0b4f3939584de3 Version: 1b890ae474d19800a6be1696df7fb4d9a41676e4 Version: 2f4a4d63a193be6fd530d180bb13c3592052904c Version: 2f4a4d63a193be6fd530d180bb13c3592052904c Version: 2f4a4d63a193be6fd530d180bb13c3592052904c Version: 2f4a4d63a193be6fd530d180bb13c3592052904c Version: 6cb6b12b78dcd8867a3fdbb1b6d0ed1df2b208d1 Version: 5.15.154 ≤ Version: 6.1.90 ≤ Version: 6.6.30 ≤ Version: 6.8.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/cppc_acpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b54c4632946ae42f2b39ed38abd909bbf78cbcc2",
"status": "affected",
"version": "4949affd5288b867cdf115f5b08d6166b2027f87",
"versionType": "git"
},
{
"lessThan": "e904596ba6dd108534ffa15e3e46b2fe245145e2",
"status": "affected",
"version": "01fc53be672acae37e611c80cc0b4f3939584de3",
"versionType": "git"
},
{
"lessThan": "2fb80e962029000959f651665baa4838cc92eb99",
"status": "affected",
"version": "1b890ae474d19800a6be1696df7fb4d9a41676e4",
"versionType": "git"
},
{
"lessThan": "37f28bf8f14672dfa395994e41fd778a63f0bf5c",
"status": "affected",
"version": "2f4a4d63a193be6fd530d180bb13c3592052904c",
"versionType": "git"
},
{
"lessThan": "f29dc6132d4968e39d8fa575d1a12e2c718ce57b",
"status": "affected",
"version": "2f4a4d63a193be6fd530d180bb13c3592052904c",
"versionType": "git"
},
{
"lessThan": "dc066bd13c860bb27d6ace511210e18b8064c1d9",
"status": "affected",
"version": "2f4a4d63a193be6fd530d180bb13c3592052904c",
"versionType": "git"
},
{
"lessThan": "1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1",
"status": "affected",
"version": "2f4a4d63a193be6fd530d180bb13c3592052904c",
"versionType": "git"
},
{
"status": "affected",
"version": "6cb6b12b78dcd8867a3fdbb1b6d0ed1df2b208d1",
"versionType": "git"
},
{
"lessThan": "5.15.155",
"status": "affected",
"version": "5.15.154",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.90",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.30",
"versionType": "semver"
},
{
"lessThan": "6.9",
"status": "affected",
"version": "6.8.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/cppc_acpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.155",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.155",
"versionStartIncluding": "5.15.154",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: CPPC: Suppress UBSAN warning caused by field misuse\n\nThe definition of reg-\u003eaccess_width changes depending on the\nreg-\u003espace_id type. Type ACPI_ADR_SPACE_PLATFORM_COMM uses\naccess_width to indicate the PCC region, which can result in a UBSAN\nif the value is greater than 4.\n\nFor example:\n\n UBSAN: shift-out-of-bounds in drivers/acpi/cppc_acpi.c:1090:9\n shift exponent 32 is too large for 32-bit type \u0027int\u0027\n CPU: 61 UID: 0 PID: 1220 Comm: (udev-worker) Not tainted 7.0.10-201.fc44.aarch64 #1 PREEMPT(lazy)\n Hardware name: To be filled by O.E.M.\n Call trace:\n ...(trimming)\n ubsan_epilogue+0x10/0x48\n __ubsan_handle_shift_out_of_bounds+0xdc/0x1e0\n cpc_write+0x4d0/0x670\n cppc_set_perf+0x18c/0x490\n cppc_cpufreq_cpu_init+0x1c8/0x380 [cppc_cpufreq]\n ... (trimming)\n\nLets fix this by validating the region type, as well as whether\naccess_width has a value. Then since we are returning bit_width\ndirectly for ACPI_ADR_SPACE_PLATFORM_COMM, drop the code correcting\nthe size."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:03.207Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b54c4632946ae42f2b39ed38abd909bbf78cbcc2"
},
{
"url": "https://git.kernel.org/stable/c/e904596ba6dd108534ffa15e3e46b2fe245145e2"
},
{
"url": "https://git.kernel.org/stable/c/2fb80e962029000959f651665baa4838cc92eb99"
},
{
"url": "https://git.kernel.org/stable/c/37f28bf8f14672dfa395994e41fd778a63f0bf5c"
},
{
"url": "https://git.kernel.org/stable/c/f29dc6132d4968e39d8fa575d1a12e2c718ce57b"
},
{
"url": "https://git.kernel.org/stable/c/dc066bd13c860bb27d6ace511210e18b8064c1d9"
},
{
"url": "https://git.kernel.org/stable/c/1b1acf2dada0cc3931bb2cb9ff8832edfbee46a1"
}
],
"title": "ACPI: CPPC: Suppress UBSAN warning caused by field misuse",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64512",
"datePublished": "2026-07-25T08:52:04.423Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-08-17T04:57:03.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52925 (GCVE-0-2026-52925)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-06-24 07:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vrf: Fix a potential NPD when removing a port from a VRF
RCU readers that identified a net device as a VRF port using
netif_is_l3_slave() assume that a subsequent call to
netdev_master_upper_dev_get_rcu() will return a VRF device. They then
continue to dereference its l3mdev operations.
This assumption is not always correct and can result in a NPD [1]. There
is no RCU synchronization when removing a port from a VRF, so it is
possible for an RCU reader to see a new master device (e.g., a bridge)
that does not have l3mdev operations.
Fix by adding RCU synchronization after clearing the IFF_L3MDEV_SLAVE
flag. Skip this synchronization when a net device is removed from a VRF
as part of its deletion and when the VRF device itself is deleted. In
the latter case an RCU grace period will pass by the time RTNL is
released.
[1]
BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
RIP: 0010:l3mdev_fib_table_rcu (net/l3mdev/l3mdev.c:181)
[...]
Call Trace:
<TASK>
l3mdev_fib_table_by_index (net/l3mdev/l3mdev.c:201 net/l3mdev/l3mdev.c:189)
__inet_bind (net/ipv4/af_inet.c:499 (discriminator 3))
inet_bind_sk (net/ipv4/af_inet.c:469)
__sys_bind (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:1951 (discriminator 1))
__x64_sys_bind (net/socket.c:1969 (discriminator 1) net/socket.c:1967 (discriminator 1) net/socket.c:1967 (discriminator 1))
do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vrf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c022f582fd16a470df6ed9e7fb7e9fc48946d49",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "4ab6fc60ed5a0344b60711b09bff1dc238d8d6a4",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "468defa0b70902a22f4478c1207624bc1b31c124",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "3db8d078f7f652379ee394132b169d304f6eb4c1",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "8c2b792f04a3db97c9d8d2a45817e93f8884baf5",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "a7a97f2303e63ede105c1d55ef53dc497364e11d",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "d47204c127992da0c976ac9747070a575912e0fe",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "2674d603a9e6970463b2b9ebcf8e31e90beae169",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vrf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvrf: Fix a potential NPD when removing a port from a VRF\n\nRCU readers that identified a net device as a VRF port using\nnetif_is_l3_slave() assume that a subsequent call to\nnetdev_master_upper_dev_get_rcu() will return a VRF device. They then\ncontinue to dereference its l3mdev operations.\n\nThis assumption is not always correct and can result in a NPD [1]. There\nis no RCU synchronization when removing a port from a VRF, so it is\npossible for an RCU reader to see a new master device (e.g., a bridge)\nthat does not have l3mdev operations.\n\nFix by adding RCU synchronization after clearing the IFF_L3MDEV_SLAVE\nflag. Skip this synchronization when a net device is removed from a VRF\nas part of its deletion and when the VRF device itself is deleted. In\nthe latter case an RCU grace period will pass by the time RTNL is\nreleased.\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n[...]\nRIP: 0010:l3mdev_fib_table_rcu (net/l3mdev/l3mdev.c:181)\n[...]\nCall Trace:\n\u003cTASK\u003e\nl3mdev_fib_table_by_index (net/l3mdev/l3mdev.c:201 net/l3mdev/l3mdev.c:189)\n__inet_bind (net/ipv4/af_inet.c:499 (discriminator 3))\ninet_bind_sk (net/ipv4/af_inet.c:469)\n__sys_bind (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:1951 (discriminator 1))\n__x64_sys_bind (net/socket.c:1969 (discriminator 1) net/socket.c:1967 (discriminator 1) net/socket.c:1967 (discriminator 1))\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T07:14:19.351Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c022f582fd16a470df6ed9e7fb7e9fc48946d49"
},
{
"url": "https://git.kernel.org/stable/c/4ab6fc60ed5a0344b60711b09bff1dc238d8d6a4"
},
{
"url": "https://git.kernel.org/stable/c/468defa0b70902a22f4478c1207624bc1b31c124"
},
{
"url": "https://git.kernel.org/stable/c/3db8d078f7f652379ee394132b169d304f6eb4c1"
},
{
"url": "https://git.kernel.org/stable/c/8c2b792f04a3db97c9d8d2a45817e93f8884baf5"
},
{
"url": "https://git.kernel.org/stable/c/a7a97f2303e63ede105c1d55ef53dc497364e11d"
},
{
"url": "https://git.kernel.org/stable/c/d47204c127992da0c976ac9747070a575912e0fe"
},
{
"url": "https://git.kernel.org/stable/c/2674d603a9e6970463b2b9ebcf8e31e90beae169"
}
],
"title": "vrf: Fix a potential NPD when removing a port from a VRF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52925",
"datePublished": "2026-06-24T07:14:19.351Z",
"dateReserved": "2026-06-09T07:44:35.368Z",
"dateUpdated": "2026-06-24T07:14:19.351Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43125 (GCVE-0-2026-43125)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-10-21 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dlm: validate length in dlm_search_rsb_tree
The len parameter in dlm_dump_rsb_name() is not validated and comes
from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can
cause out-of-bounds write in dlm_search_rsb_tree().
Add length validation to prevent potential buffer overflow.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_extras_rt_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.155.1.rt56.1307.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.154.1.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.132.1.rt7.473.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.132.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.198.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.198.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.150.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.150.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.15.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.178.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.178.1.rt14.463.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.2"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.136.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.4"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.125.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.6"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Distributed Lock Manager (dlm) module. An attacker could send specially crafted network messages with an oversized length parameter to the dlm_dump_rsb_name() function. This lack of validation can lead to an out-of-bounds write in the dlm_search_rsb_tree() function, potentially causing a buffer overflow. This vulnerability could allow for denial of service or, in some cases, arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-130",
"description": "Improper Handling of Length Parameter Inconsistency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T12:05:44.813Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-43125"
},
{
"name": "RHBZ#2467234",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467234"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43125.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35844"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41236"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34095"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36767"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34094"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25217"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25121"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55762"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59091"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33899"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35863"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55761"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55837"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56224"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56225"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55763"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25120"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33900"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:35844: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:34095: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:36767: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:34094: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:25217: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25121: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:55762: Red Hat Enterprise Linux BaseOS (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:59091: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:33899: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:35863: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:55761: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:55837: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:56224: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:56225: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:55763: Red Hat Enterprise Linux BaseOS (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25120: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33900: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-06T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-06T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: dlm: validate length in dlm_search_rsb_tree",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43125",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:14:54.896196Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:06:14.654Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/dlm/lock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2deafd015ea9a0e75ee5764e20eb1e16bd73efd8",
"status": "affected",
"version": "7210cb7a72a22303cdb225bd1aea28697a17bbae",
"versionType": "git"
},
{
"lessThan": "67288113c5e6cf9e659b4065c0ed6f16100e0c71",
"status": "affected",
"version": "7210cb7a72a22303cdb225bd1aea28697a17bbae",
"versionType": "git"
},
{
"lessThan": "082083c9fbd99422a0370fe2102144a231c9f5d6",
"status": "affected",
"version": "7210cb7a72a22303cdb225bd1aea28697a17bbae",
"versionType": "git"
},
{
"lessThan": "5f053a2e7209d326cbbc07738fa6d6893d307438",
"status": "affected",
"version": "7210cb7a72a22303cdb225bd1aea28697a17bbae",
"versionType": "git"
},
{
"lessThan": "080e5563f878c64e697b89e7439d730d0daad882",
"status": "affected",
"version": "7210cb7a72a22303cdb225bd1aea28697a17bbae",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/dlm/lock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: validate length in dlm_search_rsb_tree\n\nThe len parameter in dlm_dump_rsb_name() is not validated and comes\nfrom network messages. When it exceeds DLM_RESNAME_MAXLEN, it can\ncause out-of-bounds write in dlm_search_rsb_tree().\n\nAdd length validation to prevent potential buffer overflow."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is reached by DLM recovery messages received over the kernel DLM TCP/SCTP lowcomms transport from a remote cluster peer. Although the peer address must match configured cluster membership, the bug is triggered by network protocol data delivered to the target kernel.\nAC:L - A remote peer that can send DLM recovery traffic controls the malformed RCOM_LOOKUP packet, including the special debug rc_id and oversized length/name payload. The recovery-state gate is a normal DLM condition that a participating peer can plausibly induce or target, so exploitation does not depend on conditions outside attacker control.\nPR:N - The vulnerable receive path does not require credentials or privileges on the target system before parsing the packet. Cluster peer/source-address admission is not a privilege on the vulnerable host, and there is no DLM authentication check before the oversized name reaches the copy.\nUI:N - No victim user action is required once the target DLM lockspace is active and receiving cluster traffic. The attacker sends the malformed recovery message directly.\nS:U - The impact is compromise or crash of the target kernel within the same security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary.\nC:H - The bug is a network-controlled stack buffer overflow in the kernel, copying up to socket-buffer-sized attacker data into a 64-byte resource-name key. Such memory corruption is defensibly exploitable for kernel information disclosure as part of code execution or memory disclosure primitives.\nI:H - The oversized memcpy can corrupt the kernel stack, including control data, from attacker-controlled network bytes. This supports arbitrary kernel memory modification or code execution in the highest reasonable scenario.\nA:H - Even without reliable code execution, the stack overflow can corrupt kernel control state and readily crash or panic the system. The malformed packet can be sent remotely whenever the vulnerable DLM receive path is reachable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:07.671Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2deafd015ea9a0e75ee5764e20eb1e16bd73efd8"
},
{
"url": "https://git.kernel.org/stable/c/67288113c5e6cf9e659b4065c0ed6f16100e0c71"
},
{
"url": "https://git.kernel.org/stable/c/082083c9fbd99422a0370fe2102144a231c9f5d6"
},
{
"url": "https://git.kernel.org/stable/c/5f053a2e7209d326cbbc07738fa6d6893d307438"
},
{
"url": "https://git.kernel.org/stable/c/080e5563f878c64e697b89e7439d730d0daad882"
}
],
"title": "dlm: validate length in dlm_search_rsb_tree",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43125",
"datePublished": "2026-05-06T11:27:10.903Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-10-21T12:40:07.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64322 (GCVE-0-2026-64322)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
udf: validate sparing table length as an entry count, not a byte count
udf_load_sparable_map() accepts a sparing table when
sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize
is false, i.e. it treats reallocationTableLen as a number of BYTES that
must fit in the block. But the table is walked as an array of 8-byte
sparingEntry elements:
for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) {
struct sparingEntry *entry = &st->mapEntry[i];
... entry->origLocation ...
}
in udf_get_pblock_spar15() and udf_relocate_blocks(). A
reallocationTableLen of N therefore passes the check whenever
sizeof(*st) + N <= blocksize, yet the consumers index
sizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the
block. On a crafted UDF image this is an out-of-bounds read in
udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the
same length to udf_update_tag(), whose crc_itu_t() reads far past the
block, and its memmove() through st->mapEntry[] is an out-of-bounds
write.
Validate reallocationTableLen as the entry count it is, with
struct_size().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 Version: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 Version: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 Version: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 Version: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 Version: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 Version: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 Version: 1df2ae31c724e57be9d7ac00d78db8a5dabdd050 Version: e240873cb4a9fd18de60a817100a96fe670d4359 Version: 9ae30e324a96d0328a575329d7a95a09b3318601 Version: b1c5701ad6b3e5d21d16f65475651cfaaa41e7aa Version: a9f1af04f086656246f30354fb4564ce3b08c4a0 Version: 4836ee563d65bb492f907cbe267a5761b9693e4d Version: 2.6.32.60 ≤ Version: 2.6.34.14 ≤ Version: 3.0.37 ≤ Version: 3.2.23 ≤ Version: 3.4.5 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64322",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:39:07.495740Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:23.865Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/udf/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "2d726135099313958f8975532a2e15322ff150ce",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "7285276aa50d2839afb5957ffd491ad282dc8f72",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "2a219acb2ce674d99bbd1b7b35ed8c384dac7200",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "04f4599a9efb90992d072a814960edf0cd62805d",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "7f7774b9da0ef17b87bfa238cf966ad0b3376150",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"lessThan": "3ec997bd5508e9b25210b5bbec89031629cdb093",
"status": "affected",
"version": "1df2ae31c724e57be9d7ac00d78db8a5dabdd050",
"versionType": "git"
},
{
"status": "affected",
"version": "e240873cb4a9fd18de60a817100a96fe670d4359",
"versionType": "git"
},
{
"status": "affected",
"version": "9ae30e324a96d0328a575329d7a95a09b3318601",
"versionType": "git"
},
{
"status": "affected",
"version": "b1c5701ad6b3e5d21d16f65475651cfaaa41e7aa",
"versionType": "git"
},
{
"status": "affected",
"version": "a9f1af04f086656246f30354fb4564ce3b08c4a0",
"versionType": "git"
},
{
"status": "affected",
"version": "4836ee563d65bb492f907cbe267a5761b9693e4d",
"versionType": "git"
},
{
"lessThan": "2.6.33",
"status": "affected",
"version": "2.6.32.60",
"versionType": "semver"
},
{
"lessThan": "2.6.35",
"status": "affected",
"version": "2.6.34.14",
"versionType": "semver"
},
{
"lessThan": "3.1",
"status": "affected",
"version": "3.0.37",
"versionType": "semver"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.23",
"versionType": "semver"
},
{
"lessThan": "3.5",
"status": "affected",
"version": "3.4.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/udf/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.32.60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.34.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate sparing table length as an entry count, not a byte count\n\nudf_load_sparable_map() accepts a sparing table when\n\n\tsizeof(*st) + le16_to_cpu(st-\u003ereallocationTableLen) \u003e sb-\u003es_blocksize\n\nis false, i.e. it treats reallocationTableLen as a number of BYTES that\nmust fit in the block. But the table is walked as an array of 8-byte\nsparingEntry elements:\n\n\tfor (i = 0; i \u003c le16_to_cpu(st-\u003ereallocationTableLen); i++) {\n\t\tstruct sparingEntry *entry = \u0026st-\u003emapEntry[i];\n\t\t... entry-\u003eorigLocation ...\n\t}\n\nin udf_get_pblock_spar15() and udf_relocate_blocks(). A\nreallocationTableLen of N therefore passes the check whenever\nsizeof(*st) + N \u003c= blocksize, yet the consumers index\nsizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the\nblock. On a crafted UDF image this is an out-of-bounds read in\nudf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the\nsame length to udf_update_tag(), whose crc_itu_t() reads far past the\nblock, and its memmove() through st-\u003emapEntry[] is an out-of-bounds\nwrite.\n\nValidate reallocationTableLen as the entry count it is, with\nstruct_size()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A crafted UDF image must be presented and mounted as local loop or removable block media; no network-facing path reaches this parser.\nAC:L - The attacker deterministically controls the entry count, table contents, block size, and accessed packet, with no race or condition outside attacker control.\nPR:L - Direct mounting requires initial-namespace CAP_SYS_ADMIN and user namespaces do not help, but common UDisks/polkit configurations let an active unprivileged local user mount attacker-controlled loop or removable media through a privileged broker.\nUI:N - The local attacker can request the brokered mount and trigger block translation themselves, requiring no action by a separate victim.\nS:U - Exploitation compromises the host kernel within its existing security authority and does not inherently cross a VM, IOMMU, or other scope boundary.\nC:H - The malformed count permits reads up to roughly eight times beyond the block, and relocation can expose adjacent kernel data through copied entries or returned mapping values.\nI:H - udf_relocate_blocks performs an out-of-bounds origLocation store and attacker-sized memmove through mapEntry[], potentially corrupting adjacent kernel pages and enabling control-flow hijacking.\nA:H - The extensive out-of-bounds reads and writes can reliably cause a kernel oops, panic, or fatal memory corruption."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:23.900Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eeb0f3e193f8e523d03e4c9e084f6b4875f50e8e"
},
{
"url": "https://git.kernel.org/stable/c/0a9b79a951cfd70a9d31ca01ae2d08a20bb730e9"
},
{
"url": "https://git.kernel.org/stable/c/2d726135099313958f8975532a2e15322ff150ce"
},
{
"url": "https://git.kernel.org/stable/c/7285276aa50d2839afb5957ffd491ad282dc8f72"
},
{
"url": "https://git.kernel.org/stable/c/2a219acb2ce674d99bbd1b7b35ed8c384dac7200"
},
{
"url": "https://git.kernel.org/stable/c/04f4599a9efb90992d072a814960edf0cd62805d"
},
{
"url": "https://git.kernel.org/stable/c/7f7774b9da0ef17b87bfa238cf966ad0b3376150"
},
{
"url": "https://git.kernel.org/stable/c/3ec997bd5508e9b25210b5bbec89031629cdb093"
}
],
"title": "udf: validate sparing table length as an entry count, not a byte count",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64322",
"datePublished": "2026-07-25T08:49:50.180Z",
"dateReserved": "2026-07-19T15:36:31.780Z",
"dateUpdated": "2026-10-19T20:38:23.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68188 (GCVE-0-2026-68188)
Vulnerability from cvelistv5
Published
2026-08-10 12:00
Modified
2026-08-19 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: Fix session UAF in set_termios
rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and
later passes the pointer to rfcomm_send_rpn(). The latter dereferences
both session->initiator and session->sock. Meanwhile, krfcommd can
unlink the DLC and free the session while holding rfcomm_mutex.
The race can proceed as follows:
TTY ioctl task krfcommd
-------------- --------
load dlc->session
enter rfcomm_send_rpn()
lock rfcomm_mutex
clear dlc->session
free session
unlock rfcomm_mutex
read session->initiator
KASAN reported:
BUG: KASAN: slab-use-after-free in rfcomm_send_rpn+0x297/0x2a0
Read of size 4 at addr ffff88810012a850 by task poc/92
Call Trace:
rfcomm_send_rpn+0x297/0x2a0
rfcomm_tty_set_termios+0x50d/0x850
tty_set_termios+0x596/0x950
set_termios+0x46a/0x6e0
tty_mode_ioctl+0x152/0xbd0
tty_ioctl+0x915/0x1240
__x64_sys_ioctl+0x134/0x1c0
Allocated by task 92:
rfcomm_session_add+0x9e/0x2e0
rfcomm_dlc_open+0x8b1/0xe00
rfcomm_dev_activate+0x85/0x1a0
rfcomm_tty_open+0x90/0x280
Freed by task 68:
kfree+0x131/0x3c0
rfcomm_session_del+0x119/0x180
rfcomm_run+0x737/0x4710
Add rfcomm_dlc_send_rpn(), which holds rfcomm_mutex while it verifies
that the DLC is still attached and sends the RPN frame. Have the TTY
path use the helper and drop its unlocked session check. This keeps the
session valid through both the frame construction and socket send.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 Version: 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 Version: 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 Version: 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 Version: 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 Version: 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 Version: 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 Version: 3a5e903c09aed19ca4a1bb26d87b8d6461a93818 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/rfcomm.h",
"net/bluetooth/rfcomm/core.c",
"net/bluetooth/rfcomm/tty.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4eac4576a072084b06459de6c054b4ebc764b4ea",
"status": "affected",
"version": "3a5e903c09aed19ca4a1bb26d87b8d6461a93818",
"versionType": "git"
},
{
"lessThan": "82c383f9031f1ce919ac6c3c06bc5bd492a6b078",
"status": "affected",
"version": "3a5e903c09aed19ca4a1bb26d87b8d6461a93818",
"versionType": "git"
},
{
"lessThan": "c5c060597247131f90f39ea7c8c978fa0c2e79d0",
"status": "affected",
"version": "3a5e903c09aed19ca4a1bb26d87b8d6461a93818",
"versionType": "git"
},
{
"lessThan": "2894bd8c68e97accd758ca6e5fc375d7e9e8882c",
"status": "affected",
"version": "3a5e903c09aed19ca4a1bb26d87b8d6461a93818",
"versionType": "git"
},
{
"lessThan": "a82a9d3891f5607030b0672c255087a12bb9837b",
"status": "affected",
"version": "3a5e903c09aed19ca4a1bb26d87b8d6461a93818",
"versionType": "git"
},
{
"lessThan": "780b04d09c941262ee2a2b4a09906451b69df8a6",
"status": "affected",
"version": "3a5e903c09aed19ca4a1bb26d87b8d6461a93818",
"versionType": "git"
},
{
"lessThan": "98bc68194e37bfa5e8ddc80b5c1eb0be4dc607ea",
"status": "affected",
"version": "3a5e903c09aed19ca4a1bb26d87b8d6461a93818",
"versionType": "git"
},
{
"lessThan": "c783399efc22d035443f1dfbf2a09bf9562aaa5e",
"status": "affected",
"version": "3a5e903c09aed19ca4a1bb26d87b8d6461a93818",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/rfcomm.h",
"net/bluetooth/rfcomm/core.c",
"net/bluetooth/rfcomm/tty.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"lessThan": "2.6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: Fix session UAF in set_termios\n\nrfcomm_tty_set_termios() tests dlc-\u003esession without rfcomm_mutex and\nlater passes the pointer to rfcomm_send_rpn(). The latter dereferences\nboth session-\u003einitiator and session-\u003esock. Meanwhile, krfcommd can\nunlink the DLC and free the session while holding rfcomm_mutex.\n\nThe race can proceed as follows:\n\n TTY ioctl task krfcommd\n -------------- --------\n load dlc-\u003esession\n enter rfcomm_send_rpn()\n lock rfcomm_mutex\n clear dlc-\u003esession\n free session\n unlock rfcomm_mutex\n read session-\u003einitiator\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in rfcomm_send_rpn+0x297/0x2a0\n Read of size 4 at addr ffff88810012a850 by task poc/92\n\n Call Trace:\n rfcomm_send_rpn+0x297/0x2a0\n rfcomm_tty_set_termios+0x50d/0x850\n tty_set_termios+0x596/0x950\n set_termios+0x46a/0x6e0\n tty_mode_ioctl+0x152/0xbd0\n tty_ioctl+0x915/0x1240\n __x64_sys_ioctl+0x134/0x1c0\n\n Allocated by task 92:\n rfcomm_session_add+0x9e/0x2e0\n rfcomm_dlc_open+0x8b1/0xe00\n rfcomm_dev_activate+0x85/0x1a0\n rfcomm_tty_open+0x90/0x280\n\n Freed by task 68:\n kfree+0x131/0x3c0\n rfcomm_session_del+0x119/0x180\n rfcomm_run+0x737/0x4710\n\nAdd rfcomm_dlc_send_rpn(), which holds rfcomm_mutex while it verifies\nthat the DLC is still attached and sends the RPN frame. Have the TTY\npath use the helper and drop its unlocked session check. This keeps the\nsession valid through both the frame construction and socket send."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:30:59.491Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4eac4576a072084b06459de6c054b4ebc764b4ea"
},
{
"url": "https://git.kernel.org/stable/c/82c383f9031f1ce919ac6c3c06bc5bd492a6b078"
},
{
"url": "https://git.kernel.org/stable/c/c5c060597247131f90f39ea7c8c978fa0c2e79d0"
},
{
"url": "https://git.kernel.org/stable/c/2894bd8c68e97accd758ca6e5fc375d7e9e8882c"
},
{
"url": "https://git.kernel.org/stable/c/a82a9d3891f5607030b0672c255087a12bb9837b"
},
{
"url": "https://git.kernel.org/stable/c/780b04d09c941262ee2a2b4a09906451b69df8a6"
},
{
"url": "https://git.kernel.org/stable/c/98bc68194e37bfa5e8ddc80b5c1eb0be4dc607ea"
},
{
"url": "https://git.kernel.org/stable/c/c783399efc22d035443f1dfbf2a09bf9562aaa5e"
}
],
"title": "Bluetooth: RFCOMM: Fix session UAF in set_termios",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68188",
"datePublished": "2026-08-10T12:00:00.521Z",
"dateReserved": "2026-07-30T09:28:09.373Z",
"dateUpdated": "2026-08-19T16:30:59.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68279 (GCVE-0-2026-68279)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-08-23 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers
drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw
message and then unconditionally does:
memcpy(bytes, &raw->msg[idx], num_bytes);
without checking that idx + num_bytes <= raw->curlen. raw->msg[] is
256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger
than the remaining payload, the memcpy reads past the received data
into whatever follows in raw->msg[].
drm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted
with a /* TODO check */ comment since the code was introduced).
Fix both functions by using a single combined check
(idx + num_bytes > curlen) before each memcpy. Since num_bytes is u8,
it is always >= 0, so this strictly subsumes the simpler idx > curlen
form and no separate step is needed.
[added missing fixes tag]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/display/drm_dp_mst_topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "185de1d74e658e2edb723ba76fa61903f77d8a68",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "d7b9b1e33b4ed8c48d4db6e6e21c257ebbbb2586",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "c2fbda0fe0163c55ba3820ee6cea0c6b43622eda",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "22d9f7fc1aaabaf73d5f30e8b0c9aa814ecd6ed2",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "04d953f50d61e542e94a5977822cc53735f8c0ce",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "533d9e2bede4aeefdc2a0561d7071cfede95958f",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "e6ef5455b06cb4e5d181aabcd723791587c79f12",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "1a8f537f5a1eeac941f262fe73078d6b08ba83c0",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/display/drm_dp_mst_topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers\n\ndrm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw\nmessage and then unconditionally does:\n\n memcpy(bytes, \u0026raw-\u003emsg[idx], num_bytes);\n\nwithout checking that idx + num_bytes \u003c= raw-\u003ecurlen. raw-\u003emsg[] is\n256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger\nthan the remaining payload, the memcpy reads past the received data\ninto whatever follows in raw-\u003emsg[].\n\ndrm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted\nwith a /* TODO check */ comment since the code was introduced).\n\nFix both functions by using a single combined check\n(idx + num_bytes \u003e curlen) before each memcpy. Since num_bytes is u8,\nit is always \u003e= 0, so this strictly subsumes the simpler idx \u003e curlen\nform and no separate step is needed.\n\n[added missing fixes tag]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:16.563Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/185de1d74e658e2edb723ba76fa61903f77d8a68"
},
{
"url": "https://git.kernel.org/stable/c/d7b9b1e33b4ed8c48d4db6e6e21c257ebbbb2586"
},
{
"url": "https://git.kernel.org/stable/c/c2fbda0fe0163c55ba3820ee6cea0c6b43622eda"
},
{
"url": "https://git.kernel.org/stable/c/22d9f7fc1aaabaf73d5f30e8b0c9aa814ecd6ed2"
},
{
"url": "https://git.kernel.org/stable/c/04d953f50d61e542e94a5977822cc53735f8c0ce"
},
{
"url": "https://git.kernel.org/stable/c/533d9e2bede4aeefdc2a0561d7071cfede95958f"
},
{
"url": "https://git.kernel.org/stable/c/e6ef5455b06cb4e5d181aabcd723791587c79f12"
},
{
"url": "https://git.kernel.org/stable/c/1a8f537f5a1eeac941f262fe73078d6b08ba83c0"
}
],
"title": "drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68279",
"datePublished": "2026-08-10T12:02:09.423Z",
"dateReserved": "2026-07-30T09:28:09.379Z",
"dateUpdated": "2026-08-23T12:46:16.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43456 (GCVE-0-2026-43456)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-10-19 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix type confusion in bond_setup_by_slave()
kernel BUG at net/core/skbuff.c:2306!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306
RSP: 0018:ffffc90004aff760 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e
RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900
RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780
R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0
Call Trace:
<TASK>
ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900
dev_hard_header include/linux/netdevice.h:3439 [inline]
packet_snd net/packet/af_packet.c:3028 [inline]
packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
__sys_sendmsg+0x170/0x220 net/socket.c:2678
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe1a0e6c1a9
When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,
bond_setup_by_slave() directly copies the slave's header_ops to the
bond device:
bond_dev->header_ops = slave_dev->header_ops;
This causes a type confusion when dev_hard_header() is later called
on the bond device. Functions like ipgre_header(), ip6gre_header(),all use
netdev_priv(dev) to access their device-specific private data. When
called with the bond device, netdev_priv() returns the bond's private
data (struct bonding) instead of the expected type (e.g. struct
ip_tunnel), leading to garbage values being read and kernel crashes.
Fix this by introducing bond_header_ops with wrapper functions that
delegate to the active slave's header_ops using the slave's own
device. This ensures netdev_priv() in the slave's header functions
always receives the correct device.
The fix is placed in the bonding driver rather than individual device
drivers, as the root cause is bond blindly inheriting header_ops from
the slave without considering that these callbacks expect a specific
netdev_priv() layout.
The type confusion can be observed by adding a printk in
ipgre_header() and running the following commands:
ip link add dummy0 type dummy
ip addr add 10.0.0.1/24 dev dummy0
ip link set dummy0 up
ip link add gre1 type gre local 10.0.0.1
ip link add bond1 type bond mode active-backup
ip link set gre1 master bond1
ip link set gre1 up
ip link set bond1 up
ip addr add fe80::1/64 dev bond1
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43456",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:17:30.903898Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:26:37.088Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5d0fb9806ab6cf2c3cfba0e1b8c701da65e25af8",
"status": "affected",
"version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
"versionType": "git"
},
{
"lessThan": "9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d",
"status": "affected",
"version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
"versionType": "git"
},
{
"lessThan": "6ac890f1d60ac3707ee8dae15a67d9a833e49956",
"status": "affected",
"version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
"versionType": "git"
},
{
"lessThan": "95597d11dc8bddb2b9a051c9232000bfbb5e43ba",
"status": "affected",
"version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
"versionType": "git"
},
{
"lessThan": "950803f7254721c1c15858fbbfae3deaaeeecb11",
"status": "affected",
"version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: fix type confusion in bond_setup_by_slave()\n\nkernel BUG at net/core/skbuff.c:2306!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306\nRSP: 0018:ffffc90004aff760 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e\nRDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900\nRBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000\nR10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780\nR13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900\n dev_hard_header include/linux/netdevice.h:3439 [inline]\n packet_snd net/packet/af_packet.c:3028 [inline]\n packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592\n ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646\n __sys_sendmsg+0x170/0x220 net/socket.c:2678\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fe1a0e6c1a9\n\nWhen a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,\nbond_setup_by_slave() directly copies the slave\u0027s header_ops to the\nbond device:\n\n bond_dev-\u003eheader_ops = slave_dev-\u003eheader_ops;\n\nThis causes a type confusion when dev_hard_header() is later called\non the bond device. Functions like ipgre_header(), ip6gre_header(),all use\nnetdev_priv(dev) to access their device-specific private data. When\ncalled with the bond device, netdev_priv() returns the bond\u0027s private\ndata (struct bonding) instead of the expected type (e.g. struct\nip_tunnel), leading to garbage values being read and kernel crashes.\n\nFix this by introducing bond_header_ops with wrapper functions that\ndelegate to the active slave\u0027s header_ops using the slave\u0027s own\ndevice. This ensures netdev_priv() in the slave\u0027s header functions\nalways receives the correct device.\n\nThe fix is placed in the bonding driver rather than individual device\ndrivers, as the root cause is bond blindly inheriting header_ops from\nthe slave without considering that these callbacks expect a specific\nnetdev_priv() layout.\n\nThe type confusion can be observed by adding a printk in\nipgre_header() and running the following commands:\n\n ip link add dummy0 type dummy\n ip addr add 10.0.0.1/24 dev dummy0\n ip link set dummy0 up\n ip link add gre1 type gre local 10.0.0.1\n ip link add bond1 type bond mode active-backup\n ip link set gre1 master bond1\n ip link set gre1 up\n ip link set bond1 up\n ip addr add fe80::1/64 dev bond1"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local rtnetlink/AF_PACKET operations: creating/enslaving a non-Ethernet slave to a bond and then causing `dev_hard_header()` on the bond device. Remote packets are not sufficient without the vulnerable local device configuration.\nAC:L - No race or special external timing is required; the attacker can deterministically create the bond/GRE setup and trigger the confused header callback. Required modules/configuration are common and autoloadable through rtnetlink in normal deployments.\nPR:L - The setup requires `CAP_NET_ADMIN` and the AF_PACKET trigger requires `CAP_NET_RAW`, but both are obtainable by an unprivileged local user inside a user/network namespace. Therefore this is low privilege rather than real init-namespace root only.\nUI:N - Exploitation does not require a victim user to perform an action. The attacker can perform the setup and trigger locally.\nS:U - The impact is within the kernel security authority on the same system. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug is kernel type confusion where bonding private data is interpreted as another device\u0027s private structure, and the confused callback can read kernel data using the wrong layout. Following the required higher-severity rule for type confusion, confidentiality impact is High.\nI:H - The confused header callback uses bogus private-data fields to construct and push protocol headers into an skb, making this a kernel memory/type confusion condition rather than a pure NULL dereference. Type confusion is scored as High integrity impact.\nA:H - The reported failure is a kernel BUG/oops in `pskb_expand_head()` reachable through the confused `ipgre_header()` call. This provides a reliable local kernel crash/DoS."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:03.247Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5d0fb9806ab6cf2c3cfba0e1b8c701da65e25af8"
},
{
"url": "https://git.kernel.org/stable/c/9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d"
},
{
"url": "https://git.kernel.org/stable/c/6ac890f1d60ac3707ee8dae15a67d9a833e49956"
},
{
"url": "https://git.kernel.org/stable/c/95597d11dc8bddb2b9a051c9232000bfbb5e43ba"
},
{
"url": "https://git.kernel.org/stable/c/950803f7254721c1c15858fbbfae3deaaeeecb11"
}
],
"title": "bonding: fix type confusion in bond_setup_by_slave()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43456",
"datePublished": "2026-05-08T14:22:20.036Z",
"dateReserved": "2026-05-01T14:12:56.010Z",
"dateUpdated": "2026-10-19T19:26:37.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53077 (GCVE-0-2026-53077)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/rds: Restrict use of RDS/IB to the initial network namespace
Prevent using RDS/IB in network namespaces other than the initial one.
The existing RDS/IB code will not work properly in non-initial network
namespaces.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/af_rds.c",
"net/rds/ib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e7f14cd5a51533404e1ae4809caab46073fb5c7",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "3174fc703d081d2ca538b22fba734e3ad5b52322",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "c244b79adffad89a5173cf8bfaa06a6b40bbd09b",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "07035306bf722f4676a1aee35cbeb3732c76194e",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "fb407343c0c16e94584707b2dfdd350a5f81b000",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "a7494479757d60d2413bfaa087f8431a26eea032",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "b6a54f5e9ce9b97ae641855378d71c5154a085c0",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "ebf71dd4aff46e8e421d455db3e231ba43d2fa8a",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/af_rds.c",
"net/rds/ib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: Restrict use of RDS/IB to the initial network namespace\n\nPrevent using RDS/IB in network namespaces other than the initial one.\nThe existing RDS/IB code will not work properly in non-initial network\nnamespaces."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Reachability is through local syscalls: unshare a user/network namespace, create an AF_RDS socket, select RDS/IB with setsockopt, then bind/send and tear down the namespace. A remote peer alone cannot create the stale non-init namespace RDS/IB connection.\nAC:L - The attacker controls the namespace lifetime and socket operations needed to leave an RDS/IB connection with a stale net pointer, and syzbot reproduced the UAF. No hard-to-win race or victim state outside attacker control is required.\nPR:L - AF_RDS socket creation and SO_RDS_TRANSPORT do not require real init-namespace root, and the issue is reachable by an unprivileged local user via user namespaces. This is not an unauthenticated remote path, so low local privileges are required.\nUI:N - No victim action is needed after the attacker runs the local namespace and socket sequence. The later RDMA/RDS workqueue access occurs asynchronously in kernel context.\nS:U - The vulnerability corrupts/accesses kernel resources within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-authority boundary break.\nC:H - The bug is a slab use-after-free read of a freed net_namespace from RDS/IB asynchronous connection handling. Under the required kernel scoring guidance, UAFs are scored as high confidentiality impact because freed object reuse can expose kernel memory.\nI:H - Although the observed report is a UAF read, use-after-free bugs can generally be shaped through heap reuse into stronger memory corruption primitives. Per the required guidance and uncertainty rule, this warrants high integrity impact.\nA:H - Syzbot reports a KASAN slab-use-after-free in rds_conn_path_drop, and the same stale pointer access can trigger kernel oops/panic or destabilize RDS/RDMA workqueues. Kernel crash availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:10.122Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e7f14cd5a51533404e1ae4809caab46073fb5c7"
},
{
"url": "https://git.kernel.org/stable/c/3174fc703d081d2ca538b22fba734e3ad5b52322"
},
{
"url": "https://git.kernel.org/stable/c/c244b79adffad89a5173cf8bfaa06a6b40bbd09b"
},
{
"url": "https://git.kernel.org/stable/c/07035306bf722f4676a1aee35cbeb3732c76194e"
},
{
"url": "https://git.kernel.org/stable/c/fb407343c0c16e94584707b2dfdd350a5f81b000"
},
{
"url": "https://git.kernel.org/stable/c/a7494479757d60d2413bfaa087f8431a26eea032"
},
{
"url": "https://git.kernel.org/stable/c/b6a54f5e9ce9b97ae641855378d71c5154a085c0"
},
{
"url": "https://git.kernel.org/stable/c/ebf71dd4aff46e8e421d455db3e231ba43d2fa8a"
}
],
"title": "net/rds: Restrict use of RDS/IB to the initial network namespace",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53077",
"datePublished": "2026-06-24T16:30:17.972Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-08-05T12:33:10.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64113 (GCVE-0-2026-64113)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ixgbevf: fix use-after-free in VEPA multicast source pruning
ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's
own address (VEPA multicast workaround) by freeing the skb and
continuing to the next descriptor:
dev_kfree_skb_irq(skb);
continue;
The skb pointer is declared outside the while loop and persists across
iterations. Because the continue skips the "skb = NULL" reset at the
bottom of the loop, the next iteration enters the "else if (skb)" path
and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing
skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context.
The sibling driver iavf already handles this correctly by nulling the
pointer before continuing. Apply the same pattern here.
I do not have ixgbevf hardware; the bug was found by static analysis
(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool
corroboration with the highest score in the scan). The UAF was confirmed
under KASAN by loading a test module that reproduces the exact code
pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):
BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000
Read of size 8 at addr 000000006163ae78 by task insmod/30
freed 208-byte region [000000006163adc0, 000000006163ae90)
QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF
driver does not include the VEPA source pruning path, so a full
end-to-end reproduction with emulated hardware was not possible.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bad17234ba702a50aeec50ab04724ee58af89607 Version: bad17234ba702a50aeec50ab04724ee58af89607 Version: bad17234ba702a50aeec50ab04724ee58af89607 Version: bad17234ba702a50aeec50ab04724ee58af89607 Version: bad17234ba702a50aeec50ab04724ee58af89607 Version: bad17234ba702a50aeec50ab04724ee58af89607 Version: bad17234ba702a50aeec50ab04724ee58af89607 Version: bad17234ba702a50aeec50ab04724ee58af89607 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64113",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:36:28.876679Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:12.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb",
"status": "affected",
"version": "bad17234ba702a50aeec50ab04724ee58af89607",
"versionType": "git"
},
{
"lessThan": "6ef30384a50a50e4a484cddf341bc27de31aa3de",
"status": "affected",
"version": "bad17234ba702a50aeec50ab04724ee58af89607",
"versionType": "git"
},
{
"lessThan": "55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1",
"status": "affected",
"version": "bad17234ba702a50aeec50ab04724ee58af89607",
"versionType": "git"
},
{
"lessThan": "add70e2682c0ad3be2a5810bcf1bc13963ba4df9",
"status": "affected",
"version": "bad17234ba702a50aeec50ab04724ee58af89607",
"versionType": "git"
},
{
"lessThan": "a244395d8c563ed1bb26c3ef708db6aeeaa08084",
"status": "affected",
"version": "bad17234ba702a50aeec50ab04724ee58af89607",
"versionType": "git"
},
{
"lessThan": "dfef79e09ed2f5df975c98547f97f5d7f8982a24",
"status": "affected",
"version": "bad17234ba702a50aeec50ab04724ee58af89607",
"versionType": "git"
},
{
"lessThan": "e8768bcbe5cd30c4ea36a22022c9ffaa66903693",
"status": "affected",
"version": "bad17234ba702a50aeec50ab04724ee58af89607",
"versionType": "git"
},
{
"lessThan": "5d49b568c188dc77199d8d2b959c91da8cc27cf1",
"status": "affected",
"version": "bad17234ba702a50aeec50ab04724ee58af89607",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: fix use-after-free in VEPA multicast source pruning\n\nixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF\u0027s\nown address (VEPA multicast workaround) by freeing the skb and\ncontinuing to the next descriptor:\n\n dev_kfree_skb_irq(skb);\n continue;\n\nThe skb pointer is declared outside the while loop and persists across\niterations. Because the continue skips the \"skb = NULL\" reset at the\nbottom of the loop, the next iteration enters the \"else if (skb)\" path\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing\nskb_shinfo(skb)-\u003enr_frags - a use-after-free in NAPI softirq context.\n\nThe sibling driver iavf already handles this correctly by nulling the\npointer before continuing. Apply the same pattern here.\n\nI do not have ixgbevf hardware; the bug was found by static analysis\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool\ncorroboration with the highest score in the scan). The UAF was confirmed\nunder KASAN by loading a test module that reproduces the exact code\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)-\u003enr_frags):\n\n BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000\n Read of size 8 at addr 000000006163ae78 by task insmod/30\n freed 208-byte region [000000006163adc0, 000000006163ae90)\n\nQEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF\ndriver does not include the VEPA source pruning path, so a full\nend-to-end reproduction with emulated hardware was not possible."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the ixgbevf NAPI receive path triggered by incoming Ethernet frames delivered by the VF hardware; per kernel guidance, driver bugs reachable via received packets are scored as Network.\nAC:L - An attacker can reliably trigger the bug by sending a VEPA-reflected multicast/broadcast frame whose source MAC matches the VF address, then immediately sending a follow-on frame so the next loop iteration reuses the freed skb pointer in the same NAPI poll.\nPR:N - Exploitation requires only the ability to inject crafted L2 frames at the VF (e.g., a co-tenant VM on the same VLAN/cloud segment); no local account or capabilities on the victim system are needed.\nUI:N - No victim user action is required; the UAF occurs automatically during softirq packet processing once the crafted frames are received.\nS:U - Impact is kernel memory corruption within the same privilege domain (guest or host kernel running the VF driver), not a cross-VM/host security-boundary escape.\nC:H - The UAF reads freed slab memory via `skb_shinfo(skb)-\u003enr_frags` in `ixgbevf_add_rx_frag()`, which KASAN confirmed and which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same UAF path writes into the freed skb through `skb_add_rx_frag()` (fragment metadata, lengths), enabling heap corruption and potential control-flow hijack.\nA:H - Use-after-free in NAPI softirq context can cause kernel oops/panic during receive processing even without full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:22.189Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d931ac62411a7e43b85dba5fe45e1a4a91bd5cb"
},
{
"url": "https://git.kernel.org/stable/c/6ef30384a50a50e4a484cddf341bc27de31aa3de"
},
{
"url": "https://git.kernel.org/stable/c/55b3e91d62b2f7a24109b2d7c9f4c66d2e3b1ec1"
},
{
"url": "https://git.kernel.org/stable/c/add70e2682c0ad3be2a5810bcf1bc13963ba4df9"
},
{
"url": "https://git.kernel.org/stable/c/a244395d8c563ed1bb26c3ef708db6aeeaa08084"
},
{
"url": "https://git.kernel.org/stable/c/dfef79e09ed2f5df975c98547f97f5d7f8982a24"
},
{
"url": "https://git.kernel.org/stable/c/e8768bcbe5cd30c4ea36a22022c9ffaa66903693"
},
{
"url": "https://git.kernel.org/stable/c/5d49b568c188dc77199d8d2b959c91da8cc27cf1"
}
],
"title": "ixgbevf: fix use-after-free in VEPA multicast source pruning",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64113",
"datePublished": "2026-07-19T15:40:14.251Z",
"dateReserved": "2026-07-19T07:54:57.035Z",
"dateUpdated": "2026-10-19T20:28:12.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80714 (GCVE-0-2026-80714)
Vulnerability from cvelistv5
Published
2026-08-28 06:53
Modified
2026-10-16 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: do not propagate one-packet flag to synced conns
Synced connections can be created before their destination exists. When
the destination is later added, ip_vs_bind_dest() copies connection flags
from the destination into cp->flags.
IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced
connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,
expiry can treat it as a one-packet connection and skip unlinking the
existing conn_tab node, leaving stale hash nodes pointing at a freed
struct ip_vs_conn.
Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced
connections.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca Version: 26ec037f9841e49cc5c615deb8e1e73e5beab2ca |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:20:40.726937Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:34.808Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06d1d9b56ef8132fbf85006885eb43d9510b8b02",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "acbdc276091b308ca7794acb86e761f8203e2f59",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "300348e3ba1521b003d59825f97e24f9a6859688",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "44af98cc7d5ef8e730488d5df1eecd5deeaa5947",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "4649e6faeecdc2d44bfa6ccbe405eef27e55d816",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "b5ee5b266f833601ac4817f6df0bc496fc376a28",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "e7acfc990c29890c883d0d0ce3f737d003a43b44",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
},
{
"lessThan": "a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b",
"status": "affected",
"version": "26ec037f9841e49cc5c615deb8e1e73e5beab2ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: do not propagate one-packet flag to synced conns\n\nSynced connections can be created before their destination exists. When\nthe destination is later added, ip_vs_bind_dest() copies connection flags\nfrom the destination into cp-\u003eflags.\n\nIP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced\nconnection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,\nexpiry can treat it as a one-packet connection and skip unlinking the\nexisting conn_tab node, leaving stale hash nodes pointing at a freed\nstruct ip_vs_conn.\n\nDrop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced\nconnections."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached on IPVS backup nodes processing UDP sync datagrams in ip_vs_process_message()/ip_vs_proc_conn() (default multicast 224.0.0.81:8848), and on internet-facing load balancers client UDP traffic drives master sync that creates the hashed backup connection before destination bind.\nAC:L - An attacker can reliably inject or refresh IPVS sync records for UDP connections whose destination is not yet present, then trigger ip_vs_try_bind_dest() once a ONEPACKET destination exists; only optional syncid filtering (often 0) is outside attacker control, and connection expiry is timer-driven without a race.\nPR:N - The backup sync receiver accepts unauthenticated UDP multicast with no capability checks in ip_vs_receive()/ip_vs_process_message(); configuring IPVS/ONEPACKET is an environmental precondition on HA load balancers, not a privilege the remote attacker must hold on the victim host.\nUI:N - Exploitation requires no victim or administrator action at trigger time beyond normal HA IPVS operation; forged or reflected sync traffic and subsequent connection expiry directly invoke the vulnerable bind/unlink path without user interaction.\nS:U - Impact is confined to the kernel IPVS connection table on the affected load-balancer node (stale hash entries to a freed struct ip_vs_conn); it does not cross a VM, container, or IOMMU security boundary.\nC:H - Incorrect ONE_PACKET handling leaves hashed conn_tab nodes pointing at a freed struct ip_vs_conn; subsequent lookups in __ip_vs_conn_in_get() dereference freed slab memory, giving a use-after-free read primitive and potential kernel pointer/data disclosure.\nI:H - The same use-after-free lets attackers influence reuse of the freed ip_vs_conn object and corrupt connection state during later hash-table operations, enabling memory corruption exploitable for arbitrary kernel writes or control-flow hijacking.\nA:H - Dereferencing stale conn_tab entries for a freed connection causes kernel oops/panic; the condition is repeatable by sending additional sync traffic to recreate and expire affected UDP synced connections on the backup node."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T06:22:30.808Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06d1d9b56ef8132fbf85006885eb43d9510b8b02"
},
{
"url": "https://git.kernel.org/stable/c/acbdc276091b308ca7794acb86e761f8203e2f59"
},
{
"url": "https://git.kernel.org/stable/c/300348e3ba1521b003d59825f97e24f9a6859688"
},
{
"url": "https://git.kernel.org/stable/c/44af98cc7d5ef8e730488d5df1eecd5deeaa5947"
},
{
"url": "https://git.kernel.org/stable/c/4649e6faeecdc2d44bfa6ccbe405eef27e55d816"
},
{
"url": "https://git.kernel.org/stable/c/b5ee5b266f833601ac4817f6df0bc496fc376a28"
},
{
"url": "https://git.kernel.org/stable/c/e7acfc990c29890c883d0d0ce3f737d003a43b44"
},
{
"url": "https://git.kernel.org/stable/c/a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b"
}
],
"title": "ipvs: do not propagate one-packet flag to synced conns",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80714",
"datePublished": "2026-08-28T06:53:13.069Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-10-16T19:26:34.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52946 (GCVE-0-2026-52946)
Vulnerability from cvelistv5
Published
2026-06-24 16:26
Modified
2026-10-19 19:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling
A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in
send_sigio() and send_sigurg() when a process group receives a signal.
When FASYNC is configured for a process group (PIDTYPE_PGID), both
functions use read_lock(&tasklist_lock) to traverse the task list.
However, they are frequently called from softirq context:
- send_sigio() via input_inject_event -> kill_fasync
- send_sigurg() via tcp_check_urg -> sk_send_sigurg (NET_RX_SOFTIRQ)
The deadlock is caused by the rwlock writer fairness mechanism:
1. CPU 0 (process context) holds read_lock(&tasklist_lock) in do_wait().
2. CPU 1 (process context) attempts write_lock(&tasklist_lock) in
fork() or exit() and spins, which blocks all new readers.
3. CPU 0 is interrupted by a softirq (e.g., TCP URG packet reception).
4. The softirq calls send_sigurg() and attempts to acquire
read_lock(&tasklist_lock), deadlocking because CPU 1 is waiting.
Since PID hashing and do_each_pid_task() traversals are already
RCU-protected, the read_lock on tasklist_lock is no longer strictly
required for safe traversal. Fix this by replacing tasklist_lock with
rcu_read_lock(), aligning the process group signaling path with the
single-PID path. This also mitigates a potential remote denial of
service vector via TCP URG packets.
Lockdep splat:
=====================================================
WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected
[...]
Chain exists of:
&dev->event_lock --> &f_owner->lock --> tasklist_lock
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(tasklist_lock);
local_irq_disable();
lock(&dev->event_lock);
lock(&f_owner->lock);
<Interrupt>
lock(&dev->event_lock);
*** DEADLOCK ***
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:22:02.371Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52946",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:23:11.779977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:47:09.047Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/fcntl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "54626335ea4174ab2d9a183b511d825f6765e47b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "897d6a7247739fb1528f98c575df4f2e5de7f994",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b5fa9e32fb6718f70c986ee14dd5d01b4846f331",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1bee417678f1135e35b25a37734db46aa94258d2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "20a93e397abe850c49b6fa0e8cc827b5f634a8f5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bfcc8e8d8a495bb34cae9e620adfb75fb13a3954",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "36c1b57b2ecf3c61ac93f5f07bd29b6f21e226ed",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "00633c4683828acd5256fa8d5163f440d74bbe71",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/fcntl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling\n\nA SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in\nsend_sigio() and send_sigurg() when a process group receives a signal.\n\nWhen FASYNC is configured for a process group (PIDTYPE_PGID), both\nfunctions use read_lock(\u0026tasklist_lock) to traverse the task list.\nHowever, they are frequently called from softirq context:\n- send_sigio() via input_inject_event -\u003e kill_fasync\n- send_sigurg() via tcp_check_urg -\u003e sk_send_sigurg (NET_RX_SOFTIRQ)\n\nThe deadlock is caused by the rwlock writer fairness mechanism:\n1. CPU 0 (process context) holds read_lock(\u0026tasklist_lock) in do_wait().\n2. CPU 1 (process context) attempts write_lock(\u0026tasklist_lock) in\n fork() or exit() and spins, which blocks all new readers.\n3. CPU 0 is interrupted by a softirq (e.g., TCP URG packet reception).\n4. The softirq calls send_sigurg() and attempts to acquire\n read_lock(\u0026tasklist_lock), deadlocking because CPU 1 is waiting.\n\nSince PID hashing and do_each_pid_task() traversals are already\nRCU-protected, the read_lock on tasklist_lock is no longer strictly\nrequired for safe traversal. Fix this by replacing tasklist_lock with\nrcu_read_lock(), aligning the process group signaling path with the\nsingle-PID path. This also mitigates a potential remote denial of\nservice vector via TCP URG packets.\n\nLockdep splat:\n=====================================================\nWARNING: SOFTIRQ-safe -\u003e SOFTIRQ-unsafe lock order detected\n[...]\nChain exists of:\n \u0026dev-\u003eevent_lock --\u003e \u0026f_owner-\u003elock --\u003e tasklist_lock\n\nPossible interrupt unsafe locking scenario:\n CPU0 CPU1\n ---- ----\n lock(tasklist_lock);\n local_irq_disable();\n lock(\u0026dev-\u003eevent_lock);\n lock(\u0026f_owner-\u003elock);\n \u003cInterrupt\u003e\n lock(\u0026dev-\u003eevent_lock);\n\n*** DEADLOCK ***"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote TCP peer can reach tcp_check_urg()-\u003esk_send_sigurg()-\u003esend_sigurg() by sending TCP packets with the URG flag to a service whose socket owner is configured as a process group. The fix explicitly identifies TCP URG packet reception as a potential remote denial-of-service vector.\nAC:L - The vulnerable condition is a lock-order deadlock, but an attacker can repeatedly send URG packets and, in a plausible forking/waiting network service, induce connection churn that exercises the other tasklist_lock paths. There is no memory-layout dependency or other hard-to-satisfy condition.\nPR:N - The network attacker does not need local privileges or authentication to send TCP URG traffic to an exposed service. The fcntl process-group ownership is target service state, not an attacker privilege requirement.\nUI:N - Exploitation does not require a user to open a file or perform an interactive action. Once the service is reachable and configured, packets alone can trigger the vulnerable path.\nS:U - The impact is within the Linux kernel and the same host security authority. It does not cross a VM, sandbox, or hardware isolation boundary.\nC:N - The bug is a lock ordering deadlock, not a memory disclosure or use-after-free. The fixed traversal is RCU-safe and does not imply an attacker read primitive.\nI:N - The vulnerability does not corrupt memory or provide a write/control-flow primitive. It only causes unsafe lock acquisition ordering during signal delivery.\nA:H - The deadlock can hang kernel execution in softirq/tasklist_lock paths and deny service to the affected system. A kernel deadlock is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:23.794Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/54626335ea4174ab2d9a183b511d825f6765e47b"
},
{
"url": "https://git.kernel.org/stable/c/897d6a7247739fb1528f98c575df4f2e5de7f994"
},
{
"url": "https://git.kernel.org/stable/c/32dbd5ce4be3a3ed7e00f8af18795cc84fc50a33"
},
{
"url": "https://git.kernel.org/stable/c/b5fa9e32fb6718f70c986ee14dd5d01b4846f331"
},
{
"url": "https://git.kernel.org/stable/c/1bee417678f1135e35b25a37734db46aa94258d2"
},
{
"url": "https://git.kernel.org/stable/c/20a93e397abe850c49b6fa0e8cc827b5f634a8f5"
},
{
"url": "https://git.kernel.org/stable/c/bfcc8e8d8a495bb34cae9e620adfb75fb13a3954"
},
{
"url": "https://git.kernel.org/stable/c/36c1b57b2ecf3c61ac93f5f07bd29b6f21e226ed"
},
{
"url": "https://git.kernel.org/stable/c/00633c4683828acd5256fa8d5163f440d74bbe71"
}
],
"title": "fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52946",
"datePublished": "2026-06-24T16:26:04.419Z",
"dateReserved": "2026-06-09T07:44:35.371Z",
"dateUpdated": "2026-10-19T19:47:09.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64343 (GCVE-0-2026-64343)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: ldusb: fix use-after-free on disconnect race
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ce0d7d3f575fc1ba6a89c3c651e710355590daff Version: ce0d7d3f575fc1ba6a89c3c651e710355590daff Version: ce0d7d3f575fc1ba6a89c3c651e710355590daff Version: ce0d7d3f575fc1ba6a89c3c651e710355590daff Version: ce0d7d3f575fc1ba6a89c3c651e710355590daff Version: ce0d7d3f575fc1ba6a89c3c651e710355590daff Version: ce0d7d3f575fc1ba6a89c3c651e710355590daff Version: ce0d7d3f575fc1ba6a89c3c651e710355590daff |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/ldusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fc55923a972e715f9a27187b47d4920709e23d85",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "af59829e67e11ba2511a9f8e4b9111afc7d1f550",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "d8f69404e1d671326f86d378b9f5bfbd56490e9d",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "a3e794136ab5e3ad1e7019175a4b837aec86db4b",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
},
{
"lessThan": "19bdfc7b3c179331eafa423d87e1336f43bbfeb8",
"status": "affected",
"version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/ldusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: ldusb: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it\u0027s unlocked\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:47.172Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fc55923a972e715f9a27187b47d4920709e23d85"
},
{
"url": "https://git.kernel.org/stable/c/e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69"
},
{
"url": "https://git.kernel.org/stable/c/af59829e67e11ba2511a9f8e4b9111afc7d1f550"
},
{
"url": "https://git.kernel.org/stable/c/02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4"
},
{
"url": "https://git.kernel.org/stable/c/d8f69404e1d671326f86d378b9f5bfbd56490e9d"
},
{
"url": "https://git.kernel.org/stable/c/2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915"
},
{
"url": "https://git.kernel.org/stable/c/a3e794136ab5e3ad1e7019175a4b837aec86db4b"
},
{
"url": "https://git.kernel.org/stable/c/19bdfc7b3c179331eafa423d87e1336f43bbfeb8"
}
],
"title": "USB: ldusb: fix use-after-free on disconnect race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64343",
"datePublished": "2026-07-25T08:50:05.828Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:47.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72164 (GCVE-0-2026-72164)
Vulnerability from cvelistv5
Published
2026-08-15 05:53
Modified
2026-10-16 18:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: avoid moving extents to occupied clusters
For non-auto OCFS2_IOC_MOVE_EXT operations, userspace supplies a physical
me_goal. ocfs2_move_extent() initializes new_phys_cpos from that goal and
expects ocfs2_probe_alloc_group() to replace it with a free run in the
target block group.
The probe currently leaves *phys_cpos unchanged if the scan reaches the
end of the group without finding a free run. An occupied goal at the last
bit can therefore survive the probe and be passed to
__ocfs2_move_extent(), which copies file data into a cluster still owned
by another inode before the bitmap is updated.
When the probe does find a free run, it also subtracts move_len from the
ending bit. The start of an N-bit run ending at i is i - N + 1, so the
current calculation can report the bit immediately before the free run.
Clear *phys_cpos before scanning and use the correct free-run start.
Callers already treat a zero result as -ENOSPC, so failed probes no longer
continue with an occupied caller-controlled goal.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e6b5859cccfa0fec02f3c5b1069481efc7186f47 Version: e6b5859cccfa0fec02f3c5b1069481efc7186f47 Version: e6b5859cccfa0fec02f3c5b1069481efc7186f47 Version: e6b5859cccfa0fec02f3c5b1069481efc7186f47 Version: e6b5859cccfa0fec02f3c5b1069481efc7186f47 Version: e6b5859cccfa0fec02f3c5b1069481efc7186f47 Version: e6b5859cccfa0fec02f3c5b1069481efc7186f47 Version: e6b5859cccfa0fec02f3c5b1069481efc7186f47 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72164",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:43:10.262778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:44:59.778Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/move_extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3112afebf2a76e522fbaabcbb0c47aafbdc35932",
"status": "affected",
"version": "e6b5859cccfa0fec02f3c5b1069481efc7186f47",
"versionType": "git"
},
{
"lessThan": "35486b291b8fbde6c4d0b1c79e565c6260d3329d",
"status": "affected",
"version": "e6b5859cccfa0fec02f3c5b1069481efc7186f47",
"versionType": "git"
},
{
"lessThan": "19f7b04924b20b81dabbeed19d5542792ba5b6d6",
"status": "affected",
"version": "e6b5859cccfa0fec02f3c5b1069481efc7186f47",
"versionType": "git"
},
{
"lessThan": "e281d892ce5870a50fdc718cb3bfc3dd5b62c728",
"status": "affected",
"version": "e6b5859cccfa0fec02f3c5b1069481efc7186f47",
"versionType": "git"
},
{
"lessThan": "0d0c5c17b18bdbc592ac26ab4d1de7e3dbf9be1e",
"status": "affected",
"version": "e6b5859cccfa0fec02f3c5b1069481efc7186f47",
"versionType": "git"
},
{
"lessThan": "d5d5a21fb33cd9b963aea99da81e4dacd452cd95",
"status": "affected",
"version": "e6b5859cccfa0fec02f3c5b1069481efc7186f47",
"versionType": "git"
},
{
"lessThan": "4d1953d3aeb4a7f6623083e1839068ee1c157db2",
"status": "affected",
"version": "e6b5859cccfa0fec02f3c5b1069481efc7186f47",
"versionType": "git"
},
{
"lessThan": "22920541c35a9f23f219038ba5874c843a7c4419",
"status": "affected",
"version": "e6b5859cccfa0fec02f3c5b1069481efc7186f47",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/move_extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: avoid moving extents to occupied clusters\n\nFor non-auto OCFS2_IOC_MOVE_EXT operations, userspace supplies a physical\nme_goal. ocfs2_move_extent() initializes new_phys_cpos from that goal and\nexpects ocfs2_probe_alloc_group() to replace it with a free run in the\ntarget block group.\n\nThe probe currently leaves *phys_cpos unchanged if the scan reaches the\nend of the group without finding a free run. An occupied goal at the last\nbit can therefore survive the probe and be passed to\n__ocfs2_move_extent(), which copies file data into a cluster still owned\nby another inode before the bitmap is updated.\n\nWhen the probe does find a free run, it also subtracts move_len from the\nending bit. The start of an N-bit run ending at i is i - N + 1, so the\ncurrent calculation can report the bit immediately before the free run.\n\nClear *phys_cpos before scanning and use the correct free-run start. \nCallers already treat a zero result as -ENOSPC, so failed probes no longer\ncontinue with an occupied caller-controlled goal."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires the OCFS2_IOC_MOVE_EXT ioctl on a locally mounted ocfs2 volume via sys_ioctl\u2192vfs_ioctl\u2192ocfs2_ioctl; OCFS2 has no network-facing handler exposing this code path.\nAC:L - The attacker fully controls me_goal and move length on the non-auto path; an occupied goal at the end of an alloc group deterministically bypasses ocfs2_probe_alloc_group() and reaches __ocfs2_move_extent() with no races or external preconditions.\nPR:L - OCFS2_IOC_MOVE_EXT performs no capable() check (unlike FITRIM); any local user with FMODE_WRITE on a regular file on an ocfs2 mount can invoke ioctl(), including root inside a user namespace per kernel CNA guidance.\nUI:N - The attacker issues OCFS2_IOC_MOVE_EXT on their own writable fd with crafted parameters; no victim interaction or third-party action is required beyond the enterprise ocfs2 mount already being present.\nS:U - Impact is confined to on-disk data corruption and filesystem availability within the same cluster node/kernel authority; it does not cross VM, container, or IOMMU security boundaries.\nC:H - __ocfs2_move_extent() copies into clusters still allocated to other inodes, creating cross-file block aliasing on shared cluster storage so later reads through the new extent can return another tenant\u0027s or root-owned file contents.\nI:H - ocfs2_duplicate_clusters_by_page() writes attacker-controlled file data into physical clusters owned by other inodes before the bitmap is updated, enabling arbitrary corruption of files the attacker lacks write permission to on shared OCFS2 storage.\nA:H - Dual allocation and bitmap/extent inconsistency can trigger ocfs2_error(), forcing remount-ro or panic on the node and corrupting shared storage in ways that impair availability for all cluster members until fsck.ocfs2."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:41:06.039Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3112afebf2a76e522fbaabcbb0c47aafbdc35932"
},
{
"url": "https://git.kernel.org/stable/c/35486b291b8fbde6c4d0b1c79e565c6260d3329d"
},
{
"url": "https://git.kernel.org/stable/c/19f7b04924b20b81dabbeed19d5542792ba5b6d6"
},
{
"url": "https://git.kernel.org/stable/c/e281d892ce5870a50fdc718cb3bfc3dd5b62c728"
},
{
"url": "https://git.kernel.org/stable/c/0d0c5c17b18bdbc592ac26ab4d1de7e3dbf9be1e"
},
{
"url": "https://git.kernel.org/stable/c/d5d5a21fb33cd9b963aea99da81e4dacd452cd95"
},
{
"url": "https://git.kernel.org/stable/c/4d1953d3aeb4a7f6623083e1839068ee1c157db2"
},
{
"url": "https://git.kernel.org/stable/c/22920541c35a9f23f219038ba5874c843a7c4419"
}
],
"title": "ocfs2: avoid moving extents to occupied clusters",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72164",
"datePublished": "2026-08-15T05:53:31.901Z",
"dateReserved": "2026-08-09T03:40:39.909Z",
"dateUpdated": "2026-10-16T18:44:59.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74519 (GCVE-0-2026-74519)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: devicetree: don't free uninitialized dev_name on error path
dt_remember_or_free_map() duplicates dev_name for each map entry. If
kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps
entries, including entries that have not been initialized.
Some pinctrl drivers, including pinctrl-imx, allocate the map with
kmalloc() and leave dev_name for the core to initialize. The untouched
entries therefore contain uninitialized data which is passed to
kfree_const().
Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection
while binding the pinctrl-consuming device, under KASAN:
BUG: KASAN: double-free in dt_free_map+0x34/0xa4
Free of addr c425a900 by task init/1
kfree from dt_free_map+0x34/0xa4
dt_free_map from dt_remember_or_free_map+0x184/0x198
dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8
pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0
Initialize all dev_name fields to NULL before duplicating the device
name, making the full-map cleanup safe after a partial failure.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: be4c60b563edee3712d392aaeb0943a768df7023 Version: be4c60b563edee3712d392aaeb0943a768df7023 Version: be4c60b563edee3712d392aaeb0943a768df7023 Version: be4c60b563edee3712d392aaeb0943a768df7023 Version: be4c60b563edee3712d392aaeb0943a768df7023 Version: be4c60b563edee3712d392aaeb0943a768df7023 Version: be4c60b563edee3712d392aaeb0943a768df7023 Version: be4c60b563edee3712d392aaeb0943a768df7023 Version: 03f69244302d7954f42f528ea2d45903ebbf59f3 Version: 77440c3a37203e3f4667d06e37f76ef3968d2d8c Version: 679c4f27b8958b65bb51d1c3dfdbf3befe4a33a3 Version: f88ac1330779c5bfdd79f7d7f7d4d3343c782f92 Version: f739a699db7d5a5cf39ca3ce2c84e4fe4a8f4c5d Version: 4.4.244 ≤ Version: 4.9.244 ≤ Version: 4.14.161 ≤ Version: 4.19.92 ≤ Version: 5.4.7 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74519",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:58:57.723333Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:52.543Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/devicetree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e3cfb22bad363bebcfd55d909e12d499cb8c5490",
"status": "affected",
"version": "be4c60b563edee3712d392aaeb0943a768df7023",
"versionType": "git"
},
{
"lessThan": "1586423da2739a80871ef6240016fcb9c7339bfb",
"status": "affected",
"version": "be4c60b563edee3712d392aaeb0943a768df7023",
"versionType": "git"
},
{
"lessThan": "dec5f0a8080502908dec5e35597c7ae07d533a3b",
"status": "affected",
"version": "be4c60b563edee3712d392aaeb0943a768df7023",
"versionType": "git"
},
{
"lessThan": "929f6396baade89999ec8a1281232c101cbc727d",
"status": "affected",
"version": "be4c60b563edee3712d392aaeb0943a768df7023",
"versionType": "git"
},
{
"lessThan": "321fe3584a8298386938130d138191aa35040b75",
"status": "affected",
"version": "be4c60b563edee3712d392aaeb0943a768df7023",
"versionType": "git"
},
{
"lessThan": "ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8",
"status": "affected",
"version": "be4c60b563edee3712d392aaeb0943a768df7023",
"versionType": "git"
},
{
"lessThan": "9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d",
"status": "affected",
"version": "be4c60b563edee3712d392aaeb0943a768df7023",
"versionType": "git"
},
{
"lessThan": "015b5bcbcb622b32317642be91a7f79aa5413649",
"status": "affected",
"version": "be4c60b563edee3712d392aaeb0943a768df7023",
"versionType": "git"
},
{
"status": "affected",
"version": "03f69244302d7954f42f528ea2d45903ebbf59f3",
"versionType": "git"
},
{
"status": "affected",
"version": "77440c3a37203e3f4667d06e37f76ef3968d2d8c",
"versionType": "git"
},
{
"status": "affected",
"version": "679c4f27b8958b65bb51d1c3dfdbf3befe4a33a3",
"versionType": "git"
},
{
"status": "affected",
"version": "f88ac1330779c5bfdd79f7d7f7d4d3343c782f92",
"versionType": "git"
},
{
"status": "affected",
"version": "f739a699db7d5a5cf39ca3ce2c84e4fe4a8f4c5d",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.244",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.244",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.161",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.92",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/devicetree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.244",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.244",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.161",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: devicetree: don\u0027t free uninitialized dev_name on error path\n\ndt_remember_or_free_map() duplicates dev_name for each map entry. If\nkstrdup_const() fails, dt_free_map() frees dev_name in all num_maps\nentries, including entries that have not been initialized.\n\nSome pinctrl drivers, including pinctrl-imx, allocate the map with\nkmalloc() and leave dev_name for the core to initialize. The untouched\nentries therefore contain uninitialized data which is passed to\nkfree_const().\n\nReproduced on qemu\u0027s mcimx6ul-evk (pinctrl-imx) with failslab injection\nwhile binding the pinctrl-consuming device, under KASAN:\n\n BUG: KASAN: double-free in dt_free_map+0x34/0xa4\n Free of addr c425a900 by task init/1\n kfree from dt_free_map+0x34/0xa4\n dt_free_map from dt_remember_or_free_map+0x184/0x198\n dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8\n pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0\n\nInitialize all dev_name fields to NULL before duplicating the device\nname, making the full-map cleanup safe after a partial failure."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local device driver probe/binding (really_probe -\u003e pinctrl_bind_pins -\u003e devm_pinctrl_get -\u003e create_pinctrl -\u003e pinctrl_dt_to_map -\u003e dt_remember_or_free_map); no network, Bluetooth, or remote protocol handler is on this path.\nAC:L - Once a pinctrl-consuming imx/sunxi device probes or re-probes, an attacker can reliably force kstrdup_const() to fail with sustained memory pressure; the partial-init error path then deterministically calls dt_free_map() on all entries, as confirmed by failslab/KASAN reproduction.\nPR:L - A local unprivileged account suffices to exhaust kernel memory during probe or deferred-probe retry; no CAP_SYS_ADMIN, module load, or DT overlay is strictly required beyond having affected OF hardware that binds pinctrl at boot or on automatic reprobe.\nUI:N - Exploitation executes autonomously during kernel driver initialization when allocation fails; no victim mount, file open, or other interactive action is needed.\nS:U - Double-free and heap corruption remain within kernel slab memory in the same security authority; this is a standard local kernel compromise path without VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - kfree_const() on uninitialized kmalloc map[i].dev_name values causes invalid or duplicate frees; KASAN reports double-free, and corrupted freelist/overlapping slab objects can be groomed into arbitrary kernel memory disclosure.\nI:H - Double-free and invalid kfree corrupt the SLUB freelist; attacker-controlled heap grooming can yield overlapping allocations and write primitives enabling control-flow hijack and arbitrary kernel code execution.\nA:H - KASAN-confirmed double-free in dt_free_map during device bind causes kernel oops/panic; even without full exploitation the invalid kmem_cache_free reliably crashes the system on affected embedded imx/sunxi platforms."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:38:21.855Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e3cfb22bad363bebcfd55d909e12d499cb8c5490"
},
{
"url": "https://git.kernel.org/stable/c/1586423da2739a80871ef6240016fcb9c7339bfb"
},
{
"url": "https://git.kernel.org/stable/c/dec5f0a8080502908dec5e35597c7ae07d533a3b"
},
{
"url": "https://git.kernel.org/stable/c/929f6396baade89999ec8a1281232c101cbc727d"
},
{
"url": "https://git.kernel.org/stable/c/321fe3584a8298386938130d138191aa35040b75"
},
{
"url": "https://git.kernel.org/stable/c/ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8"
},
{
"url": "https://git.kernel.org/stable/c/9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d"
},
{
"url": "https://git.kernel.org/stable/c/015b5bcbcb622b32317642be91a7f79aa5413649"
}
],
"title": "pinctrl: devicetree: don\u0027t free uninitialized dev_name on error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74519",
"datePublished": "2026-08-15T12:27:38.101Z",
"dateReserved": "2026-08-15T05:44:03.910Z",
"dateUpdated": "2026-10-16T19:05:52.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52912 (GCVE-0-2026-52912)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-10-19 19:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_queue: hold bridge skb->dev while queued
br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge
master before queueing bridge LOCAL_IN packets. NFQUEUE only holds
references on state.in/out and bridge physdevs, so a queued bridge
packet can retain a freed bridge master in skb->dev until reinjection.
When the verdict is reinjected later, br_netif_receive_skb() re-enters
the receive path with skb->dev still pointing at the freed bridge master,
triggering a use-after-free.
Store skb->dev in the queue entry, hold a reference on it for the queue
lifetime, and use the saved device when dropping queued packets during
NETDEV_DOWN handling.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ac28634456867b23b95faccba7997a62ec430603 Version: ac28634456867b23b95faccba7997a62ec430603 Version: ac28634456867b23b95faccba7997a62ec430603 Version: ac28634456867b23b95faccba7997a62ec430603 Version: ac28634456867b23b95faccba7997a62ec430603 Version: ac28634456867b23b95faccba7997a62ec430603 Version: ac28634456867b23b95faccba7997a62ec430603 Version: ac28634456867b23b95faccba7997a62ec430603 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:21:46.948Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52912",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:22:30.377062Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:36:59.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_queue.h",
"net/netfilter/nf_queue.c",
"net/netfilter/nfnetlink_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "950d809f154dca04e5fbe5d3c8b9c5e44769cd57",
"status": "affected",
"version": "ac28634456867b23b95faccba7997a62ec430603",
"versionType": "git"
},
{
"lessThan": "a698ac8ab2561cf575d2d9f34095032651dd952e",
"status": "affected",
"version": "ac28634456867b23b95faccba7997a62ec430603",
"versionType": "git"
},
{
"lessThan": "19924bdd8a45ebc72a7b84c57fd63057d1dc75ac",
"status": "affected",
"version": "ac28634456867b23b95faccba7997a62ec430603",
"versionType": "git"
},
{
"lessThan": "1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be",
"status": "affected",
"version": "ac28634456867b23b95faccba7997a62ec430603",
"versionType": "git"
},
{
"lessThan": "3823c27099cfe2482299065814adbaa771be9644",
"status": "affected",
"version": "ac28634456867b23b95faccba7997a62ec430603",
"versionType": "git"
},
{
"lessThan": "15d464265120ab9818bd673af301deee09bedab2",
"status": "affected",
"version": "ac28634456867b23b95faccba7997a62ec430603",
"versionType": "git"
},
{
"lessThan": "3fb0f5c0f64162a8c3f25616a4f1e340b921737f",
"status": "affected",
"version": "ac28634456867b23b95faccba7997a62ec430603",
"versionType": "git"
},
{
"lessThan": "e196115ec330a18de415bdb9f5071aa9f08e53ce",
"status": "affected",
"version": "ac28634456867b23b95faccba7997a62ec430603",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_queue.h",
"net/netfilter/nf_queue.c",
"net/netfilter/nfnetlink_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: hold bridge skb-\u003edev while queued\n\nbr_pass_frame_up() rewrites skb-\u003edev from the ingress port to the bridge\nmaster before queueing bridge LOCAL_IN packets. NFQUEUE only holds\nreferences on state.in/out and bridge physdevs, so a queued bridge\npacket can retain a freed bridge master in skb-\u003edev until reinjection.\n\nWhen the verdict is reinjected later, br_netif_receive_skb() re-enters\nthe receive path with skb-\u003edev still pointing at the freed bridge master,\ntriggering a use-after-free.\n\nStore skb-\u003edev in the queue entry, hold a reference on it for the queue\nlifetime, and use the saved device when dropping queued packets during\nNETDEV_DOWN handling."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local control of netfilter/NFQUEUE, bridge device lifecycle, and verdict reinjection through netlink/rtnetlink paths. Remote packets alone cannot force the needed bridge teardown and userspace verdict sequence.\nAC:L - A local attacker can deterministically create a namespace, bridge/veth setup, NFQUEUE rule, queued packet, bridge teardown, and reinjection. There is no race dependent on conditions outside attacker control.\nPR:L - The setup requires CAP_NET_ADMIN, but netfilter and bridge configuration are reachable with CAP_NET_ADMIN inside a user-created network namespace on systems allowing unprivileged user namespaces. This is Low, not High.\nUI:N - No victim action is required once the local attacker runs the exploit sequence. The attacker controls packet injection, queueing, device teardown, and verdict delivery.\nS:U - The impact is kernel memory corruption within the same host security authority. This is a standard local kernel privilege escalation/DoS scenario, not a VM or hardware boundary escape.\nC:H - The bug is a use-after-free of the bridge master net_device retained in skb-\u003edev across NFQUEUE. Kernel UAFs can be leveraged for kernel memory disclosure, so confidentiality impact is High.\nI:H - The stale net_device pointer is dereferenced after free in the receive path and can plausibly be combined with heap reclaim/spraying for memory corruption or control-flow impact. As a kernel UAF, integrity impact is High.\nA:H - At minimum, reinjection can dereference freed net_device memory in netif_receive_skb and crash/oops the kernel. Repeated local triggering makes availability impact High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:35.846Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/950d809f154dca04e5fbe5d3c8b9c5e44769cd57"
},
{
"url": "https://git.kernel.org/stable/c/a698ac8ab2561cf575d2d9f34095032651dd952e"
},
{
"url": "https://git.kernel.org/stable/c/19924bdd8a45ebc72a7b84c57fd63057d1dc75ac"
},
{
"url": "https://git.kernel.org/stable/c/1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be"
},
{
"url": "https://git.kernel.org/stable/c/3823c27099cfe2482299065814adbaa771be9644"
},
{
"url": "https://git.kernel.org/stable/c/15d464265120ab9818bd673af301deee09bedab2"
},
{
"url": "https://git.kernel.org/stable/c/3fb0f5c0f64162a8c3f25616a4f1e340b921737f"
},
{
"url": "https://git.kernel.org/stable/c/e196115ec330a18de415bdb9f5071aa9f08e53ce"
}
],
"title": "netfilter: nf_queue: hold bridge skb-\u003edev while queued",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52912",
"datePublished": "2026-06-24T07:14:10.583Z",
"dateReserved": "2026-06-09T07:44:35.366Z",
"dateUpdated": "2026-10-19T19:36:59.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63827 (GCVE-0-2026-63827)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-08-17 04:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix use-after-free in rawdata dedup loop
aa_replace_profiles() walks ns->rawdata_list to dedup the incoming
policy blob against entries already attached to existing profiles.
Per the kernel-doc on struct aa_loaddata, list membership does not
hold a reference: profiles hold pcount, and when the last pcount
drops, do_ploaddata_rmfs() is queued on a workqueue that takes
ns->lock and removes the entry. Between dropping the last pcount
and the workqueue running, an entry remains on the list with
pcount == 0.
aa_get_profile_loaddata() is an unconditional kref_get() on
pcount, so when the dedup loop hits such an entry, refcount
hardening reports
refcount_t: addition on 0; use-after-free.
inside aa_replace_profiles(), and the poisoned counter then
trips "saturated" and "underflow" warnings on the subsequent
uses of the same loaddata.
Before commit a0b7091c4de4 ("apparmor: fix race on rawdata
dereference") the dedup path used a get_unless_zero-style helper
on a single counter, so the existing "if (tmp)" guard was
meaningful. The split-refcount refactor introduced
aa_get_profile_loaddata(), which has plain kref_get() semantics,
and the guard quietly became a no-op.
Introduce aa_get_profile_loaddata_not0(), matching the existing
_not0 convention used by aa_get_profile_not0(), and use it for
the rawdata_list dedup lookup so dying entries are skipped.
Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu
24.04 + stress-ng 0.17.06:
stress-ng --apparmor 1 --klog-check --timeout 60s
Without this patch the three refcount_t warnings fire within a
few seconds. With it the same 60 s run is clean. Coverage is a
smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN
and CONFIG_PROVE_LOCKING would be welcome from anyone with the
cycles.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3b8e77c7abab40e6de9ad9de730d77984a498840 Version: d9d8560b9b7932f8cffc4c068c14289220900f79 Version: 6b6ba87579c7e7c669e0bec91823e7fb693bc5df Version: 6ef1f2926c41ab96952d9696d55a052f1b3a9418 Version: f9761add6d100962a23996cb68f3d6abdd4d1815 Version: af782cc8871e3683ddd5a3cd2f7df526599863a9 Version: a0b7091c4de45a7325c8780e6934a894f92ac86b Version: a0b7091c4de45a7325c8780e6934a894f92ac86b Version: 763e838adc3c7ec5a7df2990ce84cad951e42721 Version: 5.10.253 ≤ Version: 5.15.203 ≤ Version: 6.1.169 ≤ Version: 6.6.130 ≤ Version: 6.12.77 ≤ Version: 6.18.18 ≤ Version: 6.19.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/apparmor/include/policy_unpack.h",
"security/apparmor/policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "643221da57dbb1a8fd800610331cf1ec27969f71",
"status": "affected",
"version": "3b8e77c7abab40e6de9ad9de730d77984a498840",
"versionType": "git"
},
{
"lessThan": "b17f0c59cc1525765625cf07d0391b7f9c1ed7e5",
"status": "affected",
"version": "d9d8560b9b7932f8cffc4c068c14289220900f79",
"versionType": "git"
},
{
"lessThan": "a7a2890028f16e5b0af0bb005d80fcb32559cca3",
"status": "affected",
"version": "6b6ba87579c7e7c669e0bec91823e7fb693bc5df",
"versionType": "git"
},
{
"lessThan": "15fd83a1e42ede15070968806bb6c8b1a5170688",
"status": "affected",
"version": "6ef1f2926c41ab96952d9696d55a052f1b3a9418",
"versionType": "git"
},
{
"lessThan": "ce261a20b41db522e320a41bbf1292bf85af66df",
"status": "affected",
"version": "f9761add6d100962a23996cb68f3d6abdd4d1815",
"versionType": "git"
},
{
"lessThan": "c3ca2631073b2cef06824fd2bfc452ff7a1023de",
"status": "affected",
"version": "af782cc8871e3683ddd5a3cd2f7df526599863a9",
"versionType": "git"
},
{
"lessThan": "5e34fa9f6f7cd688ae153fff13139a5cf2d42339",
"status": "affected",
"version": "a0b7091c4de45a7325c8780e6934a894f92ac86b",
"versionType": "git"
},
{
"lessThan": "6f060496d03e4dc560a40f73770bd08335cb7a27",
"status": "affected",
"version": "a0b7091c4de45a7325c8780e6934a894f92ac86b",
"versionType": "git"
},
{
"status": "affected",
"version": "763e838adc3c7ec5a7df2990ce84cad951e42721",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThan": "6.1.177",
"status": "affected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThan": "6.6.144",
"status": "affected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThan": "6.12.95",
"status": "affected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThan": "6.18.38",
"status": "affected",
"version": "6.18.18",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/apparmor/include/policy_unpack.h",
"security/apparmor/policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.203",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "6.1.169",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.6.130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.12.77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "6.18.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix use-after-free in rawdata dedup loop\n\naa_replace_profiles() walks ns-\u003erawdata_list to dedup the incoming\npolicy blob against entries already attached to existing profiles.\nPer the kernel-doc on struct aa_loaddata, list membership does not\nhold a reference: profiles hold pcount, and when the last pcount\ndrops, do_ploaddata_rmfs() is queued on a workqueue that takes\nns-\u003elock and removes the entry. Between dropping the last pcount\nand the workqueue running, an entry remains on the list with\npcount == 0.\n\naa_get_profile_loaddata() is an unconditional kref_get() on\npcount, so when the dedup loop hits such an entry, refcount\nhardening reports\n\n refcount_t: addition on 0; use-after-free.\n\ninside aa_replace_profiles(), and the poisoned counter then\ntrips \"saturated\" and \"underflow\" warnings on the subsequent\nuses of the same loaddata.\n\nBefore commit a0b7091c4de4 (\"apparmor: fix race on rawdata\ndereference\") the dedup path used a get_unless_zero-style helper\non a single counter, so the existing \"if (tmp)\" guard was\nmeaningful. The split-refcount refactor introduced\naa_get_profile_loaddata(), which has plain kref_get() semantics,\nand the guard quietly became a no-op.\n\nIntroduce aa_get_profile_loaddata_not0(), matching the existing\n_not0 convention used by aa_get_profile_not0(), and use it for\nthe rawdata_list dedup lookup so dying entries are skipped.\n\nReproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu\n24.04 + stress-ng 0.17.06:\n\n stress-ng --apparmor 1 --klog-check --timeout 60s\n\nWithout this patch the three refcount_t warnings fire within a\nfew seconds. With it the same 60 s run is clean. Coverage is a\nsmoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN\nand CONFIG_PROVE_LOCKING would be welcome from anyone with the\ncycles."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local write() to AppArmor policy management interfaces (.load/.replace) under securityfs/apparmorfs, not through any network-facing protocol.\nAC:L - An attacker with policy-admin capability can reliably win the race by concurrently loading/replacing and removing profiles with identical rawdata blobs, as demonstrated by stress-ng reproducing refcount UAF warnings within seconds.\nPR:L - Triggering aa_replace_profiles() requires CAP_MAC_ADMIN plus policy-view rights; on typical AppArmor deployments (e.g. Ubuntu) namespace-root in an unprivileged user namespace can obtain CAP_MAC_ADMIN via unprivileged_userns_apparmor_policy without init-namespace root.\nUI:N - Exploitation is driven entirely by the attacker\u0027s own policy load/replace/remove operations and does not require any action from another user or administrator.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security boundary, not a cross-VM or cross-security-authority escape.\nC:H - The vulnerability is a use-after-free on aa_loaddata profile refcounts; refcount hardening reports \"addition on 0; use-after-free\" and poisons the counter, creating a path to arbitrary kernel memory disclosure.\nI:H - UAF and refcount saturation/underflow on aa_loaddata enable heap corruption primitives that can be leveraged for arbitrary kernel writes and local privilege escalation.\nA:H - The bug reliably triggers refcount_t UAF warnings and corrupts subsequent refcount operations on the same loaddata, causing kernel instability and potential crash/panic under concurrent policy management."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:35.761Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/643221da57dbb1a8fd800610331cf1ec27969f71"
},
{
"url": "https://git.kernel.org/stable/c/b17f0c59cc1525765625cf07d0391b7f9c1ed7e5"
},
{
"url": "https://git.kernel.org/stable/c/a7a2890028f16e5b0af0bb005d80fcb32559cca3"
},
{
"url": "https://git.kernel.org/stable/c/15fd83a1e42ede15070968806bb6c8b1a5170688"
},
{
"url": "https://git.kernel.org/stable/c/ce261a20b41db522e320a41bbf1292bf85af66df"
},
{
"url": "https://git.kernel.org/stable/c/c3ca2631073b2cef06824fd2bfc452ff7a1023de"
},
{
"url": "https://git.kernel.org/stable/c/5e34fa9f6f7cd688ae153fff13139a5cf2d42339"
},
{
"url": "https://git.kernel.org/stable/c/6f060496d03e4dc560a40f73770bd08335cb7a27"
}
],
"title": "apparmor: fix use-after-free in rawdata dedup loop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63827",
"datePublished": "2026-07-19T12:02:22.083Z",
"dateReserved": "2026-07-19T07:54:57.014Z",
"dateUpdated": "2026-08-17T04:51:35.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64115 (GCVE-0-2026-64115)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vsock/vmci: fix UAF when peer resets connection during handshake
vmci_transport_recv_connecting_server() returned err = 0 for a peer
RST in its default switch arm:
err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;
That made vmci_transport_recv_listen() skip vsock_remove_pending(),
leaving the pending socket on the listener's pending_links with
sk_state = TCP_CLOSE while destroy: still dropped the explicit
reference taken before schedule_delayed_work().
One second later vsock_pending_work() observed is_pending=true and
performed full cleanup: vsock_remove_pending() then the two trailing
sock_put(sk) calls -- the first reached refcount 0 and __sk_freed
the socket, and the second wrote into the freed object:
BUG: KASAN: slab-use-after-free in refcount_warn_saturate
Write of size 4 at addr ffff88800b1cac80 by task kworker
Workqueue: events vsock_pending_work
Treat peer RST like any other unexpected packet type (err = -EINVAL).
All destroy: arms now return err < 0, so vmci_transport_recv_listen()
removes pending from pending_links synchronously and
vsock_pending_work() takes the is_pending=false / !rejected branch,
dropping only its own work reference. This also closes the
multi-packet race Sashiko reported on v2: pending is removed from
the list before any subsequent packet can find it.
The pre-existing sk_acceptq_removed() gap on the err < 0 path of
vmci_transport_recv_listen() that Sashiko also noted is not
introduced or changed by this patch.
Tested on lts-6.12.79 with KASAN: 52/100 unpatched -> 0/100 patched.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64115",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:36:34.520586Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:12.821Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/vmci_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1e19f08552b90070ed18bafb1763c78297823af6",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "1dd531e28f61edd286edc486ab068f135b5ae1eb",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "ecda37f8faab3220da199335e42564cb7a9ad145",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "440447699c681e26ed58e9c309cad718270a18b4",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "9fe74e42914c851d68069713b7b917a9c33faf26",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "99e22ddf4edb63dc8382bc028af928056d3450cf",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/vmci_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: fix UAF when peer resets connection during handshake\n\nvmci_transport_recv_connecting_server() returned err = 0 for a peer\nRST in its default switch arm:\n\n\terr = pkt-\u003etype == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;\n\nThat made vmci_transport_recv_listen() skip vsock_remove_pending(),\nleaving the pending socket on the listener\u0027s pending_links with\nsk_state = TCP_CLOSE while destroy: still dropped the explicit\nreference taken before schedule_delayed_work().\n\nOne second later vsock_pending_work() observed is_pending=true and\nperformed full cleanup: vsock_remove_pending() then the two trailing\nsock_put(sk) calls -- the first reached refcount 0 and __sk_freed\nthe socket, and the second wrote into the freed object:\n\n BUG: KASAN: slab-use-after-free in refcount_warn_saturate\n Write of size 4 at addr ffff88800b1cac80 by task kworker\n Workqueue: events vsock_pending_work\n\nTreat peer RST like any other unexpected packet type (err = -EINVAL).\nAll destroy: arms now return err \u003c 0, so vmci_transport_recv_listen()\nremoves pending from pending_links synchronously and\nvsock_pending_work() takes the is_pending=false / !rejected branch,\ndropping only its own work reference. This also closes the\nmulti-packet race Sashiko reported on v2: pending is removed from\nthe list before any subsequent packet can find it.\n\nThe pre-existing sk_acceptq_removed() gap on the err \u003c 0 path of\nvmci_transport_recv_listen() that Sashiko also noted is not\nintroduced or changed by this patch.\n\nTested on lts-6.12.79 with KASAN: 52/100 unpatched -\u003e 0/100 patched."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local AF_VSOCK syscalls (connect/close) to drive VMCI control packets; per kernel CVSS guidance, vsock is scored Local even when the peer is a VM guest reaching a host listener.\nAC:L - The attacker controls both sides of the handshake race by initiating a connection and aborting it with RST during TCP_SYN_SENT; KASAN testing showed 52/100 repro without conditions outside attacker control.\nPR:L - Any unprivileged local user inside a VM (or on the same host) can open AF_VSOCK sockets and connect to a listening peer without CAP_NET_ADMIN or other elevated privileges.\nUI:N - Exploitation requires only a victim service with a bound/listening vsock socket, which is normal background operation; no interactive victim action is needed.\nS:C - In the most severe reasonable VMware deployment, an unprivileged guest VM triggers kernel memory corruption on the hypervisor host via VMCI vsock, crossing the guest-to-host virtualisation security boundary analogous to KVM/Xen VM escape.\nC:H - The bug is a slab use-after-free on struct sock; UAF on kernel heap objects enables arbitrary memory read primitives through controlled reuse of the freed socket structure.\nI:H - The UAF involves a write to a freed object\u0027s refcount field and corrupts kernel heap metadata, providing a foundation for arbitrary write and kernel code execution via heap grooming.\nA:H - The vulnerability reliably triggers kernel UAF detected by KASAN (refcount write to freed memory on a kworker), which causes kernel oops/panic and denial of host availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:24.360Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1e19f08552b90070ed18bafb1763c78297823af6"
},
{
"url": "https://git.kernel.org/stable/c/1dd531e28f61edd286edc486ab068f135b5ae1eb"
},
{
"url": "https://git.kernel.org/stable/c/ecda37f8faab3220da199335e42564cb7a9ad145"
},
{
"url": "https://git.kernel.org/stable/c/cc27e989a5dfdfcfc1cca7c3be27a0c7532b46cb"
},
{
"url": "https://git.kernel.org/stable/c/47e63077605c6c2aa45b3df9847a8cdc1f1f6ef9"
},
{
"url": "https://git.kernel.org/stable/c/440447699c681e26ed58e9c309cad718270a18b4"
},
{
"url": "https://git.kernel.org/stable/c/9fe74e42914c851d68069713b7b917a9c33faf26"
},
{
"url": "https://git.kernel.org/stable/c/99e22ddf4edb63dc8382bc028af928056d3450cf"
}
],
"title": "vsock/vmci: fix UAF when peer resets connection during handshake",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64115",
"datePublished": "2026-07-19T15:40:15.513Z",
"dateReserved": "2026-07-19T07:54:57.035Z",
"dateUpdated": "2026-10-19T20:28:12.821Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53309 (GCVE-0-2026-53309)
Vulnerability from cvelistv5
Published
2026-06-26 19:41
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
The local-vs-remote region comparison loop uses '<=' instead of '<',
causing it to read one entry past the valid range of qr_regions. The
other loops in the same function correctly use '<'.
Fix the loop condition to use '<' for consistency and correctness.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ea2034416b54700e30371f2ad6517cbb94674083 Version: ea2034416b54700e30371f2ad6517cbb94674083 Version: ea2034416b54700e30371f2ad6517cbb94674083 Version: ea2034416b54700e30371f2ad6517cbb94674083 Version: ea2034416b54700e30371f2ad6517cbb94674083 Version: ea2034416b54700e30371f2ad6517cbb94674083 Version: ea2034416b54700e30371f2ad6517cbb94674083 Version: ea2034416b54700e30371f2ad6517cbb94674083 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/dlm/dlmdomain.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "760ab35040aca8399021fdb9ff1db1089feb7194",
"status": "affected",
"version": "ea2034416b54700e30371f2ad6517cbb94674083",
"versionType": "git"
},
{
"lessThan": "c60a2710b73838d250cda57344c049b89abc5d52",
"status": "affected",
"version": "ea2034416b54700e30371f2ad6517cbb94674083",
"versionType": "git"
},
{
"lessThan": "2a0673836f019e7c032acbf48d022d5ccf02a845",
"status": "affected",
"version": "ea2034416b54700e30371f2ad6517cbb94674083",
"versionType": "git"
},
{
"lessThan": "819d8ebad3200a53de99bd7e297bc428e41ced54",
"status": "affected",
"version": "ea2034416b54700e30371f2ad6517cbb94674083",
"versionType": "git"
},
{
"lessThan": "d5403ae28085761d58b555645bc7d5feadb10073",
"status": "affected",
"version": "ea2034416b54700e30371f2ad6517cbb94674083",
"versionType": "git"
},
{
"lessThan": "1fb7f356547d9688822315cd2b205ff0bd5429b4",
"status": "affected",
"version": "ea2034416b54700e30371f2ad6517cbb94674083",
"versionType": "git"
},
{
"lessThan": "426cd8eedac89b86148d4478990eeef16e8a2520",
"status": "affected",
"version": "ea2034416b54700e30371f2ad6517cbb94674083",
"versionType": "git"
},
{
"lessThan": "01b61e8dda9b0fdb0d4cda43de25f4e390554d7b",
"status": "affected",
"version": "ea2034416b54700e30371f2ad6517cbb94674083",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/dlm/dlmdomain.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison\n\nThe local-vs-remote region comparison loop uses \u0027\u003c=\u0027 instead of \u0027\u003c\u0027,\ncausing it to read one entry past the valid range of qr_regions. The\nother loops in the same function correctly use \u0027\u003c\u0027.\n\nFix the loop condition to use \u0027\u003c\u0027 for consistency and correctness."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - DLM_QUERY_REGION is received and dispatched by the ocfs2 o2net TCP cluster transport, so the vulnerable comparison is reached through network messages from a peer node.\nAC:L - A peer that can reach the OCFS2 cluster transport can deterministically drive the join sequence and send a crafted region list; the off-by-one comparison is not a race and needs no unusual timing.\nPR:N - The receive path does not require credentials or a local account on the target; it relies on cluster node/IP/heartbeat state rather than authenticated target privileges.\nUI:N - Once the OCFS2/DLM cluster service is running, exploitation is driven entirely by network protocol messages and requires no victim user action.\nS:U - The vulnerable component and resulting kernel/cluster filesystem effects remain within the same kernel and OCFS2 cluster security authority.\nC:H - The bug is an out-of-bounds read of a region-sized entry beyond the valid qr_regions range, driven by attacker-supplied network state; under the required kernel scoring guidance, non-trivial out-of-bounds reads are treated as high confidentiality impact.\nI:H - The off-by-one can let a joining node pass heartbeat-region validation with an inconsistent region set, undermining DLM cluster membership safety and enabling severe shared-filesystem integrity corruption in a plausible OCFS2 deployment.\nA:H - Accepting inconsistent heartbeat regions can lead to cluster miscoordination, fencing, hangs, or filesystem disruption, and the malformed query can be sent without user interaction once the join path is reachable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:59.157Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/760ab35040aca8399021fdb9ff1db1089feb7194"
},
{
"url": "https://git.kernel.org/stable/c/c60a2710b73838d250cda57344c049b89abc5d52"
},
{
"url": "https://git.kernel.org/stable/c/2a0673836f019e7c032acbf48d022d5ccf02a845"
},
{
"url": "https://git.kernel.org/stable/c/819d8ebad3200a53de99bd7e297bc428e41ced54"
},
{
"url": "https://git.kernel.org/stable/c/d5403ae28085761d58b555645bc7d5feadb10073"
},
{
"url": "https://git.kernel.org/stable/c/1fb7f356547d9688822315cd2b205ff0bd5429b4"
},
{
"url": "https://git.kernel.org/stable/c/426cd8eedac89b86148d4478990eeef16e8a2520"
},
{
"url": "https://git.kernel.org/stable/c/01b61e8dda9b0fdb0d4cda43de25f4e390554d7b"
}
],
"title": "ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53309",
"datePublished": "2026-06-26T19:41:03.505Z",
"dateReserved": "2026-06-09T07:44:35.397Z",
"dateUpdated": "2026-08-05T12:34:59.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52910 (GCVE-0-2026-52910)
Vulnerability from cvelistv5
Published
2026-06-19 14:43
Modified
2026-10-19 19:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Free reuseport cBPF prog after RCU grace period.
Eulgyu Kim reported the splat below with a repro. [0]
The repro sets up a UDP reuseport group with a cBPF prog and
replaces it with a new one while another thread is sending
a UDP packet to the group.
The reuseport prog is freed by sk_reuseport_prog_free().
bpf_prog_put() is called for "e"BPF prog to destruct through
multiple stages while cBPF prog is freed immediately by
bpf_release_orig_filter() and bpf_prog_free().
If a reuseport prog is detached from the setsockopt() path
(reuseport_attach_prog() or reuseport_detach_prog()),
sk_reuseport_prog_free() is called without waiting for RCU
readers to complete, resulting in various bugs.
Let's defer freeing the reuseport cBPF prog after one RCU
grace period.
Note "e"BPF prog is safe as is unless the fast path starts
to touch fields destroyed in bpf_prog_put_deferred() and
__bpf_prog_put_noref().
[0]:
BUG: KASAN: vmalloc-out-of-bounds in reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596
Read of size 4 at addr ffffc9000051e004 by task slowme/10208
CPU: 6 UID: 1000 PID: 10208 Comm: slowme Not tainted 7.0.0-geb7ac95ff75e #32 PREEMPT(full)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<IRQ>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596
udp4_lib_lookup2+0x3bc/0x950 net/ipv4/udp.c:495
__udp4_lib_lookup+0x768/0xe20 net/ipv4/udp.c:723
__udp4_lib_lookup_skb+0x297/0x390 net/ipv4/udp.c:752
__udp4_lib_rcv+0x1312/0x2620 net/ipv4/udp.c:2752
ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207
ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241
NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318
NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318
__netif_receive_skb_one_core net/core/dev.c:6181 [inline]
__netif_receive_skb net/core/dev.c:6294 [inline]
process_backlog+0xaa4/0x1960 net/core/dev.c:6645
__napi_poll+0xae/0x340 net/core/dev.c:7709
napi_poll net/core/dev.c:7772 [inline]
net_rx_action+0x5d7/0xf50 net/core/dev.c:7929
handle_softirqs+0x22b/0x870 kernel/softirq.c:622
do_softirq+0x76/0xd0 kernel/softirq.c:523
</IRQ>
<TASK>
__local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline]
__dev_queue_xmit+0x1dd7/0x3710 net/core/dev.c:4890
neigh_output include/net/neighbour.h:556 [inline]
ip_finish_output2+0xca9/0x1070 net/ipv4/ip_output.c:237
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip_output+0x29f/0x450 net/ipv4/ip_output.c:438
ip_send_skb+0x45/0xc0 net/ipv4/ip_output.c:1508
udp_send_skb+0xb04/0x1510 net/ipv4/udp.c:1195
udp_sendmsg+0x1a71/0x2350 net/ipv4/udp.c:1485
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x554/0x680 net/socket.c:2206
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2209
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x160/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x415a2d
Code: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6bc31e41e8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f6bc31e4cdc RCX: 0000000000415a2d
RDX: 0000000000000001 RSI: 00007f6bc31e421f RDI: 0000000000000003
RBP: 00007f6bc31e4240 R08: 00007f6bc31e4220 R09: 0000000000000010
R10: 0000000000000000 R11:
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Berkeley Packet Filter (BPF) reuseport mechanism. When a cBPF program is detached from a reuseport group, it is freed immediately without waiting for Read-Copy-Update (RCU) readers to complete. This can lead to a use-after-free condition, resulting in memory corruption (specifically, an out-of-bounds read) if another thread is simultaneously sending UDP packets to the reuseport group. This vulnerability can cause system instability and various other bugs."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-364",
"description": "Signal Handler Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T02:48:22.880Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52910"
},
{
"name": "RHBZ#2490779",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490779"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52910.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: bpf: Free reuseport cBPF prog after RCU grace period",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:21:45.245Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52910",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:22:27.764087Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:36:59.652Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "08264d5bba0bdd3a79bc2984fee09286aba0c4eb",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "fec41484e7c2aa7ded44c541bba98872be937754",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "c3e3fddda6b5d9ba505d218b4055e7d8a282ac57",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "f8b8f1d4bb76098e87b8269a0631019648330e6d",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "298db6167f81e9c470a57cf652e4e47757b4293e",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "87dfb977bdb6eaa47e9993a34e18f44970f88b1f",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "90e47dc5c572d1c73971ac51c7428803f42b78eb",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "18fc650ccd7fe3376eca89203668cfb8268f60df",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Free reuseport cBPF prog after RCU grace period.\n\nEulgyu Kim reported the splat below with a repro. [0]\n\nThe repro sets up a UDP reuseport group with a cBPF prog and\nreplaces it with a new one while another thread is sending\na UDP packet to the group.\n\nThe reuseport prog is freed by sk_reuseport_prog_free().\nbpf_prog_put() is called for \"e\"BPF prog to destruct through\nmultiple stages while cBPF prog is freed immediately by\nbpf_release_orig_filter() and bpf_prog_free().\n\nIf a reuseport prog is detached from the setsockopt() path\n(reuseport_attach_prog() or reuseport_detach_prog()),\nsk_reuseport_prog_free() is called without waiting for RCU\nreaders to complete, resulting in various bugs.\n\nLet\u0027s defer freeing the reuseport cBPF prog after one RCU\ngrace period.\n\nNote \"e\"BPF prog is safe as is unless the fast path starts\nto touch fields destroyed in bpf_prog_put_deferred() and\n__bpf_prog_put_noref().\n\n[0]:\nBUG: KASAN: vmalloc-out-of-bounds in reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596\nRead of size 4 at addr ffffc9000051e004 by task slowme/10208\nCPU: 6 UID: 1000 PID: 10208 Comm: slowme Not tainted 7.0.0-geb7ac95ff75e #32 PREEMPT(full)\nHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x240 mm/kasan/report.c:482\n kasan_report+0x118/0x150 mm/kasan/report.c:595\n reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596\n udp4_lib_lookup2+0x3bc/0x950 net/ipv4/udp.c:495\n __udp4_lib_lookup+0x768/0xe20 net/ipv4/udp.c:723\n __udp4_lib_lookup_skb+0x297/0x390 net/ipv4/udp.c:752\n __udp4_lib_rcv+0x1312/0x2620 net/ipv4/udp.c:2752\n ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207\n ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241\n NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318\n NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318\n __netif_receive_skb_one_core net/core/dev.c:6181 [inline]\n __netif_receive_skb net/core/dev.c:6294 [inline]\n process_backlog+0xaa4/0x1960 net/core/dev.c:6645\n __napi_poll+0xae/0x340 net/core/dev.c:7709\n napi_poll net/core/dev.c:7772 [inline]\n net_rx_action+0x5d7/0xf50 net/core/dev.c:7929\n handle_softirqs+0x22b/0x870 kernel/softirq.c:622\n do_softirq+0x76/0xd0 kernel/softirq.c:523\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450\n local_bh_enable include/linux/bottom_half.h:33 [inline]\n rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline]\n __dev_queue_xmit+0x1dd7/0x3710 net/core/dev.c:4890\n neigh_output include/net/neighbour.h:556 [inline]\n ip_finish_output2+0xca9/0x1070 net/ipv4/ip_output.c:237\n NF_HOOK_COND include/linux/netfilter.h:307 [inline]\n ip_output+0x29f/0x450 net/ipv4/ip_output.c:438\n ip_send_skb+0x45/0xc0 net/ipv4/ip_output.c:1508\n udp_send_skb+0xb04/0x1510 net/ipv4/udp.c:1195\n udp_sendmsg+0x1a71/0x2350 net/ipv4/udp.c:1485\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n __sys_sendto+0x554/0x680 net/socket.c:2206\n __do_sys_sendto net/socket.c:2213 [inline]\n __se_sys_sendto net/socket.c:2209 [inline]\n __x64_sys_sendto+0xde/0x100 net/socket.c:2209\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x160/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x415a2d\nCode: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f6bc31e41e8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007f6bc31e4cdc RCX: 0000000000415a2d\nRDX: 0000000000000001 RSI: 00007f6bc31e421f RDI: 0000000000000003\nRBP: 00007f6bc31e4240 R08: 00007f6bc31e4220 R09: 0000000000000010\nR10: 0000000000000000 R11: \n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable attach/detach operation is reached through local `setsockopt()` on an `SO_REUSEPORT` socket with `SO_ATTACH_REUSEPORT_CBPF` or `SO_DETACH_REUSEPORT_BPF`. Although packet receive executes the stale program, the attacker-controlled trigger for freeing/replacing it is a local socket API path.\nAC:L - The race is attacker-controlled: a local attacker can create the UDP reuseport group, replace/detach the cBPF program, and concurrently send packets to drive `reuseport_select_sock()`. No rare external condition is required.\nPR:L - A basic unprivileged local user can create UDP sockets on an unprivileged port, set `SO_REUSEPORT`, and attach a classic reuseport BPF filter; this path does not require `CAP_NET_ADMIN`. User namespaces are not needed to make the path reachable.\nUI:N - No victim user action is required once the attacker runs the local reproducer. The attacker controls the sockets, the filter replacement, and the packet generation.\nS:U - The bug is a kernel memory lifetime error used for local kernel compromise or crash within the same host security authority. It does not cross a VM, IOMMU, or similar security boundary.\nC:H - This is a use-after-free of a `bpf_prog` object that is dereferenced after reclamation while selecting a reuseport socket. Per kernel CVSS guidance, UAFs are treated as enabling high confidentiality impact through potential kernel memory disclosure.\nI:H - The stale freed `bpf_prog` can be reused while the receive path reads and runs through the program object, making control-flow or data corruption plausible. Per kernel CVSS guidance, UAF memory corruption warrants high integrity impact.\nA:H - The reported reproducer triggers a KASAN vmalloc out-of-bounds/use-after-free splat in the packet receive path. Such kernel memory corruption can reliably crash or destabilize the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:33.683Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/08264d5bba0bdd3a79bc2984fee09286aba0c4eb"
},
{
"url": "https://git.kernel.org/stable/c/fec41484e7c2aa7ded44c541bba98872be937754"
},
{
"url": "https://git.kernel.org/stable/c/c3e3fddda6b5d9ba505d218b4055e7d8a282ac57"
},
{
"url": "https://git.kernel.org/stable/c/f8b8f1d4bb76098e87b8269a0631019648330e6d"
},
{
"url": "https://git.kernel.org/stable/c/298db6167f81e9c470a57cf652e4e47757b4293e"
},
{
"url": "https://git.kernel.org/stable/c/87dfb977bdb6eaa47e9993a34e18f44970f88b1f"
},
{
"url": "https://git.kernel.org/stable/c/90e47dc5c572d1c73971ac51c7428803f42b78eb"
},
{
"url": "https://git.kernel.org/stable/c/18fc650ccd7fe3376eca89203668cfb8268f60df"
}
],
"title": "bpf: Free reuseport cBPF prog after RCU grace period.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52910",
"datePublished": "2026-06-19T14:43:33.952Z",
"dateReserved": "2026-06-09T07:44:35.366Z",
"dateUpdated": "2026-10-19T19:36:59.652Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80819 (GCVE-0-2026-80819)
Vulnerability from cvelistv5
Published
2026-09-04 15:13
Modified
2026-10-19 08:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept
rfcomm_sock_recvmsg() completes a deferred setup by calling
rfcomm_dlc_accept() without holding any RFCOMM lock:
if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
rfcomm_dlc_accept(d);
return 0;
}
and rfcomm_dlc_accept() dereferences the session on its first line:
struct sock *sk = d->session->sock->sk;
Every other path that touches d->session runs under rfcomm_mutex:
rfcomm_dlc_open(), rfcomm_dlc_close(), rfcomm_dlc_exists(),
rfcomm_dlc_send_rpn(), and the RFCOMM thread through
rfcomm_process_sessions(). rfcomm_connect_ind() is even documented as
"called under rfcomm_lock()". This call site is the only one that skips
it.
The RFCOMM_DEFER_SETUP bit looks like it serialises the accept against
teardown, since __rfcomm_dlc_close() returns early when it wins the
test_and_clear. But rfcomm_recv_disc() forces the state first:
d->state = BT_CLOSED;
__rfcomm_dlc_close(d, err);
and the early return only covers BT_CONNECT, BT_CONFIG, BT_OPEN and
BT_CONNECT2. With the state already BT_CLOSED that switch does not
match, the bit is never consulted, and __rfcomm_dlc_close() falls
through to rfcomm_dlc_unlink(), which sets d->session = NULL.
So a remote DISC on a deferred dlc clears the session while leaving
RFCOMM_DEFER_SETUP set. The next recvmsg() then passes the
test_and_clear and dereferences a NULL session. No timing window is
needed: once the DISC has been processed, the dereference is
unconditional.
Give rfcomm_dlc_accept() the same shape as rfcomm_dlc_open() and
rfcomm_dlc_close(): an exported wrapper that takes rfcomm_mutex and
re-checks the session, around a __rfcomm_dlc_accept() that the two
in-core callers, which already hold the mutex, keep using.
Reproduced on a KASAN + PROVE_LOCKING kernel with a BR/EDR peer emulated
over /dev/vhci: the peer brings up an ACL link, opens L2CAP on the
RFCOMM PSM, starts a session, opens a dlc on a channel bound with
BT_DEFER_SETUP, and sends DISC after the socket is accepted. recv() on
the accepted socket then hits:
Oops: general protection fault
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:rfcomm_dlc_accept+0x54/0x350
Call Trace:
rfcomm_sock_recvmsg+0x1cd/0x230
sock_recvmsg+0x166/0x1c0
__sys_recvfrom+0x20d/0x300
0x10 is the offset of sock in struct rfcomm_session. With this patch the
same run completes with recv() returning 0 and no report, and lockdep
stays quiet, confirming rfcomm_mutex is still taken before lock_sock on
this path as it is on the thread side.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bb23c0ab824653be4aa7dfca15b07b3059717004 Version: bb23c0ab824653be4aa7dfca15b07b3059717004 Version: bb23c0ab824653be4aa7dfca15b07b3059717004 Version: bb23c0ab824653be4aa7dfca15b07b3059717004 Version: bb23c0ab824653be4aa7dfca15b07b3059717004 Version: bb23c0ab824653be4aa7dfca15b07b3059717004 Version: bb23c0ab824653be4aa7dfca15b07b3059717004 Version: bb23c0ab824653be4aa7dfca15b07b3059717004 Version: bb23c0ab824653be4aa7dfca15b07b3059717004 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/rfcomm/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d8d686dd5662a7c4745e4515f1237a9f3b7df181",
"status": "affected",
"version": "bb23c0ab824653be4aa7dfca15b07b3059717004",
"versionType": "git"
},
{
"lessThan": "eb71d5a1ea8ff2683e394b48ae3cd676037ab4c2",
"status": "affected",
"version": "bb23c0ab824653be4aa7dfca15b07b3059717004",
"versionType": "git"
},
{
"lessThan": "56f0aa75c7640e46397ef73bea251fcbef9150c0",
"status": "affected",
"version": "bb23c0ab824653be4aa7dfca15b07b3059717004",
"versionType": "git"
},
{
"lessThan": "362726c9c6e56eea4262109183e49868c39ccd3a",
"status": "affected",
"version": "bb23c0ab824653be4aa7dfca15b07b3059717004",
"versionType": "git"
},
{
"lessThan": "825b95561d7b7c393df9e7bc295451aaeadc3d18",
"status": "affected",
"version": "bb23c0ab824653be4aa7dfca15b07b3059717004",
"versionType": "git"
},
{
"lessThan": "d4b1a13b1eff2e80925c7368ffdeaaa50cba93df",
"status": "affected",
"version": "bb23c0ab824653be4aa7dfca15b07b3059717004",
"versionType": "git"
},
{
"lessThan": "355bfd57ca4ca881c6eb03ca813b440a094b1f44",
"status": "affected",
"version": "bb23c0ab824653be4aa7dfca15b07b3059717004",
"versionType": "git"
},
{
"lessThan": "b405c2f96ae2e37375105881890f7738833b1d62",
"status": "affected",
"version": "bb23c0ab824653be4aa7dfca15b07b3059717004",
"versionType": "git"
},
{
"lessThan": "43a556b2fd43f2df6dded59c2e26560a27874c24",
"status": "affected",
"version": "bb23c0ab824653be4aa7dfca15b07b3059717004",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/rfcomm/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.11",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.1",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept\n\nrfcomm_sock_recvmsg() completes a deferred setup by calling\nrfcomm_dlc_accept() without holding any RFCOMM lock:\n\n\tif (test_and_clear_bit(RFCOMM_DEFER_SETUP, \u0026d-\u003eflags)) {\n\t\trfcomm_dlc_accept(d);\n\t\treturn 0;\n\t}\n\nand rfcomm_dlc_accept() dereferences the session on its first line:\n\n\tstruct sock *sk = d-\u003esession-\u003esock-\u003esk;\n\nEvery other path that touches d-\u003esession runs under rfcomm_mutex:\nrfcomm_dlc_open(), rfcomm_dlc_close(), rfcomm_dlc_exists(),\nrfcomm_dlc_send_rpn(), and the RFCOMM thread through\nrfcomm_process_sessions(). rfcomm_connect_ind() is even documented as\n\"called under rfcomm_lock()\". This call site is the only one that skips\nit.\n\nThe RFCOMM_DEFER_SETUP bit looks like it serialises the accept against\nteardown, since __rfcomm_dlc_close() returns early when it wins the\ntest_and_clear. But rfcomm_recv_disc() forces the state first:\n\n\td-\u003estate = BT_CLOSED;\n\t__rfcomm_dlc_close(d, err);\n\nand the early return only covers BT_CONNECT, BT_CONFIG, BT_OPEN and\nBT_CONNECT2. With the state already BT_CLOSED that switch does not\nmatch, the bit is never consulted, and __rfcomm_dlc_close() falls\nthrough to rfcomm_dlc_unlink(), which sets d-\u003esession = NULL.\n\nSo a remote DISC on a deferred dlc clears the session while leaving\nRFCOMM_DEFER_SETUP set. The next recvmsg() then passes the\ntest_and_clear and dereferences a NULL session. No timing window is\nneeded: once the DISC has been processed, the dereference is\nunconditional.\n\nGive rfcomm_dlc_accept() the same shape as rfcomm_dlc_open() and\nrfcomm_dlc_close(): an exported wrapper that takes rfcomm_mutex and\nre-checks the session, around a __rfcomm_dlc_accept() that the two\nin-core callers, which already hold the mutex, keep using.\n\nReproduced on a KASAN + PROVE_LOCKING kernel with a BR/EDR peer emulated\nover /dev/vhci: the peer brings up an ACL link, opens L2CAP on the\nRFCOMM PSM, starts a session, opens a dlc on a channel bound with\nBT_DEFER_SETUP, and sends DISC after the socket is accepted. recv() on\nthe accepted socket then hits:\n\n Oops: general protection fault\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n RIP: 0010:rfcomm_dlc_accept+0x54/0x350\n Call Trace:\n rfcomm_sock_recvmsg+0x1cd/0x230\n sock_recvmsg+0x166/0x1c0\n __sys_recvfrom+0x20d/0x300\n\n0x10 is the offset of sock in struct rfcomm_session. With this patch the\nsame run completes with recv() returning 0 and no report, and lockdep\nstays quiet, confirming rfcomm_mutex is still taken before lock_sock on\nthis path as it is on the thread side."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:44:12.945Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d8d686dd5662a7c4745e4515f1237a9f3b7df181"
},
{
"url": "https://git.kernel.org/stable/c/eb71d5a1ea8ff2683e394b48ae3cd676037ab4c2"
},
{
"url": "https://git.kernel.org/stable/c/56f0aa75c7640e46397ef73bea251fcbef9150c0"
},
{
"url": "https://git.kernel.org/stable/c/362726c9c6e56eea4262109183e49868c39ccd3a"
},
{
"url": "https://git.kernel.org/stable/c/825b95561d7b7c393df9e7bc295451aaeadc3d18"
},
{
"url": "https://git.kernel.org/stable/c/d4b1a13b1eff2e80925c7368ffdeaaa50cba93df"
},
{
"url": "https://git.kernel.org/stable/c/355bfd57ca4ca881c6eb03ca813b440a094b1f44"
},
{
"url": "https://git.kernel.org/stable/c/b405c2f96ae2e37375105881890f7738833b1d62"
},
{
"url": "https://git.kernel.org/stable/c/43a556b2fd43f2df6dded59c2e26560a27874c24"
}
],
"title": "Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80819",
"datePublished": "2026-09-04T15:13:40.309Z",
"dateReserved": "2026-08-26T14:34:25.795Z",
"dateUpdated": "2026-10-19T08:44:12.945Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68357 (GCVE-0-2026-68357)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-08-19 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
When a watchdog governor is unregistered, it updates existing watchdog
devices that were using this governor by falling back to `default_gov`.
If the governor being unregistered is currently set as `default_gov`,
the `default_gov` is never cleared. This leads to 2 use-after-free
issues:
1. New watchdog devices registered after this point will inherit the
dangling `default_gov`.
2. Existing watchdog devices using the unregistered governor will have
their `wdd->gov` reassigned to the dangling `default_gov`.
Fix the UAF by clearing `default_gov` if it matches the governor being
unregistered.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: da0d12ff2b829a35e9921918e925d79497b82bef Version: da0d12ff2b829a35e9921918e925d79497b82bef Version: da0d12ff2b829a35e9921918e925d79497b82bef Version: da0d12ff2b829a35e9921918e925d79497b82bef Version: da0d12ff2b829a35e9921918e925d79497b82bef Version: da0d12ff2b829a35e9921918e925d79497b82bef Version: da0d12ff2b829a35e9921918e925d79497b82bef Version: da0d12ff2b829a35e9921918e925d79497b82bef |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/watchdog/watchdog_pretimeout.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b9ae33faa96bdec6bc60e4c5f8f53786182e4207",
"status": "affected",
"version": "da0d12ff2b829a35e9921918e925d79497b82bef",
"versionType": "git"
},
{
"lessThan": "472ec1e34ff0bb26379805cae808f658cce58c35",
"status": "affected",
"version": "da0d12ff2b829a35e9921918e925d79497b82bef",
"versionType": "git"
},
{
"lessThan": "7a2ee3ec6f208307eca1119a343c7b5d39c03708",
"status": "affected",
"version": "da0d12ff2b829a35e9921918e925d79497b82bef",
"versionType": "git"
},
{
"lessThan": "2e47b91b9b4020fcc01def14d6b6556d66074cf4",
"status": "affected",
"version": "da0d12ff2b829a35e9921918e925d79497b82bef",
"versionType": "git"
},
{
"lessThan": "0ca252720f0e38411cfec3431db9bb1aed0a412c",
"status": "affected",
"version": "da0d12ff2b829a35e9921918e925d79497b82bef",
"versionType": "git"
},
{
"lessThan": "7d1658b066de30f4b23afc14814d22416a971e6e",
"status": "affected",
"version": "da0d12ff2b829a35e9921918e925d79497b82bef",
"versionType": "git"
},
{
"lessThan": "7993d626983cc58fbde9607333cfd2d57725c197",
"status": "affected",
"version": "da0d12ff2b829a35e9921918e925d79497b82bef",
"versionType": "git"
},
{
"lessThan": "7362ba0f9c96ac3ad6a2ca3995bd9fc9a28a8661",
"status": "affected",
"version": "da0d12ff2b829a35e9921918e925d79497b82bef",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/watchdog/watchdog_pretimeout.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: pretimeout: Fix UAF in watchdog_unregister_governor()\n\nWhen a watchdog governor is unregistered, it updates existing watchdog\ndevices that were using this governor by falling back to `default_gov`.\n\nIf the governor being unregistered is currently set as `default_gov`,\nthe `default_gov` is never cleared. This leads to 2 use-after-free\nissues:\n1. New watchdog devices registered after this point will inherit the\n dangling `default_gov`.\n2. Existing watchdog devices using the unregistered governor will have\n their `wdd-\u003egov` reassigned to the dangling `default_gov`.\n\nFix the UAF by clearing `default_gov` if it matches the governor being\nunregistered."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:34:05.347Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b9ae33faa96bdec6bc60e4c5f8f53786182e4207"
},
{
"url": "https://git.kernel.org/stable/c/472ec1e34ff0bb26379805cae808f658cce58c35"
},
{
"url": "https://git.kernel.org/stable/c/7a2ee3ec6f208307eca1119a343c7b5d39c03708"
},
{
"url": "https://git.kernel.org/stable/c/2e47b91b9b4020fcc01def14d6b6556d66074cf4"
},
{
"url": "https://git.kernel.org/stable/c/0ca252720f0e38411cfec3431db9bb1aed0a412c"
},
{
"url": "https://git.kernel.org/stable/c/7d1658b066de30f4b23afc14814d22416a971e6e"
},
{
"url": "https://git.kernel.org/stable/c/7993d626983cc58fbde9607333cfd2d57725c197"
},
{
"url": "https://git.kernel.org/stable/c/7362ba0f9c96ac3ad6a2ca3995bd9fc9a28a8661"
}
],
"title": "watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68357",
"datePublished": "2026-08-10T12:03:34.241Z",
"dateReserved": "2026-07-30T09:28:09.385Z",
"dateUpdated": "2026-08-19T16:34:05.347Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68405 (GCVE-0-2026-68405)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-08-19 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
ieee80211_do_stop() removes AP_VLAN packets from the parent AP
ps->bc_buf while holding ps->bc_buf.lock with IRQs disabled. It then
calls ieee80211_free_txskb() before dropping the lock.
ieee80211_free_txskb() is not just a passive SKB release. For SKBs with
TX status state it can report a dropped frame through cfg80211/nl80211,
and that path can reach netlink tap transmit. This is the same reason
the pending queue cleanup in ieee80211_do_stop() already unlinks SKBs
under the queue lock and frees them after IRQ state is restored.
The buggy scenario involves two paths, with each column showing the
order within that path:
AP_VLAN management TX: AP_VLAN stop:
1. attach ACK-status state 1. clear the running state
2. queue a multicast SKB on 2. take ps->bc_buf.lock with IRQs
parent ps->bc_buf disabled
3. unlink the AP_VLAN SKB
4. call ieee80211_free_txskb()
Unlink matching AP_VLAN SKBs from ps->bc_buf under the existing lock,
but move them to a local free queue. Drop the lock and restore IRQ state
before calling ieee80211_free_txskb().
WARNING: kernel/softirq.c:430 at __local_bh_enable_ip
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 397a7a24ef8c2967a3e8090013f9c54714110c48 Version: 397a7a24ef8c2967a3e8090013f9c54714110c48 Version: 397a7a24ef8c2967a3e8090013f9c54714110c48 Version: 397a7a24ef8c2967a3e8090013f9c54714110c48 Version: 397a7a24ef8c2967a3e8090013f9c54714110c48 Version: 397a7a24ef8c2967a3e8090013f9c54714110c48 Version: 397a7a24ef8c2967a3e8090013f9c54714110c48 Version: 397a7a24ef8c2967a3e8090013f9c54714110c48 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/iface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0d2619e708e2ef02ba1c91642ea261d3f19d8f9a",
"status": "affected",
"version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
"versionType": "git"
},
{
"lessThan": "659a81b62a61440b85e02c09903be861ae7679e5",
"status": "affected",
"version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
"versionType": "git"
},
{
"lessThan": "aa01ef0ebbc3289154229ef58e65baf289eb9789",
"status": "affected",
"version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
"versionType": "git"
},
{
"lessThan": "be9dfcb0654c1f6c0fce7ba2a909683bb6f1e0ef",
"status": "affected",
"version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
"versionType": "git"
},
{
"lessThan": "962f755a47d7ec3bbf6c709697d7f4c5f798441d",
"status": "affected",
"version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
"versionType": "git"
},
{
"lessThan": "a424985c3ef2a87ce6057a853e18d0c441a86be8",
"status": "affected",
"version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
"versionType": "git"
},
{
"lessThan": "4b8abf43bf34791c99d99dc3be13f897adefc461",
"status": "affected",
"version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
"versionType": "git"
},
{
"lessThan": "f3858d5b1432098c1936e03d6e03dd0e33facf60",
"status": "affected",
"version": "397a7a24ef8c2967a3e8090013f9c54714110c48",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/iface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock\n\nieee80211_do_stop() removes AP_VLAN packets from the parent AP\nps-\u003ebc_buf while holding ps-\u003ebc_buf.lock with IRQs disabled. It then\ncalls ieee80211_free_txskb() before dropping the lock.\n\nieee80211_free_txskb() is not just a passive SKB release. For SKBs with\nTX status state it can report a dropped frame through cfg80211/nl80211,\nand that path can reach netlink tap transmit. This is the same reason\nthe pending queue cleanup in ieee80211_do_stop() already unlinks SKBs\nunder the queue lock and frees them after IRQ state is restored.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nAP_VLAN management TX: AP_VLAN stop:\n1. attach ACK-status state 1. clear the running state\n2. queue a multicast SKB on 2. take ps-\u003ebc_buf.lock with IRQs\n parent ps-\u003ebc_buf disabled\n 3. unlink the AP_VLAN SKB\n 4. call ieee80211_free_txskb()\n\nUnlink matching AP_VLAN SKBs from ps-\u003ebc_buf under the existing lock,\nbut move them to a local free queue. Drop the lock and restore IRQ state\nbefore calling ieee80211_free_txskb().\n\nWARNING: kernel/softirq.c:430 at __local_bh_enable_ip"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:34:57.265Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d2619e708e2ef02ba1c91642ea261d3f19d8f9a"
},
{
"url": "https://git.kernel.org/stable/c/659a81b62a61440b85e02c09903be861ae7679e5"
},
{
"url": "https://git.kernel.org/stable/c/aa01ef0ebbc3289154229ef58e65baf289eb9789"
},
{
"url": "https://git.kernel.org/stable/c/be9dfcb0654c1f6c0fce7ba2a909683bb6f1e0ef"
},
{
"url": "https://git.kernel.org/stable/c/962f755a47d7ec3bbf6c709697d7f4c5f798441d"
},
{
"url": "https://git.kernel.org/stable/c/a424985c3ef2a87ce6057a853e18d0c441a86be8"
},
{
"url": "https://git.kernel.org/stable/c/4b8abf43bf34791c99d99dc3be13f897adefc461"
},
{
"url": "https://git.kernel.org/stable/c/f3858d5b1432098c1936e03d6e03dd0e33facf60"
}
],
"title": "wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68405",
"datePublished": "2026-08-10T12:04:25.241Z",
"dateReserved": "2026-07-30T09:28:09.390Z",
"dateUpdated": "2026-08-19T16:34:57.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53219 (GCVE-0-2026-53219)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-15 01:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: x_tables: avoid leaking percpu counter pointers
The native and compat get-entries paths copy the fixed rule entry header
from the kernelized rule blob to userspace before overwriting the entry's
counter fields with a sanitized counter snapshot.
On SMP kernels, entry->counters.pcnt contains the percpu allocation
address used by x_tables rule counters. A caller can provide a userspace
buffer that faults during the initial fixed-header copy after pcnt has
been copied but before the later sanitized counter copy runs. The syscall
then returns -EFAULT while leaving the raw percpu pointer in userspace.
Copy only the fixed entry prefix before counters from the kernelized rule
blob, then copy the sanitized counter snapshot into the counter field.
Apply this ordering to the IPv4, IPv6, and ARP native and compat
get-entries implementations so a fault cannot expose the internal percpu
counter pointer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 71ae0dff02d756e4d2ca710b79f2ff5390029a5f Version: 71ae0dff02d756e4d2ca710b79f2ff5390029a5f Version: 71ae0dff02d756e4d2ca710b79f2ff5390029a5f Version: 71ae0dff02d756e4d2ca710b79f2ff5390029a5f Version: 71ae0dff02d756e4d2ca710b79f2ff5390029a5f Version: 71ae0dff02d756e4d2ca710b79f2ff5390029a5f Version: 71ae0dff02d756e4d2ca710b79f2ff5390029a5f Version: 71ae0dff02d756e4d2ca710b79f2ff5390029a5f |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:22:45.178Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/netfilter/arp_tables.c",
"net/ipv4/netfilter/ip_tables.c",
"net/ipv6/netfilter/ip6_tables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b74ba3343eb44b2cbf7e9665918c287df1d52ebb",
"status": "affected",
"version": "71ae0dff02d756e4d2ca710b79f2ff5390029a5f",
"versionType": "git"
},
{
"lessThan": "0b35dc8527ccc16b7dc34e8a3164313e68cd4e45",
"status": "affected",
"version": "71ae0dff02d756e4d2ca710b79f2ff5390029a5f",
"versionType": "git"
},
{
"lessThan": "b28e2fcad3db7e8687b15bc20bced26b5b7c920e",
"status": "affected",
"version": "71ae0dff02d756e4d2ca710b79f2ff5390029a5f",
"versionType": "git"
},
{
"lessThan": "a0d16941adf3a501956d74aefd8d6e217906e79c",
"status": "affected",
"version": "71ae0dff02d756e4d2ca710b79f2ff5390029a5f",
"versionType": "git"
},
{
"lessThan": "8d67e42ad3b1a95a152541015a07110e06992d6c",
"status": "affected",
"version": "71ae0dff02d756e4d2ca710b79f2ff5390029a5f",
"versionType": "git"
},
{
"lessThan": "08a3e218064db11f154ad9ad5541751ea7f34ebe",
"status": "affected",
"version": "71ae0dff02d756e4d2ca710b79f2ff5390029a5f",
"versionType": "git"
},
{
"lessThan": "fb0521aff1e10e300d89725cc439d3ea74c828c5",
"status": "affected",
"version": "71ae0dff02d756e4d2ca710b79f2ff5390029a5f",
"versionType": "git"
},
{
"lessThan": "f7f2fbb0e893a0238dc464f8d8c0f5609bec584f",
"status": "affected",
"version": "71ae0dff02d756e4d2ca710b79f2ff5390029a5f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/netfilter/arp_tables.c",
"net/ipv4/netfilter/ip_tables.c",
"net/ipv6/netfilter/ip6_tables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: avoid leaking percpu counter pointers\n\nThe native and compat get-entries paths copy the fixed rule entry header\nfrom the kernelized rule blob to userspace before overwriting the entry\u0027s\ncounter fields with a sanitized counter snapshot.\n\nOn SMP kernels, entry-\u003ecounters.pcnt contains the percpu allocation\naddress used by x_tables rule counters. A caller can provide a userspace\nbuffer that faults during the initial fixed-header copy after pcnt has\nbeen copied but before the later sanitized counter copy runs. The syscall\nthen returns -EFAULT while leaving the raw percpu pointer in userspace.\n\nCopy only the fixed entry prefix before counters from the kernelized rule\nblob, then copy the sanitized counter snapshot into the counter field.\nApply this ordering to the IPv4, IPv6, and ARP native and compat\nget-entries implementations so a fault cannot expose the internal percpu\ncounter pointer."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:21.730Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b74ba3343eb44b2cbf7e9665918c287df1d52ebb"
},
{
"url": "https://git.kernel.org/stable/c/0b35dc8527ccc16b7dc34e8a3164313e68cd4e45"
},
{
"url": "https://git.kernel.org/stable/c/b28e2fcad3db7e8687b15bc20bced26b5b7c920e"
},
{
"url": "https://git.kernel.org/stable/c/a0d16941adf3a501956d74aefd8d6e217906e79c"
},
{
"url": "https://git.kernel.org/stable/c/8d67e42ad3b1a95a152541015a07110e06992d6c"
},
{
"url": "https://git.kernel.org/stable/c/08a3e218064db11f154ad9ad5541751ea7f34ebe"
},
{
"url": "https://git.kernel.org/stable/c/fb0521aff1e10e300d89725cc439d3ea74c828c5"
},
{
"url": "https://git.kernel.org/stable/c/f7f2fbb0e893a0238dc464f8d8c0f5609bec584f"
}
],
"title": "netfilter: x_tables: avoid leaking percpu counter pointers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53219",
"datePublished": "2026-06-25T08:39:21.730Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-10-15T01:22:45.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68480 (GCVE-0-2026-68480)
Vulnerability from cvelistv5
Published
2026-08-06 17:36
Modified
2026-08-18 06:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/bugs: Make Safe-RET robust against interrupt injection
An attacker injecting interrupts while the Safe-RET mitigation executes
on machines affected by SRSO can neutralize the safe return sequence,
potentially leading to data leakage through speculative execution.
Fixup register state as if the Safe-RET sequence executed successfully
by "emulating" it, in a manner of speaking, and avoid executing a RET
instruction after returning from the interrupt.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3f9b7101bea1dcb63410c016ceb266f6e9f733c9 Version: b35087763a44d1eb45857f799579a351332be505 Version: ac41e90d8daa8815d8bee774a1975435fbfe1ae7 Version: fb3bd914b3ec28f5fb697ac55c4846ac2d542855 Version: fb3bd914b3ec28f5fb697ac55c4846ac2d542855 Version: fb3bd914b3ec28f5fb697ac55c4846ac2d542855 Version: fb3bd914b3ec28f5fb697ac55c4846ac2d542855 Version: fb3bd914b3ec28f5fb697ac55c4846ac2d542855 Version: acdc883eb61efbe01b954e782e1124790bd391a8 Version: 5.10.189 ≤ Version: 5.15.125 ≤ Version: 6.1.44 ≤ Version: 6.4.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/entry/entry_64.S",
"arch/x86/include/asm/nospec-branch.h",
"arch/x86/kernel/cpu/bugs.c",
"arch/x86/lib/retpoline.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dfefa3c51370f84acb643cddf98bb42c885d0483",
"status": "affected",
"version": "3f9b7101bea1dcb63410c016ceb266f6e9f733c9",
"versionType": "git"
},
{
"lessThan": "52db77a13be224e09eb4ba6b4252ae8ab9085c2c",
"status": "affected",
"version": "b35087763a44d1eb45857f799579a351332be505",
"versionType": "git"
},
{
"lessThan": "d0208e08d64d99383e09852a76cc3038c5a4c3ab",
"status": "affected",
"version": "ac41e90d8daa8815d8bee774a1975435fbfe1ae7",
"versionType": "git"
},
{
"lessThan": "6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096",
"status": "affected",
"version": "fb3bd914b3ec28f5fb697ac55c4846ac2d542855",
"versionType": "git"
},
{
"lessThan": "e262f28a69ae9e0791248f93b0173c1d1f3e1d5d",
"status": "affected",
"version": "fb3bd914b3ec28f5fb697ac55c4846ac2d542855",
"versionType": "git"
},
{
"lessThan": "bfe7f9993467ba431b2731437949ac1e2634e771",
"status": "affected",
"version": "fb3bd914b3ec28f5fb697ac55c4846ac2d542855",
"versionType": "git"
},
{
"lessThan": "61649a2d61cb0dbc673f0f232f0f0c298bf50442",
"status": "affected",
"version": "fb3bd914b3ec28f5fb697ac55c4846ac2d542855",
"versionType": "git"
},
{
"lessThan": "7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9",
"status": "affected",
"version": "fb3bd914b3ec28f5fb697ac55c4846ac2d542855",
"versionType": "git"
},
{
"status": "affected",
"version": "acdc883eb61efbe01b954e782e1124790bd391a8",
"versionType": "git"
},
{
"lessThan": "5.10.264",
"status": "affected",
"version": "5.10.189",
"versionType": "semver"
},
{
"lessThan": "5.15.215",
"status": "affected",
"version": "5.15.125",
"versionType": "semver"
},
{
"lessThan": "6.1.182",
"status": "affected",
"version": "6.1.44",
"versionType": "semver"
},
{
"lessThan": "6.5",
"status": "affected",
"version": "6.4.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/entry/entry_64.S",
"arch/x86/include/asm/nospec-branch.h",
"arch/x86/kernel/cpu/bugs.c",
"arch/x86/lib/retpoline.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.264",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.215",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.182",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.150",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.102",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.43",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.264",
"versionStartIncluding": "5.10.189",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.215",
"versionStartIncluding": "5.15.125",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.182",
"versionStartIncluding": "6.1.44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.150",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.102",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.43",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.7",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Make Safe-RET robust against interrupt injection\n\nAn attacker injecting interrupts while the Safe-RET mitigation executes\non machines affected by SRSO can neutralize the safe return sequence,\npotentially leading to data leakage through speculative execution.\n\nFixup register state as if the Safe-RET sequence executed successfully\nby \"emulating\" it, in a manner of speaking, and avoid executing a RET\ninstruction after returning from the interrupt."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T06:56:07.999Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dfefa3c51370f84acb643cddf98bb42c885d0483"
},
{
"url": "https://git.kernel.org/stable/c/52db77a13be224e09eb4ba6b4252ae8ab9085c2c"
},
{
"url": "https://git.kernel.org/stable/c/d0208e08d64d99383e09852a76cc3038c5a4c3ab"
},
{
"url": "https://git.kernel.org/stable/c/6703dba1d14cbd6647cd1ccfa3a3fa94b64dd096"
},
{
"url": "https://git.kernel.org/stable/c/e262f28a69ae9e0791248f93b0173c1d1f3e1d5d"
},
{
"url": "https://git.kernel.org/stable/c/bfe7f9993467ba431b2731437949ac1e2634e771"
},
{
"url": "https://git.kernel.org/stable/c/61649a2d61cb0dbc673f0f232f0f0c298bf50442"
},
{
"url": "https://git.kernel.org/stable/c/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9"
},
{
"url": "https://people.csail.mit.edu/mengjia/data/2026.USENIX.TONTOU.pdf"
}
],
"title": "x86/bugs: Make Safe-RET robust against interrupt injection",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68480",
"datePublished": "2026-08-06T17:36:43.654Z",
"dateReserved": "2026-07-30T09:28:09.397Z",
"dateUpdated": "2026-08-18T06:56:07.999Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74378 (GCVE-0-2026-74378)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue
buffer, which is mapped into userspace. It validates num_sge against
max_sge, but then re-reads the same field to calculate the memcpy
size. A concurrent userspace thread can modify num_sge between
validation and use, causing a heap buffer overflow when copying the
WQE into qp->resp.srq_wqe.
Read num_sge into a local variable and use it for both the bounds
check and the size calculation.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74378",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:54:53.282881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:36.455Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_resp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c8db0e5ab0b6c540214c46c56aaac7cbcb0967fe",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "e48daa94ad2d406225b73491fc935064716f0ec7",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "3cfa2a3adc51b7c57729961a03446962ff10e3d2",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "cd19a6345e3727adafafa5954b58b13c92e13b80",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "3e07ea9579dc9553d2285c26c2823931358aa3b8",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "02558c86b6b761063e9399e6b939984500327ef1",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "b9800d7953d119bcc068c74587d48e4ba0313629",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "22b8fbded65b8c441b634a185f8da67657df6c50",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_resp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe\n\nget_srq_wqe() reads wqe-\u003edma.num_sge from the shared receive queue\nbuffer, which is mapped into userspace. It validates num_sge against\nmax_sge, but then re-reads the same field to calculate the memcpy\nsize. A concurrent userspace thread can modify num_sge between\nvalidation and use, causing a heap buffer overflow when copying the\nWQE into qp-\u003eresp.srq_wqe.\n\nRead num_sge into a local variable and use it for both the bounds\ncheck and the size calculation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local process with mmap write access to the SRQ receive queue shared with the kernel; although incoming RoCE/UDP packets trigger get_srq_wqe(), a remote peer cannot modify num_sge in the victim\u0027s userspace-mapped WQE buffer, so the TOCTOU overflow cannot be achieved from the network alone.\nAC:L - The attacker controls both sides of the race: a userspace thread that repeatedly rewrites num_sge in the mmap\u0027d SRQ entry and the thread/process that posts recv WQEs and receives the triggering RoCE Send/Write packet, making the TOCTOU window reliably winnable without external timing luck.\nPR:L - An unprivileged local user with access to /dev/infiniband/uverbs can create an SRQ (mmap\u0027d queue), associate a QP, and post recv buffers via ibverbs; rxe device setup via \"rdma link add type rxe\" is reachable with CAP_NET_ADMIN inside a user namespace (unshare -Urn).\nUI:N - No victim user interaction is required; the attacker operates their own malicious RDMA userspace process and can self-trigger the vulnerable responder path with RoCE request packets once SRQ/QP resources are configured.\nS:U - The heap overflow corrupts kernel memory within the rxe_qp responder context on the same host kernel, enabling local privilege escalation rather than crossing a VM, container, or IOMMU security boundary to impact a different authority.\nC:H - The attacker-controlled memcpy size causes an out-of-bounds copy from the mmap\u0027d SRQ ring buffer and overflows the fixed qp-\u003eresp.srq_wqe kernel buffer, enabling adjacent kernel heap data disclosure and providing primitives that can be developed into arbitrary kernel memory reads.\nI:H - Overflowing qp-\u003eresp.srq_wqe corrupts subsequent fields in rxe_resp_info/rxe_qp (e.g., responder resource pointers and state), giving a kernel heap buffer overflow that can be leveraged for arbitrary kernel memory writes and local privilege escalation.\nA:H - Corrupting responder state inside rxe_qp can cause kernel oops/panic or wedged RDMA processing during packet handling; even failed exploitation attempts can crash the kernel through use of corrupted function pointers and queue state."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:58:46.129Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c8db0e5ab0b6c540214c46c56aaac7cbcb0967fe"
},
{
"url": "https://git.kernel.org/stable/c/e48daa94ad2d406225b73491fc935064716f0ec7"
},
{
"url": "https://git.kernel.org/stable/c/3cfa2a3adc51b7c57729961a03446962ff10e3d2"
},
{
"url": "https://git.kernel.org/stable/c/cd19a6345e3727adafafa5954b58b13c92e13b80"
},
{
"url": "https://git.kernel.org/stable/c/3e07ea9579dc9553d2285c26c2823931358aa3b8"
},
{
"url": "https://git.kernel.org/stable/c/02558c86b6b761063e9399e6b939984500327ef1"
},
{
"url": "https://git.kernel.org/stable/c/b9800d7953d119bcc068c74587d48e4ba0313629"
},
{
"url": "https://git.kernel.org/stable/c/22b8fbded65b8c441b634a185f8da67657df6c50"
}
],
"title": "RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74378",
"datePublished": "2026-08-15T05:58:56.381Z",
"dateReserved": "2026-08-15T05:44:03.890Z",
"dateUpdated": "2026-10-16T18:55:36.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63823 (GCVE-0-2026-63823)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-10-19 20:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
keys: Pin request_key_auth payload in instantiate paths
A: request_key() B: KEYCTL_INSTANTIATE_IOV
================ =========================
create auth key
store rka in auth key
wait for helper
get auth key
load rka from auth key
copy user payload
sleep on #PF
helper completed
detach and free rka
destroy auth key
wake up
use rka->target_key
**USE-AFTER-FREE**
Give request_key_auth payloads a refcount. Take a payload reference while
authkey->sem stabilizes the payload and revocation state. Hold that
reference across the instantiate and reject paths. Drop the auth key
owning reference from revoke and destroy.
[jarkko: Replaced the first two paragraphs of text with an actual
concurrency scenario.]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b5f545c880a2a47947ba2118b2509644ab7a2969 Version: b5f545c880a2a47947ba2118b2509644ab7a2969 Version: b5f545c880a2a47947ba2118b2509644ab7a2969 Version: b5f545c880a2a47947ba2118b2509644ab7a2969 Version: b5f545c880a2a47947ba2118b2509644ab7a2969 Version: b5f545c880a2a47947ba2118b2509644ab7a2969 Version: b5f545c880a2a47947ba2118b2509644ab7a2969 Version: b5f545c880a2a47947ba2118b2509644ab7a2969 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63823",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:31:09.788460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:07:48.726Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/keys/request_key_auth-type.h",
"security/keys/internal.h",
"security/keys/keyctl.c",
"security/keys/request_key_auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d8274181b0f28d450b42489723a5ba81042158d7",
"status": "affected",
"version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
"versionType": "git"
},
{
"lessThan": "4982bfabce6b33b3c9eddb4fb900fe5568b7cf91",
"status": "affected",
"version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
"versionType": "git"
},
{
"lessThan": "708709c65a1832a99b0eef8ae46e343ddaca3d06",
"status": "affected",
"version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
"versionType": "git"
},
{
"lessThan": "35ab4db86774d82389e4b9559e26ab7f68d8e395",
"status": "affected",
"version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
"versionType": "git"
},
{
"lessThan": "f9b68632ac93cc742f2e411021c4dbfe452ea0c2",
"status": "affected",
"version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
"versionType": "git"
},
{
"lessThan": "7216ce8cb12fee44e309503955bb83806b106129",
"status": "affected",
"version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
"versionType": "git"
},
{
"lessThan": "83c0a1cb296d955d5f4d1f0bd8a769ba8ed8c29f",
"status": "affected",
"version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
"versionType": "git"
},
{
"lessThan": "fd15b457a86939c38aa12116adabd8ff686c5e51",
"status": "affected",
"version": "b5f545c880a2a47947ba2118b2509644ab7a2969",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/keys/request_key_auth-type.h",
"security/keys/internal.h",
"security/keys/keyctl.c",
"security/keys/request_key_auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.16"
},
{
"lessThan": "2.6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: Pin request_key_auth payload in instantiate paths\n\nA: request_key() B: KEYCTL_INSTANTIATE_IOV\n================ =========================\n\ncreate auth key\nstore rka in auth key\nwait for helper\n get auth key\n load rka from auth key\n copy user payload\n sleep on #PF\n\nhelper completed\ndetach and free rka\ndestroy auth key\n wake up\n use rka-\u003etarget_key\n **USE-AFTER-FREE**\n\nGive request_key_auth payloads a refcount. Take a payload reference while\nauthkey-\u003esem stabilizes the payload and revocation state. Hold that\nreference across the instantiate and reject paths. Drop the auth key\nowning reference from revoke and destroy.\n\n[jarkko: Replaced the first two paragraphs of text with an actual\n concurrency scenario.]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through local `request_key()` and `keyctl()` syscalls (`KEYCTL_ASSUME_AUTHORITY`, `KEYCTL_INSTANTIATE`, `KEYCTL_INSTANTIATE_IOV`, `KEYCTL_REJECT`); there is no network, adjacent-radio, or physical-device entry path.\nAC:L - Exploitation is a race the attacker orchestrates by calling `request_key()` and concurrently driving `KEYCTL_INSTANTIATE_IOV` with a user buffer that page-faults during `copy_from_iter_full()`, while a second helper thread or completion path revokes/frees the auth payload.\nPR:L - Any unprivileged local user can invoke `request_key()` and the affected `keyctl` instantiate/reject operations in the spawned helper context; no real-root or non-userns capability is required.\nUI:N - Exploitation does not depend on a victim performing an action beyond the attacker\u2019s own syscall activity and helper process setup.\nS:U - Impact is kernel memory corruption and local privilege escalation within the same kernel security domain, not a VM-guest-to-host or IOMMU boundary escape.\nC:H - This is a heap use-after-free of `struct request_key_auth`; after free the code dereferences `rka-\u003etarget_key` and related fields, enabling attacker-controlled reuse and arbitrary kernel memory disclosure.\nI:H - The UAF corrupts trusted kernel pointers (`target_key`, `dest_keyring`) used in `key_instantiate_and_link()`, which can be turned into arbitrary kernel writes and local privilege escalation.\nA:H - Use-after-free of kernel heap objects can cause kernel oops/panic during post-fault dereferences, and is independently severe even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:31.393Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d8274181b0f28d450b42489723a5ba81042158d7"
},
{
"url": "https://git.kernel.org/stable/c/4982bfabce6b33b3c9eddb4fb900fe5568b7cf91"
},
{
"url": "https://git.kernel.org/stable/c/708709c65a1832a99b0eef8ae46e343ddaca3d06"
},
{
"url": "https://git.kernel.org/stable/c/35ab4db86774d82389e4b9559e26ab7f68d8e395"
},
{
"url": "https://git.kernel.org/stable/c/f9b68632ac93cc742f2e411021c4dbfe452ea0c2"
},
{
"url": "https://git.kernel.org/stable/c/7216ce8cb12fee44e309503955bb83806b106129"
},
{
"url": "https://git.kernel.org/stable/c/83c0a1cb296d955d5f4d1f0bd8a769ba8ed8c29f"
},
{
"url": "https://git.kernel.org/stable/c/fd15b457a86939c38aa12116adabd8ff686c5e51"
}
],
"title": "keys: Pin request_key_auth payload in instantiate paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63823",
"datePublished": "2026-07-19T12:02:19.847Z",
"dateReserved": "2026-07-19T07:54:57.014Z",
"dateUpdated": "2026-10-19T20:07:48.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64543 (GCVE-0-2026-64543)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),
but tipc_disc_rcv() still dereferences b->disc in RX softirq under
rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).
L2 bearers are safe thanks to the synchronize_net() in
tipc_disable_l2_media(), but the UDP bearer defers that call to the
cleanup_bearer() workqueue, so the discoverer is freed with no grace
period:
BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)
Read of size 8 at addr ffff88802348b728 by task poc_tipc/184
<IRQ>
tipc_disc_rcv (net/tipc/discover.c:149)
tipc_rcv (net/tipc/node.c:2126)
tipc_udp_recv (net/tipc/udp_media.c:391)
udp_rcv (net/ipv4/udp.c:2643)
ip_local_deliver_finish (net/ipv4/ip_input.c:241)
</IRQ>
Freed by task 181:
kfree (mm/slub.c:6565)
bearer_disable (net/tipc/bearer.c:418)
tipc_nl_bearer_disable (net/tipc/bearer.c:1001)
The bearer is freed with kfree_rcu(); free the discoverer the same way.
Add an rcu_head to struct tipc_discoverer and free it and its skb from an
RCU callback.
Because the RCU callback (tipc_disc_free_rcu) lives in module text, a
call_rcu() that is still pending when the tipc module is unloaded would
invoke a freed function. Add an rcu_barrier() to tipc_exit() after the
bearer subsystem has been torn down, so all pending discoverer callbacks
have run before the module text goes away.
Reachable from an unprivileged user namespace: the TIPCv2 genl family is
netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC
and CONFIG_TIPC_MEDIA_UDP.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64543",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:12.338756Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:39.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/core.c",
"net/tipc/discover.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "380413cdfd29fb9fa486c82889132b680c4983c5",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "f05b3f4c78370469286879c765f5a1dd39dbcd32",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "4da2ac7749411971e1b222b992da5a172ce45f98",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "5e215bf1c47fdddf8203a0fe80a0ed594065f101",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "ec7d54d8cc1723921d671e3272b427c96366506f",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "b65289e1c3f352a9f92c6e19713ddd647e033253",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "1579342d71133da7f00daa02c75cebec7372097b",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/core.c",
"net/tipc/discover.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix use-after-free of the discoverer in tipc_disc_rcv()\n\nbearer_disable() frees b-\u003edisc with tipc_disc_delete()\u0027s plain kfree(),\nbut tipc_disc_rcv() still dereferences b-\u003edisc in RX softirq under\nrcu_read_lock() (tipc_udp_recv -\u003e tipc_rcv -\u003e tipc_disc_rcv).\n\nL2 bearers are safe thanks to the synchronize_net() in\ntipc_disable_l2_media(), but the UDP bearer defers that call to the\ncleanup_bearer() workqueue, so the discoverer is freed with no grace\nperiod:\n\n BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)\n Read of size 8 at addr ffff88802348b728 by task poc_tipc/184\n \u003cIRQ\u003e\n tipc_disc_rcv (net/tipc/discover.c:149)\n tipc_rcv (net/tipc/node.c:2126)\n tipc_udp_recv (net/tipc/udp_media.c:391)\n udp_rcv (net/ipv4/udp.c:2643)\n ip_local_deliver_finish (net/ipv4/ip_input.c:241)\n \u003c/IRQ\u003e\n Freed by task 181:\n kfree (mm/slub.c:6565)\n bearer_disable (net/tipc/bearer.c:418)\n tipc_nl_bearer_disable (net/tipc/bearer.c:1001)\n\nThe bearer is freed with kfree_rcu(); free the discoverer the same way.\nAdd an rcu_head to struct tipc_discoverer and free it and its skb from an\nRCU callback.\n\nBecause the RCU callback (tipc_disc_free_rcu) lives in module text, a\ncall_rcu() that is still pending when the tipc module is unloaded would\ninvoke a freed function. Add an rcu_barrier() to tipc_exit() after the\nbearer subsystem has been torn down, so all pending discoverer callbacks\nhave run before the module text goes away.\n\nReachable from an unprivileged user namespace: the TIPCv2 genl family is\nnetnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC\nand CONFIG_TIPC_MEDIA_UDP."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The free side is only reachable through the local TIPCv2 generic-netlink `BEARER_DISABLE` command (or netns teardown); a remote peer can supply the discovery packet that performs the use-after-free access but cannot itself cause `bearer_disable()` to run, so the complete attack requires local access.\nAC:L - The attacker controls both sides of the race \u2014 one thread floods TIPC discovery packets at the bearer\u0027s UDP port while another disables the bearer \u2014 and `bearer_disable()` clears `b-\u003eup` and then `kfree()`s the discoverer with no synchronization whatsoever, leaving a wide window that a multi-CPU packet flood hits reliably (a working PoC exists).\nPR:L - `tipc_genl_family` is `.netnsok = true` and the bearer enable/disable ops carry no `GENL_ADMIN_PERM` or other capability check, so an unprivileged user can do everything inside `unshare -Urn` after autoloading tipc via `socket(AF_TIPC, ...)`.\nUI:N - The attacking process performs both the bearer disable and the packet injection itself; no victim action or cooperating user is involved.\nS:U - The corruption stays within the kernel\u0027s own security authority \u2014 no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - `d-\u003enet` is read from the freed slab object and dereferenced as a `struct net *`; after reclaiming the kmalloc-192 allocation with sprayed data the attacker gains a controlled-pointer dereference chain usable for arbitrary kernel memory disclosure.\nI:H - `msg_set_prevnode(buf_msg(d-\u003eskb), sugg_addr)` writes a wire-controlled 32-bit value through the dangling `d-\u003eskb` pointer, and `tipc_disc_add_dest()` takes a spinlock and increments a counter in freed memory \u2014 together a controlled-address/controlled-value write suitable for control-flow hijacking.\nA:H - The use-after-free reliably produces a KASAN slab-use-after-free in softirq context and, on production kernels, a corrupted-pointer dereference or spinlock manipulation on reclaimed memory leading to kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:28.342Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/380413cdfd29fb9fa486c82889132b680c4983c5"
},
{
"url": "https://git.kernel.org/stable/c/f05b3f4c78370469286879c765f5a1dd39dbcd32"
},
{
"url": "https://git.kernel.org/stable/c/4da2ac7749411971e1b222b992da5a172ce45f98"
},
{
"url": "https://git.kernel.org/stable/c/5e215bf1c47fdddf8203a0fe80a0ed594065f101"
},
{
"url": "https://git.kernel.org/stable/c/ec7d54d8cc1723921d671e3272b427c96366506f"
},
{
"url": "https://git.kernel.org/stable/c/a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2"
},
{
"url": "https://git.kernel.org/stable/c/b65289e1c3f352a9f92c6e19713ddd647e033253"
},
{
"url": "https://git.kernel.org/stable/c/1579342d71133da7f00daa02c75cebec7372097b"
}
],
"title": "tipc: fix use-after-free of the discoverer in tipc_disc_rcv()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64543",
"datePublished": "2026-07-27T20:10:35.565Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-10-19T20:48:39.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80722 (GCVE-0-2026-80722)
Vulnerability from cvelistv5
Published
2026-08-28 06:53
Modified
2026-10-16 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: validate individual TWT params before driver setup
ieee80211_process_rx_twt_action() only partially validates a received
S1G TWT setup frame before queueing it.
An individual agreement can therefore reach ieee80211_s1g_rx_twt_setup()
with twt->length too short for the full struct ieee80211_twt_params.
The individual path passes twt to drv_add_twt_setup(). Both the tracepoint
and the driver callback consume the complete parameters block, not merely
req_type. Do not pass a short individual agreement to the driver.
Broadcast agreements remain unchanged because they are rejected locally
after accessing only req_type.
[edit commit message to not overclaim lack of validation nor
understate driver impact]
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 Version: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 Version: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 Version: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 Version: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 Version: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 Version: f5a4c24e689f54e66201f04d343bdd2e8a1d7923 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80722",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:20:57.406511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:35.418Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/s1g.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "92fcd0f30dc8e51f252589b082d46851d295cc1a",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
},
{
"lessThan": "09d60d1f72e6598241490eb6c4e97245af895c09",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
},
{
"lessThan": "ff558072d199c1d641d1561da622e67f780514de",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
},
{
"lessThan": "ade9e2f0f7f4d3089600ac2af8ef0b91746f923b",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
},
{
"lessThan": "b558e07708d886acfcf4b0391ed7a8546e81d326",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
},
{
"lessThan": "47fb04c3826e1f90271d405523043d6708b9072a",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
},
{
"lessThan": "0502d5077e419427d80f4d46ba95d0067f5fb916",
"status": "affected",
"version": "f5a4c24e689f54e66201f04d343bdd2e8a1d7923",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/s1g.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: validate individual TWT params before driver setup\n\nieee80211_process_rx_twt_action() only partially validates a received\nS1G TWT setup frame before queueing it.\n\nAn individual agreement can therefore reach ieee80211_s1g_rx_twt_setup()\nwith twt-\u003elength too short for the full struct ieee80211_twt_params.\n\nThe individual path passes twt to drv_add_twt_setup(). Both the tracepoint\nand the driver callback consume the complete parameters block, not merely\nreq_type. Do not pass a short individual agreement to the driver.\nBroadcast agreements remain unchanged because they are rejected locally\nafter accessing only req_type.\n\n[edit commit message to not overclaim lack of validation nor\n understate driver impact]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Malformed S1G TWT setup action frames reach mac80211 via normal WiFi RX (driver -\u003e ieee80211_rx_h_action -\u003e ieee80211_process_rx_twt_action -\u003e ieee80211_s1g_rx_twt_setup); an adjacent attacker within radio range sends crafted 802.11 management frames to a vulnerable AP.\nAC:L - The attacker fully controls the TWT element length and payload; ieee80211_process_rx_twt_action() only validates two bytes of req_type before queueing, so a short individual agreement reliably reaches drv_add_twt_setup() without races or victim-specific timing.\nPR:N - No Linux privileges on the victim AP are required; exploitation needs only normal 802.11 association as a WiFi client to an S1G AP with twt_responder enabled and a driver implementing add_twt_setup (e.g. MediaTek mt7915/mt7996).\nUI:N - No deliberate victim action is needed beyond operating an S1G AP that accepts associated stations; the attacker directly injects the malformed TWT setup frame and mac80211 processes it automatically on receive.\nS:U - Impact is kernel/driver heap memory corruption on the AP host within the same security authority; it does not cross VM, IOMMU, or sandbox boundaries (standard kernel compromise scope).\nC:H - drv_add_twt_setup(), its tracepoint, and driver callbacks read the full ieee80211_twt_params (twt, min_twt_dur, mantissa, channel) beyond the validated skb bounds, causing out-of-bounds reads of adjacent skb/heap memory that can disclose kernel data.\nI:H - MediaTek add_twt_setup() handlers write twt_agrt fields (req_type, min_twt_dur, twt) past the undersized params block into skb tail/heap memory, providing out-of-bounds write primitives exploitable for further memory corruption or code execution.\nA:H - Out-of-bounds access in mac80211/driver TWT setup can kernel-oops the AP or hang/crash WiFi firmware when corrupted parameters are programmed into hardware TWT state from attacker-controlled short frames."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T06:22:38.281Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/92fcd0f30dc8e51f252589b082d46851d295cc1a"
},
{
"url": "https://git.kernel.org/stable/c/09d60d1f72e6598241490eb6c4e97245af895c09"
},
{
"url": "https://git.kernel.org/stable/c/ff558072d199c1d641d1561da622e67f780514de"
},
{
"url": "https://git.kernel.org/stable/c/ade9e2f0f7f4d3089600ac2af8ef0b91746f923b"
},
{
"url": "https://git.kernel.org/stable/c/b558e07708d886acfcf4b0391ed7a8546e81d326"
},
{
"url": "https://git.kernel.org/stable/c/47fb04c3826e1f90271d405523043d6708b9072a"
},
{
"url": "https://git.kernel.org/stable/c/0502d5077e419427d80f4d46ba95d0067f5fb916"
}
],
"title": "wifi: mac80211: validate individual TWT params before driver setup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80722",
"datePublished": "2026-08-28T06:53:17.886Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-10-16T19:26:35.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68338 (GCVE-0-2026-68338)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/packet: avoid fanout hook re-registration after unregister
packet_set_ring() temporarily detaches a socket from packet delivery while
reconfiguring its ring. It records the previous running state, clears
po->num, unregisters the protocol hook when needed, drops po->bind_lock,
and later restores po->num and re-registers the hook from the saved
was_running value.
That unlocked window can race with NETDEV_UNREGISTER. The notifier can
observe the socket as not running, skip __unregister_prot_hook(), and
invalidate the per-socket binding by setting po->ifindex to -1 and clearing
po->prot_hook.dev. A one-member fanout group can still retain its shared
fanout hook device pointer. When packet_set_ring() resumes, re-registering
solely from the stale was_running state can re-add the fanout hook after
the device has been unregistered.
Treat po->ifindex == -1 as an invalidated binding after reacquiring
po->bind_lock. This is distinct from ifindex 0, the normal
unbound/wildcard state: ifindex -1 marks an existing device binding that
was invalidated when the device was unregistered. Restore po->num as
before, but do not re-register the hook if device unregister already
detached the socket.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dc99f600698dcac69b8f56dda9a8a00d645c5ffc Version: dc99f600698dcac69b8f56dda9a8a00d645c5ffc Version: dc99f600698dcac69b8f56dda9a8a00d645c5ffc Version: dc99f600698dcac69b8f56dda9a8a00d645c5ffc Version: dc99f600698dcac69b8f56dda9a8a00d645c5ffc Version: dc99f600698dcac69b8f56dda9a8a00d645c5ffc Version: dc99f600698dcac69b8f56dda9a8a00d645c5ffc Version: dc99f600698dcac69b8f56dda9a8a00d645c5ffc |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:47:16.591778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:05.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "acb40ebfa5c4d62f84339fcbf713f2a9fd033a71",
"status": "affected",
"version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
"versionType": "git"
},
{
"lessThan": "c820f4b7f2fa38f8769db0d0cefdd94e2721504d",
"status": "affected",
"version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
"versionType": "git"
},
{
"lessThan": "4628efbdc7affd094181f5263e65c1062e31f15f",
"status": "affected",
"version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
"versionType": "git"
},
{
"lessThan": "80ec024d53a05c60ad1d08968dcf745f10c1665c",
"status": "affected",
"version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
"versionType": "git"
},
{
"lessThan": "0a052e0808e015e68144a9877e6ef42b952c49fa",
"status": "affected",
"version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
"versionType": "git"
},
{
"lessThan": "1bc55c29cd85818e9052f17deb287d5a11fb817f",
"status": "affected",
"version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
"versionType": "git"
},
{
"lessThan": "a885387dae7986a55bae5c77a15bdd447f64e9b9",
"status": "affected",
"version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
"versionType": "git"
},
{
"lessThan": "50aff80475abd3533eef4320477037e6fcc6b56e",
"status": "affected",
"version": "dc99f600698dcac69b8f56dda9a8a00d645c5ffc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: avoid fanout hook re-registration after unregister\n\npacket_set_ring() temporarily detaches a socket from packet delivery while\nreconfiguring its ring. It records the previous running state, clears\npo-\u003enum, unregisters the protocol hook when needed, drops po-\u003ebind_lock,\nand later restores po-\u003enum and re-registers the hook from the saved\nwas_running value.\n\nThat unlocked window can race with NETDEV_UNREGISTER. The notifier can\nobserve the socket as not running, skip __unregister_prot_hook(), and\ninvalidate the per-socket binding by setting po-\u003eifindex to -1 and clearing\npo-\u003eprot_hook.dev. A one-member fanout group can still retain its shared\nfanout hook device pointer. When packet_set_ring() resumes, re-registering\nsolely from the stale was_running state can re-add the fanout hook after\nthe device has been unregistered.\n\nTreat po-\u003eifindex == -1 as an invalidated binding after reacquiring\npo-\u003ebind_lock. This is distinct from ifindex 0, the normal\nunbound/wildcard state: ifindex -1 marks an existing device binding that\nwas invalidated when the device was unregistered. Restore po-\u003enum as\nbefore, but do not re-register the hook if device unregister already\ndetached the socket."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is triggered through local syscalls \u2014 creating an AF_PACKET socket, PACKET_FANOUT/bind setsockopt, PACKET_RX_RING setsockopt, and a netlink device unregister \u2014 with no remote packet processing involved.\nAC:L - The attacker controls both sides of the race: it issues the packet_set_ring() reconfiguration and deletes the bound netdev in its own netns, and the unlocked window spans synchronize_net() plus the ring swap, making it wide and reliably winnable.\nPR:L - AF_PACKET requires CAP_NET_RAW and device unregistration CAP_NET_ADMIN, but an unprivileged user obtains both via user+network namespaces (unshare -Urn) and can create and delete veth/dummy devices there.\nUI:N - The attacker performs every step itself \u2014 socket setup, ring reconfiguration and device teardown \u2014 with no action required from any other user.\nS:U - The stale hook registration and resulting corruption stay within the kernel\u0027s own security authority; no hypervisor, IOMMU or other trust boundary is crossed.\nC:H - The fanout packet_type is left linked into a net_device that is being torn down, a dangling registration on soon-to-be-freed memory; such stale-pointer state in the ptype lists can be leveraged for kernel memory disclosure.\nI:H - The dangling list node in the freed net_device\u0027s ptype list yields a list_del write into freed memory when the hook is later removed, a controllable write primitive typical of use-after-free exploitation.\nA:H - The re-added hook makes netdev_run_todo() hit BUG_ON(!list_empty(\u0026dev-\u003eptype_all)) while RTNL is held, oopsing the kernel and permanently wedging all further network configuration \u2014 a repeatable, unprivileged host-wide denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:33:38.308Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/acb40ebfa5c4d62f84339fcbf713f2a9fd033a71"
},
{
"url": "https://git.kernel.org/stable/c/c820f4b7f2fa38f8769db0d0cefdd94e2721504d"
},
{
"url": "https://git.kernel.org/stable/c/4628efbdc7affd094181f5263e65c1062e31f15f"
},
{
"url": "https://git.kernel.org/stable/c/80ec024d53a05c60ad1d08968dcf745f10c1665c"
},
{
"url": "https://git.kernel.org/stable/c/0a052e0808e015e68144a9877e6ef42b952c49fa"
},
{
"url": "https://git.kernel.org/stable/c/1bc55c29cd85818e9052f17deb287d5a11fb817f"
},
{
"url": "https://git.kernel.org/stable/c/a885387dae7986a55bae5c77a15bdd447f64e9b9"
},
{
"url": "https://git.kernel.org/stable/c/50aff80475abd3533eef4320477037e6fcc6b56e"
}
],
"title": "net/packet: avoid fanout hook re-registration after unregister",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68338",
"datePublished": "2026-08-10T12:03:14.549Z",
"dateReserved": "2026-07-30T09:28:09.384Z",
"dateUpdated": "2026-10-19T21:09:05.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68158 (GCVE-0-2026-68158)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix multiplication overflow in decode_new_up_state_weight()
If a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted
osdmap, out-of-bounds memory accesses may occur in
decode_new_up_state_weight(). This happens because the bounds check for
the new_state part is based on calculating its length depending on a len
value read from the incoming message. This calculation may overflow
leading to an incorrect bounds check. Subsequently, out-of-bounds reads
may occur when decoding this part.
This patch switches the multiplication to use check_mul_overflow() to
abort processing the osdmap if an overflow occurred. Therefore,
osdmaps/messages containing large values for len that result in a
multiplication overflow are treated as invalid.
[ idryomov: rename new_state_len -> new_state_item_size, formatting ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 930c532869774ebf8af9efe9484c597f896a7d46 Version: 930c532869774ebf8af9efe9484c597f896a7d46 Version: 930c532869774ebf8af9efe9484c597f896a7d46 Version: 930c532869774ebf8af9efe9484c597f896a7d46 Version: 930c532869774ebf8af9efe9484c597f896a7d46 Version: 930c532869774ebf8af9efe9484c597f896a7d46 Version: 930c532869774ebf8af9efe9484c597f896a7d46 Version: 930c532869774ebf8af9efe9484c597f896a7d46 Version: 1196c36fd53c3b1615eb02f986cb727b1dfc1047 Version: bbc3aa6b0e6050b2b2e04a08dd4d6423d576b196 Version: 6b96b2d473701b45df3fea8dd9796b6ec39e6d54 Version: 7405d73cea0d0e6c541f5c534078feeb46188844 Version: 8777c9f654637d56f4c4ca54eb1bc7c609b70085 Version: 6831c98ce0b8a3e88db64aa224372effd0dcc694 Version: 032951d32c13b7564dfba82758260cb7aa1149d2 Version: 14877928f10667a5606383885d004f7185f33718 Version: 3.10.103 ≤ Version: 3.12.63 ≤ Version: 3.14.75 ≤ Version: 3.16.39 ≤ Version: 3.18.39 ≤ Version: 4.1.30 ≤ Version: 4.4.17 ≤ Version: 4.6.6 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68158",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:45:15.268376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:55.112Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ceee3b77b83052648c40fef965f836fd7699d26",
"status": "affected",
"version": "930c532869774ebf8af9efe9484c597f896a7d46",
"versionType": "git"
},
{
"lessThan": "e4473751cc37db41f3f7da25d64a23e0c74570f1",
"status": "affected",
"version": "930c532869774ebf8af9efe9484c597f896a7d46",
"versionType": "git"
},
{
"lessThan": "f6961070c326bd158c38fa48756cde2bd78c4aaa",
"status": "affected",
"version": "930c532869774ebf8af9efe9484c597f896a7d46",
"versionType": "git"
},
{
"lessThan": "05c90e059269f087becfcce23348496085835c29",
"status": "affected",
"version": "930c532869774ebf8af9efe9484c597f896a7d46",
"versionType": "git"
},
{
"lessThan": "143ba49ead77ec483c0326f8aaad8649874e99c4",
"status": "affected",
"version": "930c532869774ebf8af9efe9484c597f896a7d46",
"versionType": "git"
},
{
"lessThan": "1732d89dfcd74f6fde9ce70900d316c4a151c153",
"status": "affected",
"version": "930c532869774ebf8af9efe9484c597f896a7d46",
"versionType": "git"
},
{
"lessThan": "bee4b5b53e7bff0467fd916cc44c9b190733c6bd",
"status": "affected",
"version": "930c532869774ebf8af9efe9484c597f896a7d46",
"versionType": "git"
},
{
"lessThan": "98917a499ec7064c14fc56d180a4fd636fc2784c",
"status": "affected",
"version": "930c532869774ebf8af9efe9484c597f896a7d46",
"versionType": "git"
},
{
"status": "affected",
"version": "1196c36fd53c3b1615eb02f986cb727b1dfc1047",
"versionType": "git"
},
{
"status": "affected",
"version": "bbc3aa6b0e6050b2b2e04a08dd4d6423d576b196",
"versionType": "git"
},
{
"status": "affected",
"version": "6b96b2d473701b45df3fea8dd9796b6ec39e6d54",
"versionType": "git"
},
{
"status": "affected",
"version": "7405d73cea0d0e6c541f5c534078feeb46188844",
"versionType": "git"
},
{
"status": "affected",
"version": "8777c9f654637d56f4c4ca54eb1bc7c609b70085",
"versionType": "git"
},
{
"status": "affected",
"version": "6831c98ce0b8a3e88db64aa224372effd0dcc694",
"versionType": "git"
},
{
"status": "affected",
"version": "032951d32c13b7564dfba82758260cb7aa1149d2",
"versionType": "git"
},
{
"status": "affected",
"version": "14877928f10667a5606383885d004f7185f33718",
"versionType": "git"
},
{
"lessThan": "3.11",
"status": "affected",
"version": "3.10.103",
"versionType": "semver"
},
{
"lessThan": "3.13",
"status": "affected",
"version": "3.12.63",
"versionType": "semver"
},
{
"lessThan": "3.15",
"status": "affected",
"version": "3.14.75",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.39",
"versionType": "semver"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.39",
"versionType": "semver"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.30",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.17",
"versionType": "semver"
},
{
"lessThan": "4.7",
"status": "affected",
"version": "4.6.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.12.63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.14.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix multiplication overflow in decode_new_up_state_weight()\n\nIf a message of type CEPH_MSG_OSD_MAP contains a (maliciously) corrupted\nosdmap, out-of-bounds memory accesses may occur in\ndecode_new_up_state_weight(). This happens because the bounds check for\nthe new_state part is based on calculating its length depending on a len\nvalue read from the incoming message. This calculation may overflow\nleading to an incorrect bounds check. Subsequently, out-of-bounds reads\nmay occur when decoding this part.\n\nThis patch switches the multiplication to use check_mul_overflow() to\nabort processing the osdmap if an overflow occurred. Therefore,\nosdmaps/messages containing large values for len that result in a\nmultiplication overflow are treated as invalid.\n\n[ idryomov: rename new_state_len -\u003e new_state_item_size, formatting ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Malformed incremental osdmap data is delivered in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch) to libceph clients (CephFS/RBD), and the overflow is triggered while decoding received network bytes in osdmap_apply_incremental().\nAC:L - A compromised or attacker-controlled monitor/OSD can publish an incremental osdmap with epoch N+1 and a crafted new_state length that wraps the multiply, reliably bypassing bounds checks without races or victim-specific memory layout.\nPR:N - Exploitation requires no privileges on the victim host; a malicious cluster peer or on-path attacker that can deliver forged osdmaps to an already-connected kernel Ceph client needs no local account, capabilities, or user-namespace tricks.\nUI:N - Once a host is a Ceph client, osdmap subscriptions and updates are applied automatically by the kernel; no additional mount, open, or interactive step is needed at exploit time beyond the existing client session.\nS:U - Impact is confined to kernel memory and libceph client state on the Ceph client host (info leak, map corruption, crash, or privilege escalation); it does not cross VM, IOMMU, or sandbox boundaries to another security authority.\nC:H - Integer-overflow bypass lets decode_new_up_state_weight() run bare ceph_decode_32/8 loops past the message end, performing out-of-bounds reads of adjacent kernel heap/slack memory that can disclose pointers and other sensitive data.\nI:H - Misaligned decoding also drives attacker-controlled osd/xorstate/weight values into map-\u003eosd_weight[], map-\u003eosd_state[], and map-\u003eosd_addr[] updates (including memset), corrupting kernel osdmap state in ways usable for further exploitation.\nA:H - Unbounded out-of-bounds reads while parsing osdmaps can fault on unmapped pages and trigger kernel oops/panic; map corruption can also cause persistent client failure, repeatable on each malicious incremental map."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:30:30.014Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ceee3b77b83052648c40fef965f836fd7699d26"
},
{
"url": "https://git.kernel.org/stable/c/e4473751cc37db41f3f7da25d64a23e0c74570f1"
},
{
"url": "https://git.kernel.org/stable/c/f6961070c326bd158c38fa48756cde2bd78c4aaa"
},
{
"url": "https://git.kernel.org/stable/c/05c90e059269f087becfcce23348496085835c29"
},
{
"url": "https://git.kernel.org/stable/c/143ba49ead77ec483c0326f8aaad8649874e99c4"
},
{
"url": "https://git.kernel.org/stable/c/1732d89dfcd74f6fde9ce70900d316c4a151c153"
},
{
"url": "https://git.kernel.org/stable/c/bee4b5b53e7bff0467fd916cc44c9b190733c6bd"
},
{
"url": "https://git.kernel.org/stable/c/98917a499ec7064c14fc56d180a4fd636fc2784c"
}
],
"title": "libceph: Fix multiplication overflow in decode_new_up_state_weight()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68158",
"datePublished": "2026-08-10T11:59:24.675Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-10-19T20:58:55.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64541 (GCVE-0-2026-64541)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
smc_cdc_rx_handler() looks up the connection by token under the link
group's conns_lock, drops the lock, and then dereferences conn and the
smc_sock derived from it, ending in sock_hold(&smc->sk) inside
smc_cdc_msg_recv(). No reference is held across the lock release.
The only reference pinning the socket while the connection is
discoverable in the link group is taken in smc_lgr_register_conn()
(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both
under conns_lock. Once the handler drops conns_lock, a concurrent
close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn()
can drop that reference and free the smc_sock, so the handler's later
sock_hold() runs on freed memory:
WARNING: lib/refcount.c:25 at refcount_warn_saturate
Workqueue: rxe_wq do_work
refcount_warn_saturate (lib/refcount.c:25)
smc_cdc_msg_recv (net/smc/smc_cdc.c:430)
smc_cdc_rx_handler (net/smc/smc_cdc.c:502)
smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)
tasklet_action_common (kernel/softirq.c:938)
handle_softirqs (kernel/softirq.c:622)
Kernel panic - not syncing: panic_on_warn set
Only SMC-R is affected. The SMC-D receive tasklet is stopped by
tasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection
is unregistered, so it cannot run concurrently with the free.
Take the socket reference while still holding conns_lock, so the
registration reference can no longer be the last one, and drop it once
the handler is done.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64541",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:09.809089Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:39.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/smc_cdc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8de4f665d0febfb92803dece377791a563fc7041",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "8145b432136285e01091815b48ceb2dae261f262",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "1951bffbc6493ec34cff3956b29d4bc6606904a6",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "647b19e5cc145a2f1f685ae8ff3805a17356888c",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "472e9d7c0d5b03be3ff91ff941f57da822b031bc",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "ce5aa8084329351086894aa34d77e40301d5bd3d",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "9d160b35cc34a2ba8229d07651468a7848325135",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/smc_cdc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket\n\nsmc_cdc_rx_handler() looks up the connection by token under the link\ngroup\u0027s conns_lock, drops the lock, and then dereferences conn and the\nsmc_sock derived from it, ending in sock_hold(\u0026smc-\u003esk) inside\nsmc_cdc_msg_recv(). No reference is held across the lock release.\n\nThe only reference pinning the socket while the connection is\ndiscoverable in the link group is taken in smc_lgr_register_conn()\n(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both\nunder conns_lock. Once the handler drops conns_lock, a concurrent\nclose() -\u003e smc_release() -\u003e smc_conn_free() -\u003e smc_lgr_unregister_conn()\ncan drop that reference and free the smc_sock, so the handler\u0027s later\nsock_hold() runs on freed memory:\n\n WARNING: lib/refcount.c:25 at refcount_warn_saturate\n Workqueue: rxe_wq do_work\n refcount_warn_saturate (lib/refcount.c:25)\n smc_cdc_msg_recv (net/smc/smc_cdc.c:430)\n smc_cdc_rx_handler (net/smc/smc_cdc.c:502)\n smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)\n tasklet_action_common (kernel/softirq.c:938)\n handle_softirqs (kernel/softirq.c:622)\n Kernel panic - not syncing: panic_on_warn set\n\nOnly SMC-R is affected. The SMC-D receive tasklet is stopped by\ntasklet_kill(\u0026conn-\u003erx_tsklet) in smc_conn_free() before the connection\nis unregistered, so it cannot run concurrently with the free.\n\nTake the socket reference while still holding conns_lock, so the\nregistration reference can no longer be the last one, and drop it once\nthe handler is done."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable handler is driven entirely by a CDC control message sent by the remote SMC-R peer over the RDMA link, with an attacker-chosen `token` field and no local syscall involvement. SMC-R runs over RoCEv2 (IP/UDP-routable, port 4791) with the CLC handshake over plain TCP, and SMC-Rv2 explicitly supports non-local/routed peers, so the attacker need not share an L2 segment.\nAC:L - The attacker controls both sides of the race: it chooses when to emit CDC messages and which connection to target (the alert token is disclosed to it in the CLC accept/confirm), and it can drive the teardown side itself via CDC close/abort flags into `smc_close_passive_work()` or a stale seqno with `failover_validation` into `abort_work` -\u003e `smc_conn_kill()`. The race can be retried indefinitely across many connections in the same link group, and was reproduced in practice with soft-RoCE.\nPR:N - Establishing an SMC-R connection to a listening SMC socket requires no credentials \u2014 SMC has no authentication layer of its own, exactly like plain TCP. Everything after connection establishment (sending CDC messages with a chosen token, signalling close/abort) is available to an unauthenticated peer.\nUI:N - The CDC message is processed in a softirq tasklet from the RDMA completion queue with no involvement from any local user or application action. No victim interaction of any kind is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard in-kernel use-after-free.\nC:H - The freed `smc_sock` is reused type-safely as another live socket, so attacker-supplied cursors applied by `smc_cdc_msg_recv_action()` break the `0 \u003c= bytes_to_rcv \u003c= rmb_desc-\u003elen` invariant and make `smc_rx_recvmsg()` hand stale RMB contents to userspace, while the urgent-data path reads `*(base + conn-\u003eurg_curs.count - 1)` at an attacker-chosen offset. Once the slab page is reclaimed after the RCU grace period, reuse is unconstrained, giving a general kernel-memory read primitive.\nI:H - `sock_hold()` on an already-zero refcount followed by `sock_put()` re-enters `sk_free()`, yielding a double free, and the handler additionally writes `sk_err`/`sk_shutdown`, makes indirect calls through `sk_data_ready()`/`sk_write_space()`, and `queue_work()`s a freed `work_struct`. These are classic heap-spray and control-flow-hijack primitives leading to arbitrary kernel write.\nA:H - The reported symptom is `refcount_warn_saturate` from `smc_cdc_msg_recv()`, which is an immediate kernel panic on `panic_on_warn` systems, and dereferencing freed memory in softirq context otherwise oopses. The attacker can trigger it repeatedly without authentication."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:17.774Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041"
},
{
"url": "https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262"
},
{
"url": "https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6"
},
{
"url": "https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c"
},
{
"url": "https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc"
},
{
"url": "https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb"
},
{
"url": "https://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d"
},
{
"url": "https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135"
}
],
"title": "net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64541",
"datePublished": "2026-07-27T20:10:34.439Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-10-19T20:48:39.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45968 (GCVE-0-2026-45968)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cpuidle: Skip governor when only one idle state is available
On certain platforms (PowerNV systems without a power-mgt DT node),
cpuidle may register only a single idle state. In cases where that
single state is a polling state (state 0), the ladder governor may
incorrectly treat state 1 as the first usable state and pass an
out-of-bounds index. This can lead to a NULL enter callback being
invoked, ultimately resulting in a system crash.
[ 13.342636] cpuidle-powernv : Only Snooze is available
[ 13.351854] Faulting instruction address: 0x00000000
[ 13.376489] NIP [0000000000000000] 0x0
[ 13.378351] LR [c000000001e01974] cpuidle_enter_state+0x2c4/0x668
Fix this by adding a bail-out in cpuidle_select() that returns state 0
directly when state_count <= 1, bypassing the governor and keeping the
tick running.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dc2251bf98c66db3f4e055b751968f0871037ae4 Version: dc2251bf98c66db3f4e055b751968f0871037ae4 Version: dc2251bf98c66db3f4e055b751968f0871037ae4 Version: dc2251bf98c66db3f4e055b751968f0871037ae4 Version: dc2251bf98c66db3f4e055b751968f0871037ae4 Version: dc2251bf98c66db3f4e055b751968f0871037ae4 Version: dc2251bf98c66db3f4e055b751968f0871037ae4 Version: dc2251bf98c66db3f4e055b751968f0871037ae4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cpuidle/cpuidle.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a0f7e804edc82e513d1ccb7c95ed8b351522ec81",
"status": "affected",
"version": "dc2251bf98c66db3f4e055b751968f0871037ae4",
"versionType": "git"
},
{
"lessThan": "5d103a38e2ae96eca57fd17161bcd29bd4622d1c",
"status": "affected",
"version": "dc2251bf98c66db3f4e055b751968f0871037ae4",
"versionType": "git"
},
{
"lessThan": "4da2b897283c39980d6ae09dc1560fcd937879e5",
"status": "affected",
"version": "dc2251bf98c66db3f4e055b751968f0871037ae4",
"versionType": "git"
},
{
"lessThan": "5c577ac939bca486cb02069505cfe47a5312ce02",
"status": "affected",
"version": "dc2251bf98c66db3f4e055b751968f0871037ae4",
"versionType": "git"
},
{
"lessThan": "8f6833d919bae915ead6c599a53e81e19b32da52",
"status": "affected",
"version": "dc2251bf98c66db3f4e055b751968f0871037ae4",
"versionType": "git"
},
{
"lessThan": "63ae78336f40bcd9a44952a7c6bafb9c88a8effd",
"status": "affected",
"version": "dc2251bf98c66db3f4e055b751968f0871037ae4",
"versionType": "git"
},
{
"lessThan": "a0724e40a58a0e323c59707edeae5b71d15800dc",
"status": "affected",
"version": "dc2251bf98c66db3f4e055b751968f0871037ae4",
"versionType": "git"
},
{
"lessThan": "e5c9ffc6ae1bcdb1062527d611043681ac301aca",
"status": "affected",
"version": "dc2251bf98c66db3f4e055b751968f0871037ae4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cpuidle/cpuidle.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpuidle: Skip governor when only one idle state is available\n\nOn certain platforms (PowerNV systems without a power-mgt DT node),\ncpuidle may register only a single idle state. In cases where that\nsingle state is a polling state (state 0), the ladder governor may\nincorrectly treat state 1 as the first usable state and pass an\nout-of-bounds index. This can lead to a NULL enter callback being\ninvoked, ultimately resulting in a system crash.\n\n[ 13.342636] cpuidle-powernv : Only Snooze is available\n[ 13.351854] Faulting instruction address: 0x00000000\n[ 13.376489] NIP [0000000000000000] 0x0\n[ 13.378351] LR [c000000001e01974] cpuidle_enter_state+0x2c4/0x668\n\nFix this by adding a bail-out in cpuidle_select() that returns state 0\ndirectly when state_count \u003c= 1, bypassing the governor and keeping the\ntick running."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:27.247Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a0f7e804edc82e513d1ccb7c95ed8b351522ec81"
},
{
"url": "https://git.kernel.org/stable/c/5d103a38e2ae96eca57fd17161bcd29bd4622d1c"
},
{
"url": "https://git.kernel.org/stable/c/4da2b897283c39980d6ae09dc1560fcd937879e5"
},
{
"url": "https://git.kernel.org/stable/c/5c577ac939bca486cb02069505cfe47a5312ce02"
},
{
"url": "https://git.kernel.org/stable/c/8f6833d919bae915ead6c599a53e81e19b32da52"
},
{
"url": "https://git.kernel.org/stable/c/63ae78336f40bcd9a44952a7c6bafb9c88a8effd"
},
{
"url": "https://git.kernel.org/stable/c/a0724e40a58a0e323c59707edeae5b71d15800dc"
},
{
"url": "https://git.kernel.org/stable/c/e5c9ffc6ae1bcdb1062527d611043681ac301aca"
}
],
"title": "cpuidle: Skip governor when only one idle state is available",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45968",
"datePublished": "2026-05-27T12:18:27.247Z",
"dateReserved": "2026-05-13T15:03:33.089Z",
"dateUpdated": "2026-05-27T12:18:27.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63887 (GCVE-0-2026-63887)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-19 20:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
iscsi_encode_text_output() concatenates "key=value\0" records into
login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer
allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call
sites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check
the remaining buffer capacity:
*length += sprintf(output_buf, "%s=%s", er->key, er->value);
*length += 1;
output_buf = textbuf + *length;
The 8192-byte ceiling at iscsi_target_check_login_request() bounds the
*input* Login PDU payload, but a single PDU can carry up to 2048 minimal
four-byte "a=b\0" pairs, each unknown key expanding to a 16-byte
"a=NotUnderstood\0" output record via iscsi_add_notunderstood_response().
2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB
heap overrun in the kmalloc-8k slab.
The fix introduces a static iscsi_encode_text_record() helper that uses
snprintf() with a per-call bounds check against the remaining buffer,
and threads a u32 textbuf_size parameter through
iscsi_encode_text_output(). Both call sites in
iscsi_target_handle_csg_zero() (PHASE_SECURITY) and
iscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass
MAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls
iscsi_release_extra_responses() to drop queued records, and returns -1;
both caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR /
ISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning,
so the initiator sees an explicit failed-login response rather than a
silent connection drop. (Prior to this patch only the PHASE_OPERATIONAL
caller did that; the PHASE_SECURITY caller is converted to the same
shape.)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63887",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:32:57.099055Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:54.668Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/iscsi/iscsi_target_nego.c",
"drivers/target/iscsi/iscsi_target_parameters.c",
"drivers/target/iscsi/iscsi_target_parameters.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb84e974fb172bc71386289f37b78ea679410b39",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "b19382dfc6e7dee6d3859ba44b6ca29e97a51627",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "efe633e600a0ac68357206fede21b1ac8178f3b8",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "4e9f0c4a645c995bc75c06c7b3644254ffb4c76b",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "30bf335e8fe170322080ee001f05ca29c50680b3",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "594a40360012ce5f94c715d5e3b20fa3af7d525a",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "26e4a304b7e6f1338c675d527608d32549c091db",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "bf33e01f88388c43e285492a63e539df6ffed64c",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/iscsi/iscsi_target_nego.c",
"drivers/target/iscsi/iscsi_target_parameters.c",
"drivers/target/iscsi/iscsi_target_parameters.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf\n\niscsi_encode_text_output() concatenates \"key=value\\0\" records into\nlogin-\u003ersp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer\nallocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call\nsites in this function (lines 1398, 1411, 1424 in v7.1-rc2) never check\nthe remaining buffer capacity:\n\n\t*length += sprintf(output_buf, \"%s=%s\", er-\u003ekey, er-\u003evalue);\n\t*length += 1;\n\toutput_buf = textbuf + *length;\n\nThe 8192-byte ceiling at iscsi_target_check_login_request() bounds the\n*input* Login PDU payload, but a single PDU can carry up to 2048 minimal\nfour-byte \"a=b\\0\" pairs, each unknown key expanding to a 16-byte\n\"a=NotUnderstood\\0\" output record via iscsi_add_notunderstood_response().\n2048 * 16 = 32 KiB of output into an 8 KiB buffer, producing a ~24 KiB\nheap overrun in the kmalloc-8k slab.\n\nThe fix introduces a static iscsi_encode_text_record() helper that uses\nsnprintf() with a per-call bounds check against the remaining buffer,\nand threads a u32 textbuf_size parameter through\niscsi_encode_text_output(). Both call sites in\niscsi_target_handle_csg_zero() (PHASE_SECURITY) and\niscsi_target_handle_csg_one() (PHASE_OPERATIONAL) pass\nMAX_KEY_VALUE_PAIRS. On overflow the encoder logs the condition, calls\niscsi_release_extra_responses() to drop queued records, and returns -1;\nboth caller sites now emit ISCSI_STATUS_CLS_INITIATOR_ERR /\nISCSI_LOGIN_STATUS_INIT_ERR via iscsit_tx_login_rsp() before returning,\nso the initiator sees an explicit failed-login response rather than a\nsilent connection drop. (Prior to this patch only the PHASE_OPERATIONAL\ncaller did that; the PHASE_SECURITY caller is converted to the same\nshape.)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The Linux iSCSI target (LIO) is an in-kernel SCSI target that accepts remote TCP connections on the iSCSI portal (typically port 3260); crafted Login PDUs reach the vulnerable encoder via the normal network receive and login-negotiation path.\nAC:L - Once an iSCSI target portal is reachable, an attacker can reliably trigger the overflow by sending a single Login PDU packed with unknown key=value pairs; no races or victim-dependent timing are required.\nPR:N - The heap overflow occurs during login negotiation before iSCSI authentication completes; a discovery-session login requires only InitiatorName and SessionType with no credentials, initiator ACL, or local privileges.\nUI:N - Exploitation requires only network packets sent by the attacker; no action from a legitimate user or administrator is needed beyond the target already exposing its iSCSI portal.\nS:U - The corruption is confined to kernel heap memory in the iSCSI target/login context and does not cross a VM, container, or IOMMU security boundary by itself.\nC:H - A ~24 KiB out-of-bounds write into the kmalloc-8k slab can corrupt adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - The unbounded sprintf heap overrun is a large out-of-bounds write that can corrupt adjacent heap metadata or objects to achieve arbitrary kernel memory modification and potential code execution.\nA:H - Corrupting kmalloc-8k heap objects during login response encoding can cause kernel oops, BUG, or panic, and the attack can be repeated against an exposed iSCSI target."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:36:56.451Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb84e974fb172bc71386289f37b78ea679410b39"
},
{
"url": "https://git.kernel.org/stable/c/b19382dfc6e7dee6d3859ba44b6ca29e97a51627"
},
{
"url": "https://git.kernel.org/stable/c/efe633e600a0ac68357206fede21b1ac8178f3b8"
},
{
"url": "https://git.kernel.org/stable/c/4e9f0c4a645c995bc75c06c7b3644254ffb4c76b"
},
{
"url": "https://git.kernel.org/stable/c/30bf335e8fe170322080ee001f05ca29c50680b3"
},
{
"url": "https://git.kernel.org/stable/c/594a40360012ce5f94c715d5e3b20fa3af7d525a"
},
{
"url": "https://git.kernel.org/stable/c/26e4a304b7e6f1338c675d527608d32549c091db"
},
{
"url": "https://git.kernel.org/stable/c/bf33e01f88388c43e285492a63e539df6ffed64c"
}
],
"title": "scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63887",
"datePublished": "2026-07-19T14:55:00.114Z",
"dateReserved": "2026-07-19T07:54:57.018Z",
"dateUpdated": "2026-10-19T20:17:54.668Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63898 (GCVE-0-2026-63898)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-07-19 14:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: mct_u232: fix memory corruption with small endpoint
The driver overrides the maximum transfer size for a specific device
which only accepts 16 byte packets for its 32 byte bulk-out endpoint.
Make sure to never increase the maximum transfer size to prevent slab
corruption should a malicious device report a smaller endpoint max
packet size than expected.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/mct_u232.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94edbbc5fe00d03cfe1d4e690d7d2cd36317a935",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bd2ddb3fe9052ad8703593bbec26ecc7ca92869e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "39e295a91e80f3b91f61c7ada2bde434dcaba20d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "90dbad14b109e5fdfb4934ff61e561d11ba3742d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6cb48f8890f9b2051d7c34823057296a536a31c5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d8fdf33d6fcfb90cbec26299baf2352c84b2d768",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "57f332af1745014cd7e40414814ffaa6bc7d3b5b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "915b36d701950503c4ea0f6e314b10868e59fce3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/mct_u232.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: mct_u232: fix memory corruption with small endpoint\n\nThe driver overrides the maximum transfer size for a specific device\nwhich only accepts 16 byte packets for its 32 byte bulk-out endpoint.\n\nMake sure to never increase the maximum transfer size to prevent slab\ncorruption should a malicious device report a smaller endpoint max\npacket size than expected."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T14:55:07.452Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94edbbc5fe00d03cfe1d4e690d7d2cd36317a935"
},
{
"url": "https://git.kernel.org/stable/c/bd2ddb3fe9052ad8703593bbec26ecc7ca92869e"
},
{
"url": "https://git.kernel.org/stable/c/39e295a91e80f3b91f61c7ada2bde434dcaba20d"
},
{
"url": "https://git.kernel.org/stable/c/90dbad14b109e5fdfb4934ff61e561d11ba3742d"
},
{
"url": "https://git.kernel.org/stable/c/6cb48f8890f9b2051d7c34823057296a536a31c5"
},
{
"url": "https://git.kernel.org/stable/c/d8fdf33d6fcfb90cbec26299baf2352c84b2d768"
},
{
"url": "https://git.kernel.org/stable/c/57f332af1745014cd7e40414814ffaa6bc7d3b5b"
},
{
"url": "https://git.kernel.org/stable/c/915b36d701950503c4ea0f6e314b10868e59fce3"
}
],
"title": "USB: serial: mct_u232: fix memory corruption with small endpoint",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63898",
"datePublished": "2026-07-19T14:55:07.452Z",
"dateReserved": "2026-07-19T07:54:57.019Z",
"dateUpdated": "2026-07-19T14:55:07.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64002 (GCVE-0-2026-64002)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-19 20:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports
too soon.
Only after unregister_net_sysctl_table() we can be sure no threads can possibly
use the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 122ff243f5f104194750ecbc76d5946dd1eec934 Version: 122ff243f5f104194750ecbc76d5946dd1eec934 Version: 122ff243f5f104194750ecbc76d5946dd1eec934 Version: 122ff243f5f104194750ecbc76d5946dd1eec934 Version: 122ff243f5f104194750ecbc76d5946dd1eec934 Version: 122ff243f5f104194750ecbc76d5946dd1eec934 Version: 122ff243f5f104194750ecbc76d5946dd1eec934 Version: 122ff243f5f104194750ecbc76d5946dd1eec934 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:00.962668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:18:02.288Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/sysctl_net_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ecf45080a4d3f4526cacb8b14060fe3b49a6913b",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "5b23a2ff379e70b6b9ff744a972b63e1f8f4d996",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "6512c57c4638ddec113bf42439361ba85a12048d",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "a7f4eefb6e1458431eef9fa20fb363320d185f76",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "155f90be5ee8be5b110ebc0b7da33c54c83b0208",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
},
{
"lessThan": "87a1e0fe7776da7ab411be332b4be58ac8840d10",
"status": "affected",
"version": "122ff243f5f104194750ecbc76d5946dd1eec934",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/sysctl_net_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()\n\nipv4_sysctl_exit_net() is currently freeing net-\u003eipv4.sysctl_local_reserved_ports\ntoo soon.\n\nOnly after unregister_net_sysctl_table() we can be sure no threads can possibly\nuse the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscalls\u2014network namespace teardown via unshare/setns/put_net, sysctl access to /proc/sys/net/ipv4/ip_local_reserved_ports, and/or local socket bind/connect\u2014not remote packet delivery.\nAC:L - The attacker can control both sides of the race by concurrently tearing down a network namespace while hammering the sysctl or triggering socket port selection in that namespace.\nPR:L - An unprivileged local user can reach this via user namespaces (CAP_SYS_ADMIN within the user_ns for CLONE_NEWNET) and world-writable sysctl access (mode 0644) during namespace destruction.\nUI:N - No victim interaction is required beyond the attacker\u0027s own concurrent namespace teardown and sysctl or socket activity.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it is standard local kernel memory corruption, not a VM/hypervisor boundary escape.\nC:H - Freed 8 KiB bitmap memory remains reachable via sysctl reads (find_next_bit) and inet_is_local_reserved_port() (test_bit), enabling heap information disclosure through a use-after-free.\nI:H - Sysctl writes via proc_do_large_bitmap perform bitmap_copy/bitmap_or into the freed allocation, providing a heap write primitive exploitable for control-flow hijacking.\nA:H - Concurrent access to the freed bitmap can cause kernel oops/panic from invalid memory access, and UAF exploitation inherently threatens kernel availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:02.672Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ecf45080a4d3f4526cacb8b14060fe3b49a6913b"
},
{
"url": "https://git.kernel.org/stable/c/a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c"
},
{
"url": "https://git.kernel.org/stable/c/5b23a2ff379e70b6b9ff744a972b63e1f8f4d996"
},
{
"url": "https://git.kernel.org/stable/c/8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57"
},
{
"url": "https://git.kernel.org/stable/c/6512c57c4638ddec113bf42439361ba85a12048d"
},
{
"url": "https://git.kernel.org/stable/c/a7f4eefb6e1458431eef9fa20fb363320d185f76"
},
{
"url": "https://git.kernel.org/stable/c/155f90be5ee8be5b110ebc0b7da33c54c83b0208"
},
{
"url": "https://git.kernel.org/stable/c/87a1e0fe7776da7ab411be332b4be58ac8840d10"
}
],
"title": "ipv4: free net-\u003eipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64002",
"datePublished": "2026-07-19T14:56:19.495Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-10-19T20:18:02.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68154 (GCVE-0-2026-68154)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: reject zero bucket types in crush_decode
CRUSH bucket type 0 is reserved for devices. The mapper relies on
that invariant and uses type 0 to identify leaf devices.
If crush_decode() accepts a bucket with type 0, a malformed CRUSH map
can make the mapper treat a negative bucket ID as a device and pass it
to is_out(), which then indexes the OSD weight array with a negative
value.
Reject zero bucket types while decoding the CRUSH map so the invalid
state never reaches the mapper.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:45:00.533524Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:54.485Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "952ca5dc99913d169263f59fd689f586729a13c1",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "146461f09565afe3665e65b0423d3d6b0fe806c5",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "80fc40e11cda1b5d990a3f69c6efa344fb5cd987",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "b8a9fb6bf806f9c4891e71ae1beab0c07c23a877",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "826cd1de5802fd392922785f9b64d76e65d2a100",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "70998f91030ee083ecb336a1dff0701c20a38081",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "05f90284223381005d6bcddab3fda4a97f9c3401",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: reject zero bucket types in crush_decode\n\nCRUSH bucket type 0 is reserved for devices. The mapper relies on\nthat invariant and uses type 0 to identify leaf devices.\n\nIf crush_decode() accepts a bucket with type 0, a malformed CRUSH map\ncan make the mapper treat a negative bucket ID as a device and pass it\nto is_out(), which then indexes the OSD weight array with a negative\nvalue.\n\nReject zero bucket types while decoding the CRUSH map so the invalid\nstate never reaches the mapper."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is reached when the in-kernel Ceph client decodes a crafted CRUSH map inside CEPH_MSG_OSD_MAP received over TCP from a Ceph monitor or OSD, which is a standard network-delivered cluster control message on connected storage clients.\nAC:L - An attacker can reliably craft a CRUSH map with a bucket whose type field is zero and controlled hierarchy/items so crush_do_rule() later calls is_out() with a negative index, without races, victim-specific memory layout, or rare kernel build options.\nPR:N - No local privileges on the victim host are required; a remote attacker who controls, compromises, or MITMs the authenticated Ceph monitor/OSD peer can deliver the malicious OSD map over the established client cluster connection.\nUI:N - No additional victim action is needed at exploit time because poisoned OSD maps are processed automatically and CRUSH placement is recalculated during routine map updates, request rescanning, and normal Ceph client I/O.\nS:U - The vulnerability corrupts or reads kernel memory on the host running the Ceph client, affecting that kernel security domain rather than crossing a VM, container sandbox, or IOMMU boundary.\nC:H - When a type-0 bucket makes the mapper treat a negative bucket ID as a device, is_out() indexes osd_weight[] with a negative value, causing an out-of-bounds read of adjacent kernel memory beyond the OSD weight array.\nI:H - This out-of-bounds kernel heap access during CRUSH placement is memory corruption in a privileged parser/mapper path that can be leveraged for further kernel memory control and arbitrary code execution, not only information disclosure.\nA:H - The invalid negative indexing during CRUSH mapping can dereference unmapped or non-resident memory and trigger a kernel oops or panic, causing complete loss of availability on affected Ceph client hosts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:30:20.481Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/952ca5dc99913d169263f59fd689f586729a13c1"
},
{
"url": "https://git.kernel.org/stable/c/146461f09565afe3665e65b0423d3d6b0fe806c5"
},
{
"url": "https://git.kernel.org/stable/c/80fc40e11cda1b5d990a3f69c6efa344fb5cd987"
},
{
"url": "https://git.kernel.org/stable/c/b8a9fb6bf806f9c4891e71ae1beab0c07c23a877"
},
{
"url": "https://git.kernel.org/stable/c/826cd1de5802fd392922785f9b64d76e65d2a100"
},
{
"url": "https://git.kernel.org/stable/c/3b2f1937f5fce8b7dd5432e7693e3cc8b5eece56"
},
{
"url": "https://git.kernel.org/stable/c/70998f91030ee083ecb336a1dff0701c20a38081"
},
{
"url": "https://git.kernel.org/stable/c/05f90284223381005d6bcddab3fda4a97f9c3401"
}
],
"title": "libceph: reject zero bucket types in crush_decode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68154",
"datePublished": "2026-08-10T11:59:20.250Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-10-19T20:58:54.485Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68159 (GCVE-0-2026-68159)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
__decode_pg_temp() decodes an user-controlled length but only rejects
values large enough to overflow the allocation; it does not bound it to
CEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and
apply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size
on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends
an OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack
out-of-bounds write.
An OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer
entries at decode time. The bound is well below the old overflow threshold, so
it also covers the allocation-size overflow the previous check guarded against.
BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds
Write of size 4 ... by task exploit
kasan_report (mm/kasan/report.c:595)
ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)
calc_target (net/ceph/osd_client.c:1638)
__submit_request (net/ceph/osd_client.c:2394)
ceph_osdc_start_request (net/ceph/osd_client.c:2490)
ceph_osdc_call (net/ceph/osd_client.c:5164)
rbd_dev_image_probe (drivers/block/rbd.c:6899)
do_rbd_add (drivers/block/rbd.c:7138)
...
kernel BUG at net/ceph/osdmap.c:2670!
[ idryomov: do the same in __decode_pg_upmap_items() ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 Version: a303bb0e58345fe9f7ab2f82b90266f2b5036058 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68159",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:45:17.609836Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:55.255Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "66eec4af1e080b695229c9a20635648a6d12fedf",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "4daf06456677177f2a6044729abac59c1b49e87b",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "42bc06c67d94d5f2a6b33294b0c4b07d8a47c515",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "ebdf4b4f3b1474079980a2e5cd79ad65fb54db57",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "590b07ceea138d49c9b64f65d263aa902d3b4730",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "e36663145abd7024f0281dfb22fdef65f185845b",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
},
{
"lessThan": "9f00f9cf2be293efe899db67dc5272e3a9c62717",
"status": "affected",
"version": "a303bb0e58345fe9f7ab2f82b90266f2b5036058",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE\n\n__decode_pg_temp() decodes an user-controlled length but only rejects\nvalues large enough to overflow the allocation; it does not bound it to\nCEPH_PG_MAX_SIZE. The helper backs both pg_temp and pg_upmap decoding, and\napply_upmap()/get_temp_osds() later copy the decoded list into the fixed-size\non-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE]. A monitor that sends\nan OSDMap with a pg_temp/pg_upmap entry longer than 32 thus causes a stack\nout-of-bounds write.\n\nAn OSD set for a single PG can never exceed CEPH_PG_MAX_SIZE, so reject longer\nentries at decode time. The bound is well below the old overflow threshold, so\nit also covers the allocation-size overflow the previous check guarded against.\n\n BUG: KASAN: stack-out-of-bounds in ceph_pg_to_up_acting_osds\n Write of size 4 ... by task exploit\n kasan_report (mm/kasan/report.c:595)\n ceph_pg_to_up_acting_osds (net/ceph/osdmap.c:2617 net/ceph/osdmap.c:2833)\n calc_target (net/ceph/osd_client.c:1638)\n __submit_request (net/ceph/osd_client.c:2394)\n ceph_osdc_start_request (net/ceph/osd_client.c:2490)\n ceph_osdc_call (net/ceph/osd_client.c:5164)\n rbd_dev_image_probe (drivers/block/rbd.c:6899)\n do_rbd_add (drivers/block/rbd.c:7138)\n ...\n kernel BUG at net/ceph/osdmap.c:2670!\n\n[ idryomov: do the same in __decode_pg_upmap_items() ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Malicious pg_temp/pg_upmap data arrives in CEPH_MSG_OSD_MAP from a Ceph monitor or OSD over TCP, is decoded in libceph, and later triggers stack corruption in ceph_pg_to_up_acting_osds during RBD/CephFS/libceph client I/O.\nAC:L - A compromised or attacker-controlled monitor can publish osdmap entries with length \u003e32 for chosen PGs; once the client subscribes, kernel I/O paths such as RBD mount/probe via calc_target deterministically invoke apply_upmap/get_temp_osds and overflow the stack buffer.\nPR:N - Exploitation requires no privileges on the victim host; any machine acting as a Ceph client that receives a forged osdmap from a cluster peer over the network can be attacked without local user capabilities or namespace tricks.\nUI:N - No victim user action is needed during exploitation beyond the host already being a Ceph client; forged osdmaps are applied automatically and the overflow fires on subsequent kernel client operations without interactive steps.\nS:U - Impact is confined to kernel memory on the Ceph client host (privilege escalation or crash); it does not cross VM, IOMMU, or sandbox boundaries to other security authorities.\nC:H - KASAN-confirmed stack out-of-bounds write in ceph_pg_to_up_acting_osds corrupts adjacent stack memory and can be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Unbounded copy loops in apply_upmap() and get_temp_osds() write attacker-controlled u32 OSD IDs past the fixed osds[CEPH_PG_MAX_SIZE] stack array, enabling control-flow hijack and arbitrary kernel writes.\nA:H - The reported reproducer triggers KASAN stack-out-of-bounds followed by kernel BUG in ceph_pg_to_up_acting_osds, demonstrating a reliable kernel oops or panic from malformed osdmap processing on Ceph clients."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:00.131Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/66eec4af1e080b695229c9a20635648a6d12fedf"
},
{
"url": "https://git.kernel.org/stable/c/4daf06456677177f2a6044729abac59c1b49e87b"
},
{
"url": "https://git.kernel.org/stable/c/d5650ddbd4d42c1a916c8fe1a4c4cb573ef810a1"
},
{
"url": "https://git.kernel.org/stable/c/42bc06c67d94d5f2a6b33294b0c4b07d8a47c515"
},
{
"url": "https://git.kernel.org/stable/c/ebdf4b4f3b1474079980a2e5cd79ad65fb54db57"
},
{
"url": "https://git.kernel.org/stable/c/590b07ceea138d49c9b64f65d263aa902d3b4730"
},
{
"url": "https://git.kernel.org/stable/c/e36663145abd7024f0281dfb22fdef65f185845b"
},
{
"url": "https://git.kernel.org/stable/c/9f00f9cf2be293efe899db67dc5272e3a9c62717"
}
],
"title": "libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68159",
"datePublished": "2026-08-10T11:59:25.697Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-10-19T20:58:55.255Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64547 (GCVE-0-2026-64547)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
For an even packet_len, net1080_rx_fixup() reads the pad byte at
skb->data[packet_len] before the skb->len != packet_len check further
down, and packet_len is only bounded against NC_MAX_PACKET. A malicious
NetChip 1080 device can send a short frame advertising a large even
packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the
skb:
BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup
Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14
...
net1080_rx_fixup (drivers/net/usb/net1080.c:384)
usbnet_bh (drivers/net/usb/usbnet.c:1589)
process_one_work (kernel/workqueue.c:3322)
bh_worker (kernel/workqueue.c:3708)
tasklet_action (kernel/softirq.c:965)
handle_softirqs (kernel/softirq.c:622)
...
Reject the frame when packet_len >= skb->len before reading.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64547",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:20.565927Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:40.168Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/net1080.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f42217fa7d535e9ec4151f7971f06f6ea65e850a",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "c087749815379e9af2fdbeb08bfc33870b103958",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "e4a87126c085b097d29e17e3b7647295bba8be7c",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "685e92934f11d5e215dad58813e2f9955ac2f436",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "4dc8484be3302d187274364820d3bef6c62bde32",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "b153cfe84b1340c69a13d0957665a2bfcf21239c",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "ea866cab12db1a2100b400a8b03569e5bc0ee29a",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "03f384bc0cb8d4a1301d4f5b0baef2d980258383",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/net1080.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"lessThan": "2.6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: net1080: validate packet_len before pad-byte access in rx_fixup\n\nFor an even packet_len, net1080_rx_fixup() reads the pad byte at\nskb-\u003edata[packet_len] before the skb-\u003elen != packet_len check further\ndown, and packet_len is only bounded against NC_MAX_PACKET. A malicious\nNetChip 1080 device can send a short frame advertising a large even\npacket_len (e.g. 0x4000), so the pad-byte read lands past the end of the\nskb:\n\n BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup\n Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14\n ...\n net1080_rx_fixup (drivers/net/usb/net1080.c:384)\n usbnet_bh (drivers/net/usb/usbnet.c:1589)\n process_one_work (kernel/workqueue.c:3322)\n bh_worker (kernel/workqueue.c:3708)\n tasklet_action (kernel/softirq.c:965)\n handle_softirqs (kernel/softirq.c:622)\n ...\n\nReject the frame when packet_len \u003e= skb-\u003elen before reading."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - net1080 implements a point-to-point Ethernet link over a USB host-to-host cable, so the malformed NC frame originates from the logically adjacent peer host/device on that link rather than from a local user; a compromised peer (or a gadget-mode board presenting 0525:1080, which autoloads the default-y driver) sends the frame over an already-established link with no physical interaction at attack time.\nAC:L - The attacker fully and deterministically controls packet_len and the frame length in every received frame, so the out-of-bounds read is triggered on demand with no race, no timing dependency, and no reliance on memory layout the attacker cannot influence.\nPR:N - The rx path runs in softirq/workqueue context on every received URB with no authentication, no capability check, and no local account on the target; USB/link-level peers are entirely untrusted and ungated.\nUI:N - The driver binds automatically via MODULE_DEVICE_TABLE and processes frames in usbnet_bh without any user action; on an already-connected host-to-host cable the victim does nothing at all.\nS:U - The out-of-bounds read stays within the kernel\u0027s own memory and security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The attacker controls the read offset across a ~32 KB range past a 1523-byte slab/page-frag object, and the comparison outcome is leaked back over the wire because only the matching path reaches nc_ensure_sync()\u0027s vendor control transfer, yielding a repeatable oracle for probing kernel heap contents rather than a bounded few-byte read.\nI:N - The path performs only a one-byte read; the subsequent skb-\u003elen != packet_len check still rejects the frame, and the skb_trim calls on the underflow paths are no-ops, so no kernel memory or network data is modified.\nA:H - The read reaches roughly 31 KB beyond the allocation, which can cross into a KFENCE guard page, an unmapped hole, or a page-frag boundary and oops in softirq context, and on KASAN/panic_on_warn hardened kernels it panics the machine outright \u2014 repeatable per frame."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:24.361Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f42217fa7d535e9ec4151f7971f06f6ea65e850a"
},
{
"url": "https://git.kernel.org/stable/c/c087749815379e9af2fdbeb08bfc33870b103958"
},
{
"url": "https://git.kernel.org/stable/c/e4a87126c085b097d29e17e3b7647295bba8be7c"
},
{
"url": "https://git.kernel.org/stable/c/685e92934f11d5e215dad58813e2f9955ac2f436"
},
{
"url": "https://git.kernel.org/stable/c/4dc8484be3302d187274364820d3bef6c62bde32"
},
{
"url": "https://git.kernel.org/stable/c/b153cfe84b1340c69a13d0957665a2bfcf21239c"
},
{
"url": "https://git.kernel.org/stable/c/ea866cab12db1a2100b400a8b03569e5bc0ee29a"
},
{
"url": "https://git.kernel.org/stable/c/03f384bc0cb8d4a1301d4f5b0baef2d980258383"
}
],
"title": "net: usb: net1080: validate packet_len before pad-byte access in rx_fixup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64547",
"datePublished": "2026-07-27T20:10:37.786Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-10-19T20:48:40.168Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74377 (GCVE-0-2026-74377)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path
For non-SRQ QPs, the responder reads WQE fields directly from the
shared queue buffer mapped into userspace. This allows a malicious
user to modify fields like num_sge or sge entries while the kernel
is processing the WQE, leading to out-of-bounds reads in
rxe_resp_check_length() and copy_data().
Introduce get_recv_wqe() that validates num_sge and copies the WQE
to a kernel-local buffer before processing, matching the approach
already used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is
reused since SRQ and non-SRQ paths are mutually exclusive per QP.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74377",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:54:49.610673Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:36.323Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_resp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2e60378fb3c8b51c94103bb40014c4fe38fa5033",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "fc72fd61cc8b2e2e3e92ae4c0e9cc30c9a7ecb78",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "9fa785137303f7109c23dea779b8dedc67c9b531",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "5420eebf3b3c162bfaf965f30e61cd1d689e5732",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "a211b7904aed365e4e4f08a48ec6e6dd1ea7b16b",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "d6ab440240a04b8737ee4c7bb21af9182e451733",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_resp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Copy WQE to local buffer in non-SRQ receive path\n\nFor non-SRQ QPs, the responder reads WQE fields directly from the\nshared queue buffer mapped into userspace. This allows a malicious\nuser to modify fields like num_sge or sge entries while the kernel\nis processing the WQE, leading to out-of-bounds reads in\nrxe_resp_check_length() and copy_data().\n\nIntroduce get_recv_wqe() that validates num_sge and copies the WQE\nto a kernel-local buffer before processing, matching the approach\nalready used for SRQ WQEs in get_srq_wqe(). The srq_wqe buffer is\nreused since SRQ and non-SRQ paths are mutually exclusive per QP."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires mutating mmap\u0027d receive WQEs through /dev/infiniband/uverbs; inbound RoCE packets (rxe_udp_encap_recv\u2192rxe_rcv\u2192rxe_receiver) only trigger processing and cannot alter WQE fields without local control of the userspace-mapped receive queue.\nAC:L - The attacker controls both sides of the TOCTOU\u2014userspace threads racing num_sge/sge edits while posting recv WRs and driving inbound RoCE SEND/WRITE traffic\u2014so out-of-bounds reads in rxe_resp_check_length() and copy_data() are reliably triggerable with retries.\nPR:L - uverbs_devnode() publishes /dev/infiniband/uverbsN as mode 0666, letting any local account create userspace QPs and mmap receive queues; rxe link setup needs CAP_NET_ADMIN obtainable in a user+network namespace via unshare -Urn, matching PR:L kernel guidance.\nUI:N - Exploitation is entirely self-driven from the attacker\u0027s own RDMA verbs client and concurrent userspace threads; no victim user action, mount, or file open is required.\nS:U - Impact is kernel memory corruption and local privilege escalation within the host kernel security authority, not a VM guest-to-host escape, IOMMU/DMA boundary bypass, or other cross-scope compromise.\nC:H - Inflating num_sge or rewriting sge entries during processing causes out-of-bounds reads in rxe_resp_check_length() and copy_data() beyond the allocated WQE slot, potentially into adjacent vmalloc/kernel memory, enabling arbitrary kernel information disclosure.\nI:H - copy_data() walks attacker-forged out-of-bounds sge entries and performs rxe_mr_copy writes of incoming RDMA payload into MR-backed memory; combined with queue overruns this yields controlled memory corruption exploitable for arbitrary write and code execution.\nA:H - Processing a WQE with an attacker-inflated num_sge causes the kernel to walk far past valid sge slots, dereferencing invalid pointers and corrupting memory, reliably producing kernel oops/panic and total loss of availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:46:29.745Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2e60378fb3c8b51c94103bb40014c4fe38fa5033"
},
{
"url": "https://git.kernel.org/stable/c/fc72fd61cc8b2e2e3e92ae4c0e9cc30c9a7ecb78"
},
{
"url": "https://git.kernel.org/stable/c/9fa785137303f7109c23dea779b8dedc67c9b531"
},
{
"url": "https://git.kernel.org/stable/c/5420eebf3b3c162bfaf965f30e61cd1d689e5732"
},
{
"url": "https://git.kernel.org/stable/c/a211b7904aed365e4e4f08a48ec6e6dd1ea7b16b"
},
{
"url": "https://git.kernel.org/stable/c/d6ab440240a04b8737ee4c7bb21af9182e451733"
}
],
"title": "RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74377",
"datePublished": "2026-08-15T05:58:55.704Z",
"dateReserved": "2026-08-15T05:44:03.889Z",
"dateUpdated": "2026-10-16T18:55:36.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68136 (GCVE-0-2026-68136)
Vulnerability from cvelistv5
Published
2026-08-10 11:58
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: gro: fix double aggregation of flush-marked skbs
Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO
packet.") added a flush check to skb_gro_receive(), but
skb_gro_receive_list() lacks the same validation.
As a result, packets marked with NAPI_GRO_CB(skb)->flush may still be
re-aggregated.
This allows already-GRO'd packets with existing frag_list to be
re-aggregated into a new GRO session, corrupting the frag_list chain
structure. When skb_segment() attempts to unpack these malformed packets,
it encounters invalid state and triggers a kernel panic.
Scenario (Tethering/Device forwarding):
1. Driver: Generated aggregated packet P1 via LRO with frag_list
2. Dev A: Receives aggregated fraglist packet and flush flag set
3. Dev A: Re-enters GRO, skb_gro_receive_list() is called
4. Missing flush check allows re-aggregation despite flush flag
5. Frag_list chain becomes corrupted (loops or dangling refs)
6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list
Root cause in skb_segment():
The check at line ~4891:
if (hsize <= 0 && i >= nfrags && skb_headlen(list_skb) &&
(skb_headlen(list_skb) == len || sg)) {
When frag_list is corrupted by double aggregation, when list_skb is
a NULL pointer from skb->next, skb_headlen(list_skb) dereference
NULL/corrupted pointers occurs.
Call Trace:
skb_headlen(NULL skb)
skb_segment
tcp_gso_segment
tcp4_gso_segment
inet_gso_segment
skb_mac_gso_segment
__skb_gso_segment
skb_gso_segment
validate_xmit_skb
validate_xmit_skb_list
sch_direct_xmit
qdisc_restart
__qdisc_run
qdisc_run
net_tx_action
Fix: Add NAPI_GRO_CB(skb)->flush validation to the early-return check in
skb_gro_receive_list(), matching the defensive programming pattern of
skb_gro_receive().
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 Version: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 Version: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 Version: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 Version: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 Version: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 Version: 3a1296a38d0cf62bffb9a03c585cbd5dbf15d596 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68136",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:44:29.127961Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:52.839Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/gro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7fc7e35212cf58c134310fb47566a844297ceae9",
"status": "affected",
"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
"versionType": "git"
},
{
"lessThan": "d1fb23f8f794ac4683127bd49a6422bd87e0ac02",
"status": "affected",
"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
"versionType": "git"
},
{
"lessThan": "db3e82da616f52e2b27e25e7be3fde2f2a5e54d6",
"status": "affected",
"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
"versionType": "git"
},
{
"lessThan": "107e1a469f53a2a70874f3f12bf6fcd23925da1d",
"status": "affected",
"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
"versionType": "git"
},
{
"lessThan": "a4dfd46cc8f08a29c6183794790547d0945f3d45",
"status": "affected",
"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
"versionType": "git"
},
{
"lessThan": "fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0",
"status": "affected",
"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
"versionType": "git"
},
{
"lessThan": "e751256486d0ded20f5a9f9863467f1dce65142f",
"status": "affected",
"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/gro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: fix double aggregation of flush-marked skbs\n\nCommit 0ab03f353d36 (\"net-gro: Fix GRO flush when receiving a GSO\npacket.\") added a flush check to skb_gro_receive(), but\nskb_gro_receive_list() lacks the same validation.\n\nAs a result, packets marked with NAPI_GRO_CB(skb)-\u003eflush may still be\nre-aggregated.\n\nThis allows already-GRO\u0027d packets with existing frag_list to be\nre-aggregated into a new GRO session, corrupting the frag_list chain\nstructure. When skb_segment() attempts to unpack these malformed packets,\nit encounters invalid state and triggers a kernel panic.\n\nScenario (Tethering/Device forwarding):\n 1. Driver: Generated aggregated packet P1 via LRO with frag_list\n 2. Dev A: Receives aggregated fraglist packet and flush flag set\n 3. Dev A: Re-enters GRO, skb_gro_receive_list() is called\n 4. Missing flush check allows re-aggregation despite flush flag\n 5. Frag_list chain becomes corrupted (loops or dangling refs)\n 6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list\n\nRoot cause in skb_segment():\n The check at line ~4891:\n if (hsize \u003c= 0 \u0026\u0026 i \u003e= nfrags \u0026\u0026 skb_headlen(list_skb) \u0026\u0026\n (skb_headlen(list_skb) == len || sg)) {\n\n When frag_list is corrupted by double aggregation, when list_skb is\n a NULL pointer from skb-\u003enext, skb_headlen(list_skb) dereference\n NULL/corrupted pointers occurs.\n\nCall Trace:\n skb_headlen(NULL skb)\n skb_segment\n tcp_gso_segment\n tcp4_gso_segment\n inet_gso_segment\n skb_mac_gso_segment\n __skb_gso_segment\n skb_gso_segment\n validate_xmit_skb\n validate_xmit_skb_list\n sch_direct_xmit\n qdisc_restart\n __qdisc_run\n qdisc_run\n net_tx_action\n\nFix: Add NAPI_GRO_CB(skb)-\u003eflush validation to the early-return check in\nskb_gro_receive_list(), matching the defensive programming pattern of\nskb_gro_receive()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached from the standard NAPI GRO receive path processing remotely originated TCP/IP packets (napi_gro_receive\u2192dev_gro_receive\u2192tcp_gro_receive\u2192skb_gro_receive_list), including tethering/NAT/forwarding scenarios where packets re-enter GRO on a second netdev after driver LRO or prior GRO aggregation.\nAC:L - An attacker can reliably trigger the bug by crafting a TCP stream through a forwarding host with rx-gro-list enabled, without races or victim-specific timing; the commit documents a deterministic tethering/forwarding repro where flush-marked frag_list skbs are re-aggregated and later crash skb_segment.\nPR:N - No local privileges or authentication are required; any remote peer that can send TCP traffic through a vulnerable forwarding/tethering/NAT Linux host can reach the GRO fraglist merge path, which performs no capability or credential checks on the receive path.\nUI:N - Exploitation requires only network-delivered packets and normal kernel forwarding/GRO processing; the victim does not need to open files, mount filesystems, click links, or perform any deliberate action beyond routine network operation.\nS:U - Impact is confined to kernel memory corruption and panic within the same host kernel security domain during packet GRO aggregation and subsequent segmentation on transmit; it does not cross VM, container, or IOMMU boundaries to affect a separate security authority.\nC:H - Double aggregation corrupts the skb frag_list chain (loops, dangling references, NULL/corrupted list_skb pointers), constituting kernel heap memory corruption that can be read during skb_segment processing and is classifiable as a high-impact info-disclosure primitive beyond a simple crash.\nI:H - Re-aggregating flush-marked skbs with existing frag_list corrupts skb linked-list structure and reference relationships in kernel memory, enabling potential control of subsequent skb metadata and write/control-flow primitives during GSO segmentation, not merely integrity-preserving packet drops.\nA:H - Corrupted frag_list state causes skb_segment to dereference a NULL or invalid list_skb via skb_headlen(), producing a kernel panic/oops on the transmit path (sch_direct_xmit/qdisc_run), fully denying availability of the affected system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:45:54.689Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7fc7e35212cf58c134310fb47566a844297ceae9"
},
{
"url": "https://git.kernel.org/stable/c/d1fb23f8f794ac4683127bd49a6422bd87e0ac02"
},
{
"url": "https://git.kernel.org/stable/c/db3e82da616f52e2b27e25e7be3fde2f2a5e54d6"
},
{
"url": "https://git.kernel.org/stable/c/107e1a469f53a2a70874f3f12bf6fcd23925da1d"
},
{
"url": "https://git.kernel.org/stable/c/a4dfd46cc8f08a29c6183794790547d0945f3d45"
},
{
"url": "https://git.kernel.org/stable/c/fc0c0f7a207f0cd2d2aa725696c907f7d03af9e0"
},
{
"url": "https://git.kernel.org/stable/c/e751256486d0ded20f5a9f9863467f1dce65142f"
}
],
"title": "net: gro: fix double aggregation of flush-marked skbs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68136",
"datePublished": "2026-08-10T11:58:59.450Z",
"dateReserved": "2026-07-30T09:28:09.370Z",
"dateUpdated": "2026-10-19T20:58:52.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64411 (GCVE-0-2026-64411)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: terminate table name before find_table_lock()
update_counters() and compat_update_counters() forward a user-supplied
32-byte table name to find_table_lock() without NUL-terminating it. On a
lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s",
"ebtable_", name), and vsnprintf() reads past the name field and the
stack object until it hits a zero byte.
BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)
Read of size 1 at addr ffff8880119dfb20 by task exploit/147
Call Trace:
...
string (lib/vsprintf.c:648 lib/vsprintf.c:730)
vsnprintf (lib/vsprintf.c:2945)
__request_module (kernel/module/kmod.c:150)
do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)
update_counters (net/bridge/netfilter/ebtables.c:1440)
do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)
nf_setsockopt (net/netfilter/nf_sockopt.c:101)
ip_setsockopt (net/ipv4/ip_sockglue.c:1424)
raw_setsockopt (net/ipv4/raw.c:847)
__sys_setsockopt (net/socket.c:2393)
...
compat_do_replace() shares the same unterminated name via
compat_copy_ebt_replace_from_user(); terminate it there too so all
find_table_lock() callers behave alike. The other callers already
terminate the name after the copy.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:23:41.919Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64411",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:40:19.631345Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:27.565Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebtables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4c046ca4e35a83ea32f6e748f54139f5fe2a1d01",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ab63ccefb9c71627f957a0724c2b9ebc869c6f20",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c6f539311e58e76aa96feef0f1572b13a564f8a2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2664f537ca5bcb2ef3fac2683dcca602e51fad24",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7436da6c1bc44654b7f11a17e746f6999fd37250",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b6183b1b88a722b6d8ea0cecc99eba168a15e0be",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a622d2e9608c9dff47fc2e5759ac7aa3a836b45d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebtables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: terminate table name before find_table_lock()\n\nupdate_counters() and compat_update_counters() forward a user-supplied\n32-byte table name to find_table_lock() without NUL-terminating it. On a\nlookup miss, find_inlist_lock() calls try_then_request_module(..., \"%s%s\",\n\"ebtable_\", name), and vsnprintf() reads past the name field and the\nstack object until it hits a zero byte.\n\n BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n Read of size 1 at addr ffff8880119dfb20 by task exploit/147\n Call Trace:\n ...\n string (lib/vsprintf.c:648 lib/vsprintf.c:730)\n vsnprintf (lib/vsprintf.c:2945)\n __request_module (kernel/module/kmod.c:150)\n do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)\n update_counters (net/bridge/netfilter/ebtables.c:1440)\n do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)\n nf_setsockopt (net/netfilter/nf_sockopt.c:101)\n ip_setsockopt (net/ipv4/ip_sockglue.c:1424)\n raw_setsockopt (net/ipv4/raw.c:847)\n __sys_setsockopt (net/socket.c:2393)\n ...\n\ncompat_do_replace() shares the same unterminated name via\ncompat_copy_ebt_replace_from_user(); terminate it there too so all\nfind_table_lock() callers behave alike. The other callers already\nterminate the name after the copy."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached through a local setsockopt() call into the legacy ebtables interface, not through received network traffic.\nAC:L - The attacker directly supplies a nonterminated table name and guarantees a lookup miss without racing or relying on conditions outside their control.\nPR:L - The path requires CAP_NET_ADMIN in the socket\u0027s network namespace, which an unprivileged user can obtain using a new user and network namespace.\nUI:N - No action by another user is required after the attacker invokes the crafted setsockopt() operation.\nS:U - The over-read affects the same host kernel security authority and does not cross a virtualization or comparable security boundary.\nC:H - The unbounded source read can copy kernel-stack contents into the generated module name, potentially exposing sensitive kernel data.\nI:N - The flaw performs an out-of-bounds read only; the destination formatting is bounded and no attacker-controlled write or memory corruption occurs.\nA:H - The unbounded scan can reach an unmapped stack boundary and cause an oops or panic, as supported by the demonstrated KASAN stack-out-of-bounds failure."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:10.076Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4c046ca4e35a83ea32f6e748f54139f5fe2a1d01"
},
{
"url": "https://git.kernel.org/stable/c/ab63ccefb9c71627f957a0724c2b9ebc869c6f20"
},
{
"url": "https://git.kernel.org/stable/c/c6f539311e58e76aa96feef0f1572b13a564f8a2"
},
{
"url": "https://git.kernel.org/stable/c/2664f537ca5bcb2ef3fac2683dcca602e51fad24"
},
{
"url": "https://git.kernel.org/stable/c/7436da6c1bc44654b7f11a17e746f6999fd37250"
},
{
"url": "https://git.kernel.org/stable/c/6fe8d3cecd20bfaaaf440db3a06ba674d2f2e322"
},
{
"url": "https://git.kernel.org/stable/c/b6183b1b88a722b6d8ea0cecc99eba168a15e0be"
},
{
"url": "https://git.kernel.org/stable/c/a622d2e9608c9dff47fc2e5759ac7aa3a836b45d"
}
],
"title": "netfilter: ebtables: terminate table name before find_table_lock()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64411",
"datePublished": "2026-07-25T08:50:52.143Z",
"dateReserved": "2026-07-19T15:36:31.786Z",
"dateUpdated": "2026-10-19T20:38:27.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64332 (GCVE-0-2026-64332)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-08-17 04:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: ulpi: fix memory leak on registration failure
The allocated device name is never freed on early ULPI device
registration failures.
Fix this by initialising the device structure earlier and releasing the
initial reference whenever registration fails.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f Version: 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f Version: 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f Version: 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f Version: 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f Version: 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f Version: 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f Version: 289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/common/ulpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d5b32f36c50894ac2df8fa184e6f35f3a6665ecd",
"status": "affected",
"version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f",
"versionType": "git"
},
{
"lessThan": "691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0",
"status": "affected",
"version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f",
"versionType": "git"
},
{
"lessThan": "88187a43135c79d0e43573b4d8f880bbb919eceb",
"status": "affected",
"version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f",
"versionType": "git"
},
{
"lessThan": "5c098f20f15db7f9126129686d1c6da2ce8bbeb0",
"status": "affected",
"version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f",
"versionType": "git"
},
{
"lessThan": "624c57147df1977e0d3da53f1da7117861b9cf19",
"status": "affected",
"version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f",
"versionType": "git"
},
{
"lessThan": "1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04",
"status": "affected",
"version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f",
"versionType": "git"
},
{
"lessThan": "e5493c9a98ffe083acf13ac064828ae598ba3c16",
"status": "affected",
"version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f",
"versionType": "git"
},
{
"lessThan": "8af6812795869a66e9b26044f455b13deecdb69c",
"status": "affected",
"version": "289fcff4bcdb1dcc0ce8788b7ea0f58a9e4a495f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/common/ulpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: ulpi: fix memory leak on registration failure\n\nThe allocated device name is never freed on early ULPI device\nregistration failures.\n\nFix this by initialising the device structure earlier and releasing the\ninitial reference whenever registration fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:35.002Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d5b32f36c50894ac2df8fa184e6f35f3a6665ecd"
},
{
"url": "https://git.kernel.org/stable/c/691e61e5d4cfc5a1b061e937f8cbf2126bfc19a0"
},
{
"url": "https://git.kernel.org/stable/c/88187a43135c79d0e43573b4d8f880bbb919eceb"
},
{
"url": "https://git.kernel.org/stable/c/5c098f20f15db7f9126129686d1c6da2ce8bbeb0"
},
{
"url": "https://git.kernel.org/stable/c/624c57147df1977e0d3da53f1da7117861b9cf19"
},
{
"url": "https://git.kernel.org/stable/c/1967a7f0cd5c08eb479196daa5aaa4b7b7a7bd04"
},
{
"url": "https://git.kernel.org/stable/c/e5493c9a98ffe083acf13ac064828ae598ba3c16"
},
{
"url": "https://git.kernel.org/stable/c/8af6812795869a66e9b26044f455b13deecdb69c"
}
],
"title": "USB: ulpi: fix memory leak on registration failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64332",
"datePublished": "2026-07-25T08:49:59.005Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:35.002Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74278 (GCVE-0-2026-74278)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Fix kernel heap address leak in bounce_error_event()
The comment above bounce_error_event() documents that user clients
should receive SNDRV_SEQ_EVENT_BOUNCE with the original event embedded
as variable-length data, while kernel clients should receive
SNDRV_SEQ_EVENT_KERNEL_ERROR with a quoted kernel pointer.
However, the implementation unconditionally uses
SNDRV_SEQ_EVENT_KERNEL_ERROR with data.quote.event set to the raw
struct snd_seq_event pointer for all clients. When a bounce error
event is delivered to a USER_CLIENT via snd_seq_read(), the kernel
heap address in data.quote.event is exposed to userspace through
copy_to_user() in the fixed-length branch.
This is a distinct leak path from the one addressed by commit
705dd6dcbc0e ("ALSA: seq: Clear variable event pointer on read"),
which sanitizes data.ext.ptr in the variable-length branch of
snd_seq_read(). The bounce_error_event() leak uses fixed-length
events that take the else branch where no sanitization occurs.
Differentiate the bounce event by client type. For USER_CLIENT,
send SNDRV_SEQ_EVENT_BOUNCE with SNDRV_SEQ_EVENT_LENGTH_VARIABLE
and data.ext pointing to the original event. The variable-length
path in snd_seq_event_dup() copies the event data into chained
cells, and snd_seq_expand_var_event() copies only the content --
never the pointer -- to userspace. For KERNEL_CLIENT, keep the
existing SNDRV_SEQ_EVENT_KERNEL_ERROR behavior with the quoted
pointer.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/seq/seq_clientmgr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eae296065ede41a24040e6a7c909ec970f78b4eb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "93d260ce43a81df579c98bee92b91316df9c1c57",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "dae23c545eb5a2be3b27a82fd0f611894fb8ab69",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0527a56cb327021cb73167cfddf0e49efa043500",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "efc86691e4d8083d9e380ea95042c2cf679f65fd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/seq/seq_clientmgr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: Fix kernel heap address leak in bounce_error_event()\n\nThe comment above bounce_error_event() documents that user clients\nshould receive SNDRV_SEQ_EVENT_BOUNCE with the original event embedded\nas variable-length data, while kernel clients should receive\nSNDRV_SEQ_EVENT_KERNEL_ERROR with a quoted kernel pointer.\n\nHowever, the implementation unconditionally uses\nSNDRV_SEQ_EVENT_KERNEL_ERROR with data.quote.event set to the raw\nstruct snd_seq_event pointer for all clients. When a bounce error\nevent is delivered to a USER_CLIENT via snd_seq_read(), the kernel\nheap address in data.quote.event is exposed to userspace through\ncopy_to_user() in the fixed-length branch.\n\nThis is a distinct leak path from the one addressed by commit\n705dd6dcbc0e (\"ALSA: seq: Clear variable event pointer on read\"),\nwhich sanitizes data.ext.ptr in the variable-length branch of\nsnd_seq_read(). The bounce_error_event() leak uses fixed-length\nevents that take the else branch where no sanitization occurs.\n\nDifferentiate the bounce event by client type. For USER_CLIENT,\nsend SNDRV_SEQ_EVENT_BOUNCE with SNDRV_SEQ_EVENT_LENGTH_VARIABLE\nand data.ext pointing to the original event. The variable-length\npath in snd_seq_event_dup() copies the event data into chained\ncells, and snd_seq_expand_var_event() copies only the content --\nnever the pointer -- to userspace. For KERNEL_CLIENT, keep the\nexisting SNDRV_SEQ_EVENT_KERNEL_ERROR behavior with the quoted\npointer."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:16.258Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eae296065ede41a24040e6a7c909ec970f78b4eb"
},
{
"url": "https://git.kernel.org/stable/c/93d260ce43a81df579c98bee92b91316df9c1c57"
},
{
"url": "https://git.kernel.org/stable/c/dae23c545eb5a2be3b27a82fd0f611894fb8ab69"
},
{
"url": "https://git.kernel.org/stable/c/0527a56cb327021cb73167cfddf0e49efa043500"
},
{
"url": "https://git.kernel.org/stable/c/efc86691e4d8083d9e380ea95042c2cf679f65fd"
}
],
"title": "ALSA: seq: Fix kernel heap address leak in bounce_error_event()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74278",
"datePublished": "2026-08-15T05:57:49.475Z",
"dateReserved": "2026-08-15T05:44:03.880Z",
"dateUpdated": "2026-10-21T12:45:16.258Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43116 (GCVE-0-2026-43116)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-10-19 19:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ctnetlink: ensure safe access to master conntrack
Holding reference on the expectation is not sufficient, the master
conntrack object can just go away, making exp->master invalid.
To access exp->master safely:
- Grab the nf_conntrack_expect_lock, this gets serialized with
clean_from_lists() which also holds this lock when the master
conntrack goes away.
- Hold reference on master conntrack via nf_conntrack_find_get().
Not so easy since the master tuple to look up for the master conntrack
is not available in the existing problematic paths.
This patch goes for extending the nf_conntrack_expect_lock section
to address this issue for simplicity, in the cases that are described
below this is just slightly extending the lock section.
The add expectation command already holds a reference to the master
conntrack from ctnetlink_create_expect().
However, the delete expectation command needs to grab the spinlock
before looking up for the expectation. Expand the existing spinlock
section to address this to cover the expectation lookup. Note that,
the nf_ct_expect_iterate_net() calls already grabs the spinlock while
iterating over the expectation table, which is correct.
The get expectation command needs to grab the spinlock to ensure master
conntrack does not go away. This also expands the existing spinlock
section to cover the expectation lookup too. I needed to move the
netlink skb allocation out of the spinlock to keep it GFP_KERNEL.
For the expectation events, the IPEXP_DESTROY event is already delivered
under the spinlock, just move the delivery of IPEXP_NEW under the
spinlock too because the master conntrack event cache is reached through
exp->master.
While at it, add lockdep notations to help identify what codepaths need
to grab the spinlock.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c1d10adb4a521de5760112853f42aaeefcec96eb Version: c1d10adb4a521de5760112853f42aaeefcec96eb Version: c1d10adb4a521de5760112853f42aaeefcec96eb Version: c1d10adb4a521de5760112853f42aaeefcec96eb Version: c1d10adb4a521de5760112853f42aaeefcec96eb Version: c1d10adb4a521de5760112853f42aaeefcec96eb |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:19:14.625Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43116",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:14:47.387968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:06:14.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_conntrack_core.h",
"net/netfilter/nf_conntrack_ecache.c",
"net/netfilter/nf_conntrack_expect.c",
"net/netfilter/nf_conntrack_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9e1196d27ef496f404c76f7a9d03761142d991c4",
"status": "affected",
"version": "c1d10adb4a521de5760112853f42aaeefcec96eb",
"versionType": "git"
},
{
"lessThan": "5e1c1d22268ae710c238342c8030c21daf298168",
"status": "affected",
"version": "c1d10adb4a521de5760112853f42aaeefcec96eb",
"versionType": "git"
},
{
"lessThan": "d52fa1fa7440676b8c238037a050ab008c22737f",
"status": "affected",
"version": "c1d10adb4a521de5760112853f42aaeefcec96eb",
"versionType": "git"
},
{
"lessThan": "f338ced0473849c9f6ed0b77ca99f1aab5826787",
"status": "affected",
"version": "c1d10adb4a521de5760112853f42aaeefcec96eb",
"versionType": "git"
},
{
"lessThan": "497f99b26fffdc5635706d1b4811f1ed8ee21a5b",
"status": "affected",
"version": "c1d10adb4a521de5760112853f42aaeefcec96eb",
"versionType": "git"
},
{
"lessThan": "bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5",
"status": "affected",
"version": "c1d10adb4a521de5760112853f42aaeefcec96eb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_conntrack_core.h",
"net/netfilter/nf_conntrack_ecache.c",
"net/netfilter/nf_conntrack_expect.c",
"net/netfilter/nf_conntrack_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.16"
},
{
"lessThan": "2.6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: ensure safe access to master conntrack\n\nHolding reference on the expectation is not sufficient, the master\nconntrack object can just go away, making exp-\u003emaster invalid.\n\nTo access exp-\u003emaster safely:\n\n- Grab the nf_conntrack_expect_lock, this gets serialized with\n clean_from_lists() which also holds this lock when the master\n conntrack goes away.\n\n- Hold reference on master conntrack via nf_conntrack_find_get().\n Not so easy since the master tuple to look up for the master conntrack\n is not available in the existing problematic paths.\n\nThis patch goes for extending the nf_conntrack_expect_lock section\nto address this issue for simplicity, in the cases that are described\nbelow this is just slightly extending the lock section.\n\nThe add expectation command already holds a reference to the master\nconntrack from ctnetlink_create_expect().\n\nHowever, the delete expectation command needs to grab the spinlock\nbefore looking up for the expectation. Expand the existing spinlock\nsection to address this to cover the expectation lookup. Note that,\nthe nf_ct_expect_iterate_net() calls already grabs the spinlock while\niterating over the expectation table, which is correct.\n\nThe get expectation command needs to grab the spinlock to ensure master\nconntrack does not go away. This also expands the existing spinlock\nsection to cover the expectation lookup too. I needed to move the\nnetlink skb allocation out of the spinlock to keep it GFP_KERNEL.\n\nFor the expectation events, the IPEXP_DESTROY event is already delivered\nunder the spinlock, just move the delivery of IPEXP_NEW under the\nspinlock too because the master conntrack event cache is reached through\nexp-\u003emaster.\n\nWhile at it, add lockdep notations to help identify what codepaths need\nto grab the spinlock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable ctnetlink expectation operations are reached through NETLINK_NETFILTER messages from local userspace, not directly by remote packets.\nAC:L - The race is between attacker-driven ctnetlink expectation lookup/dump/delete and attacker-driven master conntrack deletion or timeout, so the attacker can create and retry both sides.\nPR:L - nfnetlink requires CAP_NET_ADMIN in the target network namespace, and an unprivileged local user can reasonably obtain that via a user plus network namespace on affected deployments.\nUI:N - No victim action is required after the attacker can send the netlink requests.\nS:U - This is a kernel memory safety issue within the same host security authority and does not cross a VM, IOMMU, or similar scope boundary.\nC:H - The bug is a use-after-free of the master struct nf_conn reachable from a retained expectation, and kernel UAFs can be leveraged for disclosure of sensitive kernel memory.\nI:H - The stale master pointer is kernel heap memory corruption/use-after-free, which is defensibly exploitable for control-flow or data modification with heap grooming.\nA:H - Even without full exploitation, dereferencing the freed master conntrack can trigger a kernel oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:02.836Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9e1196d27ef496f404c76f7a9d03761142d991c4"
},
{
"url": "https://git.kernel.org/stable/c/5e1c1d22268ae710c238342c8030c21daf298168"
},
{
"url": "https://git.kernel.org/stable/c/d52fa1fa7440676b8c238037a050ab008c22737f"
},
{
"url": "https://git.kernel.org/stable/c/f338ced0473849c9f6ed0b77ca99f1aab5826787"
},
{
"url": "https://git.kernel.org/stable/c/497f99b26fffdc5635706d1b4811f1ed8ee21a5b"
},
{
"url": "https://git.kernel.org/stable/c/bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5"
}
],
"title": "netfilter: ctnetlink: ensure safe access to master conntrack",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43116",
"datePublished": "2026-05-06T07:40:41.185Z",
"dateReserved": "2026-05-01T14:12:55.986Z",
"dateUpdated": "2026-10-19T19:06:14.222Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68117 (GCVE-0-2026-68117)
Vulnerability from cvelistv5
Published
2026-08-10 11:58
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
When tipc_sk_create() fails to insert the new socket (tipc_sk_insert()
returns non-zero), its error path frees the sk with sk_free() but leaves
sock->sk pointing at the freed object:
if (tipc_sk_insert(tsk)) {
sk_free(sk);
pr_warn("Socket create failed; port number exhausted\n");
return -EINVAL;
}
This is harmless for plain socket(): the syscall layer clears sock->ops
before releasing, so tipc_release() is never called. It is not harmless
on the accept() path. tipc_accept() creates the pre-allocated child
socket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves
new_sock->sk dangling and new_sock->ops non-NULL, and do_accept() then
fput()s the new file, so __sock_release() -> tipc_release() runs
lock_sock(new_sock->sk) on the freed sk -- a use-after-free write of the
sk_lock spinlock.
tipc_release() already guards this exact "failed accept() releases a
pre-allocated child" case with "if (sk == NULL) return 0;", but the
guard is bypassed because tipc_sk_create() left sock->sk non-NULL
(dangling) rather than NULL.
Clear sock->sk on the failed-insert path so the existing tipc_release()
NULL check fires and the use-after-free is avoided.
The tipc_sk_insert() failure is reached when the per-netns socket
rhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M
elements) -- i.e. once a netns holds ~2M TIPC sockets every insert
returns -E2BIG.
BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)
Write of size 8 at addr ffff8880047cdc38 by task init/1
lock_sock_nested (net/core/sock.c:3839)
tipc_release (net/tipc/socket.c:638)
__sock_release (net/socket.c:710)
sock_close (net/socket.c:1501)
__fput (fs/file_table.c:512)
Allocated by task 1:
sk_alloc (net/core/sock.c:2308)
tipc_sk_create (net/tipc/socket.c:487)
tipc_accept (net/tipc/socket.c:2744)
do_accept (net/socket.c:2034)
Freed by task 1:
__sk_destruct (net/core/sock.c:2391)
tipc_sk_create (net/tipc/socket.c:504)
tipc_accept (net/tipc/socket.c:2744)
do_accept (net/socket.c:2034)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: efa78f2ae363428525fb4981bb63c555ee79f3c7 Version: 833ecd0eae76eadf81d6d747bb5bc992d1151867 Version: 00aff3590fc0a73bddd3b743863c14e76fd35c0c Version: 00aff3590fc0a73bddd3b743863c14e76fd35c0c Version: 00aff3590fc0a73bddd3b743863c14e76fd35c0c Version: 00aff3590fc0a73bddd3b743863c14e76fd35c0c Version: 00aff3590fc0a73bddd3b743863c14e76fd35c0c Version: 00aff3590fc0a73bddd3b743863c14e76fd35c0c Version: 638fa20b618b2bbcf86da71231624cc82121a036 Version: 7bc9e7f70bc57d8f02ffea2a42094281effb15ef Version: ef488669b2652bde5b6ee5a409a5b048a2a50db4 Version: 4919d82f7041157a421ca9bf39a78551d5ad8a1b Version: 3b2957fc09fe1ac7f07f40dd50dd5f93e3f3a7a2 Version: 5.10.132 ≤ Version: 5.15.56 ≤ Version: 4.9.324 ≤ Version: 4.14.289 ≤ Version: 4.19.253 ≤ Version: 5.4.207 ≤ Version: 5.18.13 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68117",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:44:06.454287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:51.459Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "efebc23e9b29e3e5a9e2127dd066929f7f0d315e",
"status": "affected",
"version": "efa78f2ae363428525fb4981bb63c555ee79f3c7",
"versionType": "git"
},
{
"lessThan": "8d6f26d48e61ef34f1921289401dbf36b10816af",
"status": "affected",
"version": "833ecd0eae76eadf81d6d747bb5bc992d1151867",
"versionType": "git"
},
{
"lessThan": "82f59aa27f33bd014a7d8739371ab5712d15e33b",
"status": "affected",
"version": "00aff3590fc0a73bddd3b743863c14e76fd35c0c",
"versionType": "git"
},
{
"lessThan": "b07d87b31631edb6529e6cdcca790a7489d1250d",
"status": "affected",
"version": "00aff3590fc0a73bddd3b743863c14e76fd35c0c",
"versionType": "git"
},
{
"lessThan": "dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea",
"status": "affected",
"version": "00aff3590fc0a73bddd3b743863c14e76fd35c0c",
"versionType": "git"
},
{
"lessThan": "5f5a41a48dbf9eda57b67ce23e548602cf7195a6",
"status": "affected",
"version": "00aff3590fc0a73bddd3b743863c14e76fd35c0c",
"versionType": "git"
},
{
"lessThan": "f9596b1566616a8be0592dbceccb6344a7c6f6bb",
"status": "affected",
"version": "00aff3590fc0a73bddd3b743863c14e76fd35c0c",
"versionType": "git"
},
{
"lessThan": "ba0533fc163f905fe817cfabdf8ed4058da44800",
"status": "affected",
"version": "00aff3590fc0a73bddd3b743863c14e76fd35c0c",
"versionType": "git"
},
{
"status": "affected",
"version": "638fa20b618b2bbcf86da71231624cc82121a036",
"versionType": "git"
},
{
"status": "affected",
"version": "7bc9e7f70bc57d8f02ffea2a42094281effb15ef",
"versionType": "git"
},
{
"status": "affected",
"version": "ef488669b2652bde5b6ee5a409a5b048a2a50db4",
"versionType": "git"
},
{
"status": "affected",
"version": "4919d82f7041157a421ca9bf39a78551d5ad8a1b",
"versionType": "git"
},
{
"status": "affected",
"version": "3b2957fc09fe1ac7f07f40dd50dd5f93e3f3a7a2",
"versionType": "git"
},
{
"lessThan": "5.10.265",
"status": "affected",
"version": "5.10.132",
"versionType": "semver"
},
{
"lessThan": "5.15.216",
"status": "affected",
"version": "5.15.56",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.324",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.289",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.253",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.207",
"versionType": "semver"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10.132",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15.56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.324",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.289",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.207",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create()\n\nWhen tipc_sk_create() fails to insert the new socket (tipc_sk_insert()\nreturns non-zero), its error path frees the sk with sk_free() but leaves\nsock-\u003esk pointing at the freed object:\n\n\tif (tipc_sk_insert(tsk)) {\n\t\tsk_free(sk);\n\t\tpr_warn(\"Socket create failed; port number exhausted\\n\");\n\t\treturn -EINVAL;\n\t}\n\nThis is harmless for plain socket(): the syscall layer clears sock-\u003eops\nbefore releasing, so tipc_release() is never called. It is not harmless\non the accept() path. tipc_accept() creates the pre-allocated child\nsocket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves\nnew_sock-\u003esk dangling and new_sock-\u003eops non-NULL, and do_accept() then\nfput()s the new file, so __sock_release() -\u003e tipc_release() runs\nlock_sock(new_sock-\u003esk) on the freed sk -- a use-after-free write of the\nsk_lock spinlock.\n\ntipc_release() already guards this exact \"failed accept() releases a\npre-allocated child\" case with \"if (sk == NULL) return 0;\", but the\nguard is bypassed because tipc_sk_create() left sock-\u003esk non-NULL\n(dangling) rather than NULL.\n\nClear sock-\u003esk on the failed-insert path so the existing tipc_release()\nNULL check fires and the use-after-free is avoided.\n\nThe tipc_sk_insert() failure is reached when the per-netns socket\nrhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M\nelements) -- i.e. once a netns holds ~2M TIPC sockets every insert\nreturns -E2BIG.\n\n BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)\n Write of size 8 at addr ffff8880047cdc38 by task init/1\n lock_sock_nested (net/core/sock.c:3839)\n tipc_release (net/tipc/socket.c:638)\n __sock_release (net/socket.c:710)\n sock_close (net/socket.c:1501)\n __fput (fs/file_table.c:512)\n Allocated by task 1:\n sk_alloc (net/core/sock.c:2308)\n tipc_sk_create (net/tipc/socket.c:487)\n tipc_accept (net/tipc/socket.c:2744)\n do_accept (net/socket.c:2034)\n Freed by task 1:\n __sk_destruct (net/core/sock.c:2391)\n tipc_sk_create (net/tipc/socket.c:504)\n tipc_accept (net/tipc/socket.c:2744)\n do_accept (net/socket.c:2034)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is hit in tipc_accept() when a listening SOCK_STREAM/SOCK_SEQPACKET socket accepts an incoming TIPC connection; peers reach this path over default UDP/Ethernet bearers (e.g. UDP/6118) without local syscall access.\nAC:L - An attacker can deterministically fill the per-netns TIPC socket rhashtable (~2M entries) by opening many sockets or connections, then trigger the failed-insert accept() cleanup path that performs lock_sock() on the freed sk.\nPR:N - No elevated Linux capabilities are required to create AF_TIPC stream/seqpacket sockets or send unauthenticated TIPC SYN traffic to a listening cluster service; only LSM policy may restrict access.\nUI:N - Exploitation needs no end-user action beyond a server\u2019s normal accept() loop processing inbound TIPC connection requests queued by the network stack.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security domain; impact is kernel privilege escalation or crash, not a VM/hypervisor or IOMMU boundary crossing.\nC:H - tipc_release() calls lock_sock() on a freed struct sock, a slab use-after-free that can be groomed for arbitrary kernel memory disclosure via controlled reuse of the freed socket object.\nI:H - The UAF performs an 8-byte write to sk_lock on freed memory during socket teardown, enabling heap corruption and potential arbitrary kernel write or code execution primitives.\nA:H - KASAN reports slab-use-after-free in lock_sock_nested during tipc_release on the failed accept() path, causing kernel oops/panic and denial of service even without full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:29.277Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/efebc23e9b29e3e5a9e2127dd066929f7f0d315e"
},
{
"url": "https://git.kernel.org/stable/c/8d6f26d48e61ef34f1921289401dbf36b10816af"
},
{
"url": "https://git.kernel.org/stable/c/82f59aa27f33bd014a7d8739371ab5712d15e33b"
},
{
"url": "https://git.kernel.org/stable/c/b07d87b31631edb6529e6cdcca790a7489d1250d"
},
{
"url": "https://git.kernel.org/stable/c/dd29891ed840f6b8d020b759d0dc4a00b1d6e4ea"
},
{
"url": "https://git.kernel.org/stable/c/5f5a41a48dbf9eda57b67ce23e548602cf7195a6"
},
{
"url": "https://git.kernel.org/stable/c/f9596b1566616a8be0592dbceccb6344a7c6f6bb"
},
{
"url": "https://git.kernel.org/stable/c/ba0533fc163f905fe817cfabdf8ed4058da44800"
}
],
"title": "tipc: clear sock-\u003esk on the failed-insert path in tipc_sk_create()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68117",
"datePublished": "2026-08-10T11:58:36.675Z",
"dateReserved": "2026-07-30T09:28:09.369Z",
"dateUpdated": "2026-10-19T20:58:51.459Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68325 (GCVE-0-2026-68325)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-08-19 16:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Bound the early ACPI HID map
The ivrs_acpihid command-line parser appends entries to a fixed
four-element early_acpihid_map array. Unlike the sibling IOAPIC and HPET
parsers, it does not reject a fifth entry before incrementing the map size.
Check the capacity at the common found label before parsing the HID and
UID or writing the entry.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ca3bf5d47cec8b7614bcb2e9132c40081d6d81db Version: ca3bf5d47cec8b7614bcb2e9132c40081d6d81db Version: ca3bf5d47cec8b7614bcb2e9132c40081d6d81db Version: ca3bf5d47cec8b7614bcb2e9132c40081d6d81db Version: ca3bf5d47cec8b7614bcb2e9132c40081d6d81db Version: ca3bf5d47cec8b7614bcb2e9132c40081d6d81db Version: ca3bf5d47cec8b7614bcb2e9132c40081d6d81db Version: ca3bf5d47cec8b7614bcb2e9132c40081d6d81db |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9ae6b1b972ce01d3316c8a5f7f58c8b3668cc6bb",
"status": "affected",
"version": "ca3bf5d47cec8b7614bcb2e9132c40081d6d81db",
"versionType": "git"
},
{
"lessThan": "e5e0098f8cd82f8b3c8687a8f686309565d51745",
"status": "affected",
"version": "ca3bf5d47cec8b7614bcb2e9132c40081d6d81db",
"versionType": "git"
},
{
"lessThan": "afe7ea0520c49586703f210865ace2d70b017e48",
"status": "affected",
"version": "ca3bf5d47cec8b7614bcb2e9132c40081d6d81db",
"versionType": "git"
},
{
"lessThan": "1e31d2394e0db69541b1591d46c5ad6431c81db3",
"status": "affected",
"version": "ca3bf5d47cec8b7614bcb2e9132c40081d6d81db",
"versionType": "git"
},
{
"lessThan": "abe5d7962f09adada9c4fb25b816dddd3f97c55d",
"status": "affected",
"version": "ca3bf5d47cec8b7614bcb2e9132c40081d6d81db",
"versionType": "git"
},
{
"lessThan": "e5ebe8544df1a1c3611739a8622156094fe470df",
"status": "affected",
"version": "ca3bf5d47cec8b7614bcb2e9132c40081d6d81db",
"versionType": "git"
},
{
"lessThan": "030a8e84f8f1b6e96f469c84a13a225c3699910b",
"status": "affected",
"version": "ca3bf5d47cec8b7614bcb2e9132c40081d6d81db",
"versionType": "git"
},
{
"lessThan": "fb80117fddb5b477218dc99bb53911b72c3847f8",
"status": "affected",
"version": "ca3bf5d47cec8b7614bcb2e9132c40081d6d81db",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Bound the early ACPI HID map\n\nThe ivrs_acpihid command-line parser appends entries to a fixed\nfour-element early_acpihid_map array. Unlike the sibling IOAPIC and HPET\nparsers, it does not reject a fifth entry before incrementing the map size.\n\nCheck the capacity at the common found label before parsing the HID and\nUID or writing the entry."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:33:18.080Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9ae6b1b972ce01d3316c8a5f7f58c8b3668cc6bb"
},
{
"url": "https://git.kernel.org/stable/c/e5e0098f8cd82f8b3c8687a8f686309565d51745"
},
{
"url": "https://git.kernel.org/stable/c/afe7ea0520c49586703f210865ace2d70b017e48"
},
{
"url": "https://git.kernel.org/stable/c/1e31d2394e0db69541b1591d46c5ad6431c81db3"
},
{
"url": "https://git.kernel.org/stable/c/abe5d7962f09adada9c4fb25b816dddd3f97c55d"
},
{
"url": "https://git.kernel.org/stable/c/e5ebe8544df1a1c3611739a8622156094fe470df"
},
{
"url": "https://git.kernel.org/stable/c/030a8e84f8f1b6e96f469c84a13a225c3699910b"
},
{
"url": "https://git.kernel.org/stable/c/fb80117fddb5b477218dc99bb53911b72c3847f8"
}
],
"title": "iommu/amd: Bound the early ACPI HID map",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68325",
"datePublished": "2026-08-10T12:03:01.384Z",
"dateReserved": "2026-07-30T09:28:09.382Z",
"dateUpdated": "2026-08-19T16:33:18.080Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64047 (GCVE-0-2026-64047)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
When an sk_msg scatterlist ring wraps (sg.end < sg.start),
tls_push_record() chains the tail portion of the ring to the head
using sg_chain(). An extra entry in the sg array is reserved for
this:
struct sk_msg_sg {
[...]
/* The extra two elements:
* 1) used for chaining the front and sections when the list becomes
* partitioned (e.g. end < start). The crypto APIs require the
* chaining;
* 2) to chain tailer SG entries after the message.
*/
struct scatterlist data[MAX_MSG_FRAGS + 2];
The current code uses MAX_SKB_FRAGS + 1 as the ring size:
sg_chain(&msg_pl->sg.data[msg_pl->sg.start],
MAX_SKB_FRAGS - msg_pl->sg.start + 1,
msg_pl->sg.data);
This places the chain pointer at
sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. =
&data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 =
data[start + (MAX_SKB_FRAGS - start + 1) - 1] =
data[MAX_SKB_FRAGS]
instead of the true last entry. This is likely due to a "race" of
the commit under Fixes landing close to
commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down")
Convert to ARRAY_SIZE and drop the data[start] / - start (as suggested
by Sabrina).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9aaaa56845a06aeabdd597cbe19492dc01f281ec Version: 9aaaa56845a06aeabdd597cbe19492dc01f281ec Version: 9aaaa56845a06aeabdd597cbe19492dc01f281ec Version: 9aaaa56845a06aeabdd597cbe19492dc01f281ec Version: 9aaaa56845a06aeabdd597cbe19492dc01f281ec Version: 9aaaa56845a06aeabdd597cbe19492dc01f281ec Version: 9aaaa56845a06aeabdd597cbe19492dc01f281ec Version: 9aaaa56845a06aeabdd597cbe19492dc01f281ec Version: d529d6c9f7e3aaeac13c4948f79799ccb825f29d Version: 5.4.14 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64047",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:54.546412Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:10.717Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "73963a375885d5ccb7def39fd0b4f542e0f343dd",
"status": "affected",
"version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
"versionType": "git"
},
{
"lessThan": "47110c3a9ac247b688657337f5981efcfcb240dc",
"status": "affected",
"version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
"versionType": "git"
},
{
"lessThan": "84158c2997159df4a0d70cd9c46774512d32a522",
"status": "affected",
"version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
"versionType": "git"
},
{
"lessThan": "131ef12057d92b77b636321b7849c69222405a97",
"status": "affected",
"version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
"versionType": "git"
},
{
"lessThan": "66339b71f105e6f83e0da3b9583d95077534fe1d",
"status": "affected",
"version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
"versionType": "git"
},
{
"lessThan": "eca989eab4b2599dcb02f72140a7c08f08838520",
"status": "affected",
"version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
"versionType": "git"
},
{
"lessThan": "2fb0dc7e0099686c4e9d2732745d8a31b18c3628",
"status": "affected",
"version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
"versionType": "git"
},
{
"lessThan": "285943c6e7ca309bbea84b253745154241d9788a",
"status": "affected",
"version": "9aaaa56845a06aeabdd597cbe19492dc01f281ec",
"versionType": "git"
},
{
"status": "affected",
"version": "d529d6c9f7e3aaeac13c4948f79799ccb825f29d",
"versionType": "git"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring\n\nWhen an sk_msg scatterlist ring wraps (sg.end \u003c sg.start),\ntls_push_record() chains the tail portion of the ring to the head\nusing sg_chain(). An extra entry in the sg array is reserved for\nthis:\n\n struct sk_msg_sg {\n [...]\n /* The extra two elements:\n * 1) used for chaining the front and sections when the list becomes\n * partitioned (e.g. end \u003c start). The crypto APIs require the\n * chaining;\n * 2) to chain tailer SG entries after the message.\n */\n struct scatterlist data[MAX_MSG_FRAGS + 2];\n\nThe current code uses MAX_SKB_FRAGS + 1 as the ring size:\n\n sg_chain(\u0026msg_pl-\u003esg.data[msg_pl-\u003esg.start],\n MAX_SKB_FRAGS - msg_pl-\u003esg.start + 1,\n msg_pl-\u003esg.data);\n\nThis places the chain pointer at\n\n sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. =\n \u0026data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 =\n data[start + (MAX_SKB_FRAGS - start + 1) - 1] =\n data[MAX_SKB_FRAGS]\n\ninstead of the true last entry. This is likely due to a \"race\" of\nthe commit under Fixes landing close to\ncommit 031097d9e079 (\"bpf: sk_msg, zap ingress queue on psock down\")\n\nConvert to ARRAY_SIZE and drop the data[start] / - start (as suggested\nby Sabrina)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is in kernel TLS (kTLS) software transmit encryption triggered when a TLS socket sends records; remote peers on established TLS connections drive this TX path through normal network I/O.\nAC:L - An attacker who controls connection traffic can reliably create the wrapped sk_msg ring state via BPF sockmap SK_MSG verdict helpers (push/pop/redirect) and then trigger record push on demand.\nPR:N - Exploitation requires no privileges on the target host beyond being a network peer on a kTLS socket with sockmap BPF already configured by the service; attacker capabilities are not needed on the victim system.\nUI:N - Triggering requires only automated server-side TLS transmit activity in response to network input, with no victim user action.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same kernel/host security boundary, not a cross-VM or sandbox escape by itself.\nC:H - Corrupting an active scatterlist entry causes the AEAD crypto path to follow an incorrect chain, enabling out-of-bounds kernel memory reads beyond intended plaintext buffers.\nI:H - The malformed scatterlist passed to crypto_aead_encrypt() can direct encryption I/O to wrong memory regions, providing an out-of-bounds write primitive exploitable for control-flow hijacking.\nA:H - Scatterlist corruption in the kernel crypto TX path can cause kernel oopses, panics, or fatal BUG conditions when invalid chain entries or page pointers are dereferenced."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:39.300Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/73963a375885d5ccb7def39fd0b4f542e0f343dd"
},
{
"url": "https://git.kernel.org/stable/c/47110c3a9ac247b688657337f5981efcfcb240dc"
},
{
"url": "https://git.kernel.org/stable/c/84158c2997159df4a0d70cd9c46774512d32a522"
},
{
"url": "https://git.kernel.org/stable/c/131ef12057d92b77b636321b7849c69222405a97"
},
{
"url": "https://git.kernel.org/stable/c/66339b71f105e6f83e0da3b9583d95077534fe1d"
},
{
"url": "https://git.kernel.org/stable/c/eca989eab4b2599dcb02f72140a7c08f08838520"
},
{
"url": "https://git.kernel.org/stable/c/2fb0dc7e0099686c4e9d2732745d8a31b18c3628"
},
{
"url": "https://git.kernel.org/stable/c/285943c6e7ca309bbea84b253745154241d9788a"
}
],
"title": "net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64047",
"datePublished": "2026-07-19T15:39:31.960Z",
"dateReserved": "2026-07-19T07:54:57.029Z",
"dateUpdated": "2026-10-19T20:28:10.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64005 (GCVE-0-2026-64005)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-19 20:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: Do not re-initialize smc hashtables
INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(),
proto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht
being reset even though hash entries already exist and are being used,
possibly resulting in a corrupted list.
Remove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in
smc_init(); it is implicitly initialised to zero anyhow. Add
HLIST_HEAD_INIT to the definitions for clarity.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 Version: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 Version: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 Version: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 Version: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 Version: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 Version: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 Version: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64005",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:10.431253Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-662",
"description": "CWE-662 Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:18:02.958Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/af_smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cdc79c05cc375f68ae87b0c74fdaac1a5c93155a",
"status": "affected",
"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
"versionType": "git"
},
{
"lessThan": "2006605006e5a4a11d93e1ebdbbe95764d24276f",
"status": "affected",
"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
"versionType": "git"
},
{
"lessThan": "64c96e497d5ada0b90e99bf58f893aa2b73dcfbc",
"status": "affected",
"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
"versionType": "git"
},
{
"lessThan": "ed7a758313011885347b854e97cb95903ef3c3f7",
"status": "affected",
"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
"versionType": "git"
},
{
"lessThan": "0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d",
"status": "affected",
"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
"versionType": "git"
},
{
"lessThan": "55cba6b883b41e5922c00ba9d4e3262131f46f1b",
"status": "affected",
"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
"versionType": "git"
},
{
"lessThan": "5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1",
"status": "affected",
"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
"versionType": "git"
},
{
"lessThan": "9e4389b0038781f19f97895186ed941ff8ac1678",
"status": "affected",
"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/af_smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Do not re-initialize smc hashtables\n\nINIT_HLIST_HEAD(\u0026smc_v*_hashinfo.ht) are called after smc_nl_init(),\nproto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht\nbeing reset even though hash entries already exist and are being used,\npossibly resulting in a corrupted list.\n\nRemove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in\nsmc_init(); it is implicitly initialised to zero anyhow. Add\nHLIST_HEAD_INIT to the definitions for clarity."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires winning a race during SMC module initialization by concurrently calling socket(PF_SMC)/socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) syscalls. The bug is not reachable from remote network packet handling; SMC network upgrade paths operate only after initialization completes.\nAC:L - An attacker controls both sides of the race by spawning concurrent threads that hammer socket creation while another thread triggers SMC module autoload via request_module(\"net-pf-43\") during sock_register(). The vulnerable window between sock_register() and INIT_HLIST_HEAD() is narrow but attacker-driven and repeatable on each module load/reload.\nPR:L - Creating PF_SMC or IPPROTO_SMC sockets requires only an unprivileged local user account; no CAP_NET_ADMIN, CAP_SYS_MODULE, or real root in the initial namespace is needed to participate in the race when module autoload is enabled. Triggering module load may require admin action on hardened systems, but the corrupting socket operations themselves need only basic local privileges.\nUI:N - No victim interaction is required beyond the attacker\u0027s own concurrent socket creation during module initialization; no mount, file open, or other user action is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox escape.\nC:H - Resetting smc_v4/v6_hashinfo.ht after sockets are hashed orphans live sk_node entries; subsequent hlist traversal in smc_diag_dump_proto() or corrupted pointer chasing can read arbitrary kernel memory adjacent to socket structures.\nI:H - Orphaned hlist nodes cause __hlist_del() in smc_unhash_sk() to write through stale pprev/next pointers when corrupted sockets are closed, enabling exploitable kernel heap/list corruption and potential control-flow hijacking.\nA:H - List corruption reliably causes kernel oops or panic when orphaned sockets are unhashed (__hlist_del with NULL next) or when the corrupted hashtable is walked, resulting in complete loss of kernel availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:05.933Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cdc79c05cc375f68ae87b0c74fdaac1a5c93155a"
},
{
"url": "https://git.kernel.org/stable/c/2006605006e5a4a11d93e1ebdbbe95764d24276f"
},
{
"url": "https://git.kernel.org/stable/c/64c96e497d5ada0b90e99bf58f893aa2b73dcfbc"
},
{
"url": "https://git.kernel.org/stable/c/ed7a758313011885347b854e97cb95903ef3c3f7"
},
{
"url": "https://git.kernel.org/stable/c/0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d"
},
{
"url": "https://git.kernel.org/stable/c/55cba6b883b41e5922c00ba9d4e3262131f46f1b"
},
{
"url": "https://git.kernel.org/stable/c/5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1"
},
{
"url": "https://git.kernel.org/stable/c/9e4389b0038781f19f97895186ed941ff8ac1678"
}
],
"title": "net/smc: Do not re-initialize smc hashtables",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64005",
"datePublished": "2026-07-19T14:56:21.608Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-10-19T20:18:02.958Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74271 (GCVE-0-2026-74271)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-08-17 05:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: core: fix supplied_from allocations
If dts property power-supplies has multiple values, then accessing to
psy->supplied_from[i-1] in __power_supply_populate_supplied_from will
overrun supplied_from array.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f6e0b081fb300a4601b064346963cf6bb163f437 Version: f6e0b081fb300a4601b064346963cf6bb163f437 Version: f6e0b081fb300a4601b064346963cf6bb163f437 Version: f6e0b081fb300a4601b064346963cf6bb163f437 Version: f6e0b081fb300a4601b064346963cf6bb163f437 Version: f6e0b081fb300a4601b064346963cf6bb163f437 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/power_supply_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae55e4bf18ee0c4c170797dd65e17dbdf644fcf2",
"status": "affected",
"version": "f6e0b081fb300a4601b064346963cf6bb163f437",
"versionType": "git"
},
{
"lessThan": "23a29ee1d9de38b7d6226b27653bc736b28ff05a",
"status": "affected",
"version": "f6e0b081fb300a4601b064346963cf6bb163f437",
"versionType": "git"
},
{
"lessThan": "fefc9dad30d545be288d50a0b10d00465015fcfe",
"status": "affected",
"version": "f6e0b081fb300a4601b064346963cf6bb163f437",
"versionType": "git"
},
{
"lessThan": "d0503357653ee62188987a26baa2d7f3689f367e",
"status": "affected",
"version": "f6e0b081fb300a4601b064346963cf6bb163f437",
"versionType": "git"
},
{
"lessThan": "14357ba006e1586e4b4e809c074b21baf0aa4c4b",
"status": "affected",
"version": "f6e0b081fb300a4601b064346963cf6bb163f437",
"versionType": "git"
},
{
"lessThan": "ba61aed9a34671222d1149acfc2f0179a9ce7e80",
"status": "affected",
"version": "f6e0b081fb300a4601b064346963cf6bb163f437",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/power_supply_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: core: fix supplied_from allocations\n\nIf dts property power-supplies has multiple values, then accessing to\npsy-\u003esupplied_from[i-1] in __power_supply_populate_supplied_from will\noverrun supplied_from array."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:16:14.971Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae55e4bf18ee0c4c170797dd65e17dbdf644fcf2"
},
{
"url": "https://git.kernel.org/stable/c/23a29ee1d9de38b7d6226b27653bc736b28ff05a"
},
{
"url": "https://git.kernel.org/stable/c/fefc9dad30d545be288d50a0b10d00465015fcfe"
},
{
"url": "https://git.kernel.org/stable/c/d0503357653ee62188987a26baa2d7f3689f367e"
},
{
"url": "https://git.kernel.org/stable/c/14357ba006e1586e4b4e809c074b21baf0aa4c4b"
},
{
"url": "https://git.kernel.org/stable/c/ba61aed9a34671222d1149acfc2f0179a9ce7e80"
}
],
"title": "power: supply: core: fix supplied_from allocations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74271",
"datePublished": "2026-08-15T05:57:44.853Z",
"dateReserved": "2026-08-15T05:44:03.879Z",
"dateUpdated": "2026-08-17T05:16:14.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68363 (GCVE-0-2026-68363)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-08-19 16:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
ath9k_hif_request_firmware() re-arms an asynchronous firmware load via
request_firmware_nowait(), passing hif_dev as the completion context, and
then still dereferences hif_dev:
dev_info(&hif_dev->udev->dev, "ath9k_htc: Firmware %s requested\n",
hif_dev->fw_name);
The re-armed callback ath9k_hif_usb_firmware_cb() runs on the "events"
workqueue and, when the firmware is missing, walks the retry chain into
ath9k_hif_usb_firmware_fail() -> complete_all(&hif_dev->fw_done). That
releases the wait_for_completion(&hif_dev->fw_done) in a concurrent
ath9k_hif_usb_disconnect(), which then kfree()s hif_dev. The trailing
dev_info() in the frame that re-armed the request can therefore read freed
memory (hif_dev->udev, the first field of struct hif_device_usb):
BUG: KASAN: slab-use-after-free in ath9k_hif_request_firmware
Read of size 8 ... by task kworker/...
ath9k_hif_request_firmware
ath9k_hif_usb_firmware_cb drivers/net/wireless/ath/ath9k/hif_usb.c:1247
request_firmware_work_func
Allocated by ...:
ath9k_hif_usb_probe drivers/net/wireless/ath/ath9k/hif_usb.c
Freed by ...:
ath9k_hif_usb_disconnect -> kfree drivers/net/wireless/ath/ath9k/hif_usb.c
The fw_done barrier only makes disconnect wait for the firmware chain to
*terminate*; it does not protect the outer ath9k_hif_request_firmware()
frame that re-armed the request and keeps touching hif_dev afterwards.
Drop the post-request dev_info(): it is the only use of hif_dev after the
async request is armed, and it is purely informational (the dev_err() on the
failure path runs only when request_firmware_nowait() did not arm a callback,
so hif_dev is still alive there).
This was first reported by syzbot as a single, non-reproduced crash that was
later auto-obsoleted, and was independently rediscovered by the reFuzz fuzzer,
which produced a C reproducer (USB-gadget connect/disconnect of an ath9k_htc
device whose firmware download fails). The vulnerable code is unchanged and
still present in v7.1-rc6, where the slab-use-after-free reproduces under KASAN
once the (sub-microsecond) race window is widened.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e904cf6fe23022cde4e0ea9d41601411a315a3dc Version: e904cf6fe23022cde4e0ea9d41601411a315a3dc Version: e904cf6fe23022cde4e0ea9d41601411a315a3dc Version: e904cf6fe23022cde4e0ea9d41601411a315a3dc Version: e904cf6fe23022cde4e0ea9d41601411a315a3dc Version: e904cf6fe23022cde4e0ea9d41601411a315a3dc Version: e904cf6fe23022cde4e0ea9d41601411a315a3dc Version: e904cf6fe23022cde4e0ea9d41601411a315a3dc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath9k/hif_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "47ed81aaa7f94d9808f4719e78a760c2ec1e6c86",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "48de0c6952192b0771fca468df4364d11ec74ad9",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "063497cc9f320ab71a7a937c3bc0a23e630aefe2",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "7f184ca38a90889f3f6665ff96748b95da39dbee",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "10b0ce629123a3737b4eda50188f73bb7be7b68b",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "48a69cedde7388294e4ea6fd804156cd62bc04fc",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "7c9046d92c4b9789c9d9d775e4fd5f34be64cb0a",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
},
{
"lessThan": "dad9f96945d77ecd4708f730c06ef54dcd8cc057",
"status": "affected",
"version": "e904cf6fe23022cde4e0ea9d41601411a315a3dc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath9k/hif_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath9k: hif_usb: don\u0027t dereference hif_dev after re-arming firmware request\n\nath9k_hif_request_firmware() re-arms an asynchronous firmware load via\nrequest_firmware_nowait(), passing hif_dev as the completion context, and\nthen still dereferences hif_dev:\n\n\tdev_info(\u0026hif_dev-\u003eudev-\u003edev, \"ath9k_htc: Firmware %s requested\\n\",\n\t\t hif_dev-\u003efw_name);\n\nThe re-armed callback ath9k_hif_usb_firmware_cb() runs on the \"events\"\nworkqueue and, when the firmware is missing, walks the retry chain into\nath9k_hif_usb_firmware_fail() -\u003e complete_all(\u0026hif_dev-\u003efw_done). That\nreleases the wait_for_completion(\u0026hif_dev-\u003efw_done) in a concurrent\nath9k_hif_usb_disconnect(), which then kfree()s hif_dev. The trailing\ndev_info() in the frame that re-armed the request can therefore read freed\nmemory (hif_dev-\u003eudev, the first field of struct hif_device_usb):\n\n BUG: KASAN: slab-use-after-free in ath9k_hif_request_firmware\n Read of size 8 ... by task kworker/...\n ath9k_hif_request_firmware\n ath9k_hif_usb_firmware_cb drivers/net/wireless/ath/ath9k/hif_usb.c:1247\n request_firmware_work_func\n Allocated by ...:\n ath9k_hif_usb_probe drivers/net/wireless/ath/ath9k/hif_usb.c\n Freed by ...:\n ath9k_hif_usb_disconnect -\u003e kfree drivers/net/wireless/ath/ath9k/hif_usb.c\n\nThe fw_done barrier only makes disconnect wait for the firmware chain to\n*terminate*; it does not protect the outer ath9k_hif_request_firmware()\nframe that re-armed the request and keeps touching hif_dev afterwards.\n\nDrop the post-request dev_info(): it is the only use of hif_dev after the\nasync request is armed, and it is purely informational (the dev_err() on the\nfailure path runs only when request_firmware_nowait() did not arm a callback,\nso hif_dev is still alive there).\n\nThis was first reported by syzbot as a single, non-reproduced crash that was\nlater auto-obsoleted, and was independently rediscovered by the reFuzz fuzzer,\nwhich produced a C reproducer (USB-gadget connect/disconnect of an ath9k_htc\ndevice whose firmware download fails). The vulnerable code is unchanged and\nstill present in v7.1-rc6, where the slab-use-after-free reproduces under KASAN\nonce the (sub-microsecond) race window is widened."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:34:18.694Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/47ed81aaa7f94d9808f4719e78a760c2ec1e6c86"
},
{
"url": "https://git.kernel.org/stable/c/48de0c6952192b0771fca468df4364d11ec74ad9"
},
{
"url": "https://git.kernel.org/stable/c/063497cc9f320ab71a7a937c3bc0a23e630aefe2"
},
{
"url": "https://git.kernel.org/stable/c/7f184ca38a90889f3f6665ff96748b95da39dbee"
},
{
"url": "https://git.kernel.org/stable/c/10b0ce629123a3737b4eda50188f73bb7be7b68b"
},
{
"url": "https://git.kernel.org/stable/c/48a69cedde7388294e4ea6fd804156cd62bc04fc"
},
{
"url": "https://git.kernel.org/stable/c/7c9046d92c4b9789c9d9d775e4fd5f34be64cb0a"
},
{
"url": "https://git.kernel.org/stable/c/dad9f96945d77ecd4708f730c06ef54dcd8cc057"
}
],
"title": "wifi: ath9k: hif_usb: don\u0027t dereference hif_dev after re-arming firmware request",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68363",
"datePublished": "2026-08-10T12:03:40.355Z",
"dateReserved": "2026-07-30T09:28:09.385Z",
"dateUpdated": "2026-08-19T16:34:18.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-35973 (GCVE-0-2024-35973)
Vulnerability from cvelistv5
Published
2024-05-20 09:42
Modified
2026-10-15 00:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
geneve: fix header validation in geneve[6]_xmit_skb
syzbot is able to trigger an uninit-value in geneve_xmit() [1]
Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield())
uses skb_protocol(skb, true), pskb_inet_may_pull() is only using
skb->protocol.
If anything else than ETH_P_IPV6 or ETH_P_IP is found in skb->protocol,
pskb_inet_may_pull() does nothing at all.
If a vlan tag was provided by the caller (af_packet in the syzbot case),
the network header might not point to the correct location, and skb
linear part could be smaller than expected.
Add skb_vlan_inet_prepare() to perform a complete mac validation.
Use this in geneve for the moment, I suspect we need to adopt this
more broadly.
v4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest
- Only call __vlan_get_protocol() for vlan types.
v2,v3 - Addressed Sabrina comments on v1 and v2
[1]
BUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline]
BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030
geneve_xmit_skb drivers/net/geneve.c:910 [inline]
geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030
__netdev_start_xmit include/linux/netdevice.h:4903 [inline]
netdev_start_xmit include/linux/netdevice.h:4917 [inline]
xmit_one net/core/dev.c:3531 [inline]
dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547
__dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335
dev_queue_xmit include/linux/netdevice.h:3091 [inline]
packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276
packet_snd net/packet/af_packet.c:3081 [inline]
packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x30f/0x380 net/socket.c:745
__sys_sendto+0x685/0x830 net/socket.c:2191
__do_sys_sendto net/socket.c:2203 [inline]
__se_sys_sendto net/socket.c:2199 [inline]
__x64_sys_sendto+0x125/0x1d0 net/socket.c:2199
do_syscall_64+0xd5/0x1f0
entry_SYSCALL_64_after_hwframe+0x6d/0x75
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3804 [inline]
slab_alloc_node mm/slub.c:3845 [inline]
kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888
kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577
__alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668
alloc_skb include/linux/skbuff.h:1318 [inline]
alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504
sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795
packet_alloc_skb net/packet/af_packet.c:2930 [inline]
packet_snd net/packet/af_packet.c:3024 [inline]
packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x30f/0x380 net/socket.c:745
__sys_sendto+0x685/0x830 net/socket.c:2191
__do_sys_sendto net/socket.c:2203 [inline]
__se_sys_sendto net/socket.c:2199 [inline]
__x64_sys_sendto+0x125/0x1d0 net/socket.c:2199
do_syscall_64+0xd5/0x1f0
entry_SYSCALL_64_after_hwframe+0x6d/0x75
CPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 35385daa8db320d2d9664930c28e732578b0d7de Version: 6f92124d74419797fadfbcd5b7a72c384a6413ad Version: 71ad9260c001b217d704cda88ecea251b2d367da Version: d13f048dd40e8577260cd43faea8ec9b77520197 Version: d13f048dd40e8577260cd43faea8ec9b77520197 Version: d13f048dd40e8577260cd43faea8ec9b77520197 Version: d13f048dd40e8577260cd43faea8ec9b77520197 Version: d13f048dd40e8577260cd43faea8ec9b77520197 Version: 9a51e36ebf433adf59c051bec33f5aa54640bb4d Version: 21815f28af8081b258552c111774ff320cf38d38 Version: 4.19.191 ≤ Version: 5.4.119 ≤ Version: 5.10.37 ≤ Version: 5.11.21 ≤ Version: 5.12.4 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-35973",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-29T18:16:33.435108Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T19:56:09.359Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:21:49.047Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/43be590456e1f3566054ce78ae2dbb68cbe1a536"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/d3adf11d7993518a39bd02b383cfe657ccc0023c"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/10204df9beda4978bd1d0c2db0d8375bfb03b915"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/3c1ae6de74e3d2d6333d29a2d3e13e6094596c79"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/4a1b65d1e55d53b397cb27014208be1e04172670"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/190d9efa5773f26d6f334b1b8be282c4fa13fd5e"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/357163fff3a6e48fe74745425a32071ec9caf852"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/d8a6213d70accb403b82924a1c229e733433a5ef"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "RUGGEDCOM RST2428P",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V3.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V1.1.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T00:41:50.846Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/geneve.c",
"include/net/ip_tunnels.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "43be590456e1f3566054ce78ae2dbb68cbe1a536",
"status": "affected",
"version": "35385daa8db320d2d9664930c28e732578b0d7de",
"versionType": "git"
},
{
"lessThan": "d3adf11d7993518a39bd02b383cfe657ccc0023c",
"status": "affected",
"version": "6f92124d74419797fadfbcd5b7a72c384a6413ad",
"versionType": "git"
},
{
"lessThan": "10204df9beda4978bd1d0c2db0d8375bfb03b915",
"status": "affected",
"version": "71ad9260c001b217d704cda88ecea251b2d367da",
"versionType": "git"
},
{
"lessThan": "3c1ae6de74e3d2d6333d29a2d3e13e6094596c79",
"status": "affected",
"version": "d13f048dd40e8577260cd43faea8ec9b77520197",
"versionType": "git"
},
{
"lessThan": "4a1b65d1e55d53b397cb27014208be1e04172670",
"status": "affected",
"version": "d13f048dd40e8577260cd43faea8ec9b77520197",
"versionType": "git"
},
{
"lessThan": "190d9efa5773f26d6f334b1b8be282c4fa13fd5e",
"status": "affected",
"version": "d13f048dd40e8577260cd43faea8ec9b77520197",
"versionType": "git"
},
{
"lessThan": "357163fff3a6e48fe74745425a32071ec9caf852",
"status": "affected",
"version": "d13f048dd40e8577260cd43faea8ec9b77520197",
"versionType": "git"
},
{
"lessThan": "d8a6213d70accb403b82924a1c229e733433a5ef",
"status": "affected",
"version": "d13f048dd40e8577260cd43faea8ec9b77520197",
"versionType": "git"
},
{
"status": "affected",
"version": "9a51e36ebf433adf59c051bec33f5aa54640bb4d",
"versionType": "git"
},
{
"status": "affected",
"version": "21815f28af8081b258552c111774ff320cf38d38",
"versionType": "git"
},
{
"lessThan": "4.19.313",
"status": "affected",
"version": "4.19.191",
"versionType": "semver"
},
{
"lessThan": "5.4.275",
"status": "affected",
"version": "5.4.119",
"versionType": "semver"
},
{
"lessThan": "5.10.216",
"status": "affected",
"version": "5.10.37",
"versionType": "semver"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.21",
"versionType": "semver"
},
{
"lessThan": "5.13",
"status": "affected",
"version": "5.12.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/geneve.c",
"include/net/ip_tunnels.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.313",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.275",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.87",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.313",
"versionStartIncluding": "4.19.191",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.275",
"versionStartIncluding": "5.4.119",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.216",
"versionStartIncluding": "5.10.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.156",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.87",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.28",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.7",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngeneve: fix header validation in geneve[6]_xmit_skb\n\nsyzbot is able to trigger an uninit-value in geneve_xmit() [1]\n\nProblem : While most ip tunnel helpers (like ip_tunnel_get_dsfield())\nuses skb_protocol(skb, true), pskb_inet_may_pull() is only using\nskb-\u003eprotocol.\n\nIf anything else than ETH_P_IPV6 or ETH_P_IP is found in skb-\u003eprotocol,\npskb_inet_may_pull() does nothing at all.\n\nIf a vlan tag was provided by the caller (af_packet in the syzbot case),\nthe network header might not point to the correct location, and skb\nlinear part could be smaller than expected.\n\nAdd skb_vlan_inet_prepare() to perform a complete mac validation.\n\nUse this in geneve for the moment, I suspect we need to adopt this\nmore broadly.\n\nv4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest\n - Only call __vlan_get_protocol() for vlan types.\n\nv2,v3 - Addressed Sabrina comments on v1 and v2\n\n[1]\n\nBUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline]\n BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030\n geneve_xmit_skb drivers/net/geneve.c:910 [inline]\n geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030\n __netdev_start_xmit include/linux/netdevice.h:4903 [inline]\n netdev_start_xmit include/linux/netdevice.h:4917 [inline]\n xmit_one net/core/dev.c:3531 [inline]\n dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547\n __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335\n dev_queue_xmit include/linux/netdevice.h:3091 [inline]\n packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276\n packet_snd net/packet/af_packet.c:3081 [inline]\n packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x30f/0x380 net/socket.c:745\n __sys_sendto+0x685/0x830 net/socket.c:2191\n __do_sys_sendto net/socket.c:2203 [inline]\n __se_sys_sendto net/socket.c:2199 [inline]\n __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:3804 [inline]\n slab_alloc_node mm/slub.c:3845 [inline]\n kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n alloc_skb include/linux/skbuff.h:1318 [inline]\n alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n packet_alloc_skb net/packet/af_packet.c:2930 [inline]\n packet_snd net/packet/af_packet.c:3024 [inline]\n packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x30f/0x380 net/socket.c:745\n __sys_sendto+0x685/0x830 net/socket.c:2191\n __do_sys_sendto net/socket.c:2203 [inline]\n __se_sys_sendto net/socket.c:2199 [inline]\n __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nCPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T15:45:36.681Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/43be590456e1f3566054ce78ae2dbb68cbe1a536"
},
{
"url": "https://git.kernel.org/stable/c/d3adf11d7993518a39bd02b383cfe657ccc0023c"
},
{
"url": "https://git.kernel.org/stable/c/10204df9beda4978bd1d0c2db0d8375bfb03b915"
},
{
"url": "https://git.kernel.org/stable/c/3c1ae6de74e3d2d6333d29a2d3e13e6094596c79"
},
{
"url": "https://git.kernel.org/stable/c/4a1b65d1e55d53b397cb27014208be1e04172670"
},
{
"url": "https://git.kernel.org/stable/c/190d9efa5773f26d6f334b1b8be282c4fa13fd5e"
},
{
"url": "https://git.kernel.org/stable/c/357163fff3a6e48fe74745425a32071ec9caf852"
},
{
"url": "https://git.kernel.org/stable/c/d8a6213d70accb403b82924a1c229e733433a5ef"
}
],
"title": "geneve: fix header validation in geneve[6]_xmit_skb",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-35973",
"datePublished": "2024-05-20T09:42:00.475Z",
"dateReserved": "2024-05-17T13:50:33.142Z",
"dateUpdated": "2026-10-15T00:41:50.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68426 (GCVE-0-2026-68426)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix stale skb->prev after async crypto steals a GSO segment
skb_gso_segment() leaves the segment list head with ->prev pointing at
the last segment, an invariant validate_xmit_skb_list() relies on when
it sets its tail pointer (tail = skb->prev).
When validate_xmit_xfrm() walks a GSO list and some segments are stolen
by async crypto (->xmit() returns -EINPROGRESS), those segments are
unlinked from the list but the head ->prev is never updated. If the
last segment is the one stolen, the returned head still has ->prev
pointing at it, even though it is now owned by the crypto engine and may
be freed. validate_xmit_skb_list() later does tail->next = skb, writing
through that stale pointer -- a use-after-free.
Repoint skb->prev at the last retained segment before returning.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:46.371818Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:09.834Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4927ab8a8acc8db4fad33e803d1d35e0b16cef83",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "b58731e0570bfd3989999fc2baf9ee4fecd5bec6",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "33e1b0d25ca0d2818c635ff80e6aa0d295e08a98",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "bbca7cc3b2b4b10afbfee99b81d9ee78f5423046",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "3f4c3919baf0944ad96580467c302bc6c7758b00",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment\n\nskb_gso_segment() leaves the segment list head with -\u003eprev pointing at\nthe last segment, an invariant validate_xmit_skb_list() relies on when\nit sets its tail pointer (tail = skb-\u003eprev).\n\nWhen validate_xmit_xfrm() walks a GSO list and some segments are stolen\nby async crypto (-\u003exmit() returns -EINPROGRESS), those segments are\nunlinked from the list but the head -\u003eprev is never updated. If the\nlast segment is the one stolen, the returned head still has -\u003eprev\npointing at it, even though it is now owned by the crypto engine and may\nbe freed. validate_xmit_skb_list() later does tail-\u003enext = skb, writing\nthrough that stale pointer -- a use-after-free.\n\nRepoint skb-\u003eprev at the last retained segment before returning."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the IPsec transmit path (validate_xmit_xfrm) which processes any skb routed into an offloaded SA, including GRO-aggregated traffic forwarded from remote hosts on an IPsec gateway; xfrm_dev_offload_ok() has no socket/local-origin requirement, so a remote peer\u0027s packet stream drives the vulnerable GSO segmentation and async-crypto steal directly.\nAC:L - The attacker drives both preconditions with traffic alone: sustained large GSO flows keep the crypto engine backlogged so -\u003exmit() returns -EINPROGRESS routinely, and packet volume advances xo-\u003eseq.low toward the wrap that forces segmentation; each stolen trailing segment reproduces the stale skb-\u003eprev, and the subsequent tail-\u003enext write is deterministic once it occurs.\nPR:N - On an IPsec gateway the traffic that triggers the path is forwarded from remote, unauthenticated senders \u2014 no account, credentials, or capability on the target host is needed, since the SA and offload are pre-existing administrative configuration rather than something the attacker must set up.\nUI:N - No victim action is required; the vulnerable code runs automatically in softirq context on every qualifying transmit, driven purely by the attacker\u0027s packet stream.\nS:U - The corruption is of kernel sk_buff list state within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Writing through the stale -\u003eprev is a use-after-free on an skb whose memory the attacker can influence via heap grooming with concurrent traffic; per kernel UAF guidance this yields a high-confidentiality primitive, and the corrupted list can splice engine-owned skbs into the transmit path, exposing freed/reused memory contents on the wire.\nI:H - tail-\u003enext = skb is an attacker-influenced pointer write into freed heap memory, and the resulting skb list corruption lets live and engine-owned skbs be chained together; this is classic heap corruption that can be shaped via spraying into an arbitrary write or control-flow hijack.\nA:H - Even without full exploitation the use-after-free write and the double-ownership of a stolen segment cause list corruption, double-free/oops and kernel panic in the softirq transmit path, taking down the gateway."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:07.204Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4927ab8a8acc8db4fad33e803d1d35e0b16cef83"
},
{
"url": "https://git.kernel.org/stable/c/b58731e0570bfd3989999fc2baf9ee4fecd5bec6"
},
{
"url": "https://git.kernel.org/stable/c/33e1b0d25ca0d2818c635ff80e6aa0d295e08a98"
},
{
"url": "https://git.kernel.org/stable/c/bbca7cc3b2b4b10afbfee99b81d9ee78f5423046"
},
{
"url": "https://git.kernel.org/stable/c/3f4c3919baf0944ad96580467c302bc6c7758b00"
}
],
"title": "xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68426",
"datePublished": "2026-08-10T12:04:46.945Z",
"dateReserved": "2026-07-30T09:28:09.392Z",
"dateUpdated": "2026-10-21T12:44:07.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68156 (GCVE-0-2026-68156)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: refresh auth->authorizer_buf{,_len} after authorizer update
ceph_x_create_authorizer() caches au->buf->vec.iov_base and
au->buf->vec.iov_len in struct ceph_auth_handshake. These
cached values are then used by the messenger connect code when
sending the authorizer.
ceph_x_update_authorizer() can rebuild the authorizer when a newer
service ticket is available. If the rebuilt authorizer no longer
fits in the existing buffer, ceph_x_build_authorizer() drops its
reference to au->buf and allocates a new one. If this is the final
reference, ceph_buffer_put() frees the old ceph_buffer and its
vec.iov_base, but auth->authorizer_buf still points at that freed
memory.
A subsequent msgr1 reconnect can therefore queue the stale pointer
and trigger a KASAN slab-use-after-free in _copy_from_iter() while
tcp_sendmsg() copies the authorizer.
Refresh auth->authorizer_buf and auth->authorizer_buf_len after a
successful authorizer rebuild so the messenger sends the current
buffer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 0bed9b5c523d577378b6f83eab5835fe30c27208 Version: 29c65a277a64645af853e8c9a9b3dda0ddc421e0 Version: d2c7223497cf8228416c70e3f4238ddd6c5bdf3c Version: 3.4.50 ≤ Version: 3.9.7 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:45:09.780823Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:54.796Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/auth_x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2334e9997308305ee4fd508fdfe6086c4150ed60",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "79a273df64238a4ade8b709689a78589f755b8ef",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "26f814187abceee90dbb29a02133adb4786fbb13",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "9d37aec9ffe4e743dabc3f84502e9723e17a30d4",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "75e82e8944ac1efe9fdb88bd2f14d9a031282bdf",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "0060ec912292a550198d8d18ac95b433c92a7091",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "5ecfcd5c05866f185357700b81b461dae4f5ebb2",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"lessThan": "937d61f86d377a3aa578adae7a3dfcecdddf9d89",
"status": "affected",
"version": "0bed9b5c523d577378b6f83eab5835fe30c27208",
"versionType": "git"
},
{
"status": "affected",
"version": "29c65a277a64645af853e8c9a9b3dda0ddc421e0",
"versionType": "git"
},
{
"status": "affected",
"version": "d2c7223497cf8228416c70e3f4238ddd6c5bdf3c",
"versionType": "git"
},
{
"lessThan": "3.5",
"status": "affected",
"version": "3.4.50",
"versionType": "semver"
},
{
"lessThan": "3.10",
"status": "affected",
"version": "3.9.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/auth_x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.4.50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.9.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update\n\nceph_x_create_authorizer() caches au-\u003ebuf-\u003evec.iov_base and\nau-\u003ebuf-\u003evec.iov_len in struct ceph_auth_handshake. These\ncached values are then used by the messenger connect code when\nsending the authorizer.\n\nceph_x_update_authorizer() can rebuild the authorizer when a newer\nservice ticket is available. If the rebuilt authorizer no longer\nfits in the existing buffer, ceph_x_build_authorizer() drops its\nreference to au-\u003ebuf and allocates a new one. If this is the final\nreference, ceph_buffer_put() frees the old ceph_buffer and its\nvec.iov_base, but auth-\u003eauthorizer_buf still points at that freed\nmemory.\n\nA subsequent msgr1 reconnect can therefore queue the stale pointer\nand trigger a KASAN slab-use-after-free in _copy_from_iter() while\ntcp_sendmsg() copies the authorizer.\n\nRefresh auth-\u003eauthorizer_buf and auth-\u003eauthorizer_buf_len after a\nsuccessful authorizer rebuild so the messenger sends the current\nbuffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A compromised or malicious Ceph monitor/OSD delivers rotated cephx service tickets over TCP that increase secret_id and can enlarge the authorizer; on subsequent msgr1 reconnect the stale authorizer_buf is copied in tcp_sendmsg, so the UAF is reachable from the network peer without local syscall access.\nAC:L - An attacker controlling the Ceph cluster can deterministically issue a larger rotated ticket to force ceph_buffer realloc in ceph_x_update_authorizer, then trigger an msgr1 OSD/MDS/MON reconnect; no victim-specific memory layout or uncontrollable race is required.\nPR:N - Exploitation requires no privileges on the victim host; any kernel Ceph/RBD/CephFS client already connected to an attacker-controlled or compromised cluster is sufficient, matching other libceph client CVEs where the remote peer drives the bug.\nUI:N - After initial Ceph client setup, service-ticket rotation and messenger reconnects occur automatically; no further interactive user action is needed to reach the stale-buffer send path.\nS:U - The slab UAF corrupts kernel heap memory on the Ceph client host for local privilege escalation or crash, but does not cross VM, IOMMU, or container sandbox boundaries to another security authority.\nC:H - KASAN-confirmed slab use-after-free in _copy_from_iter during authorizer transmission reads freed kmalloc memory, which can disclose adjacent kernel pointers and is classed as exploitable arbitrary read per kernel UAF guidance.\nI:H - Freed authorizer buffers can be reclaimed with attacker-controlled data before reconnect, enabling heap corruption and control-flow hijack during the stale-pointer copy, consistent with kernel UAF write primitive scoring.\nA:H - The reported KASAN slab-use-after-free in tcp_sendmsg while copying the authorizer reliably causes kernel oops or panic on Ceph client reconnect, and remains repeatable whenever tickets are rotated and msgr1 reconnects."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:30:25.089Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2334e9997308305ee4fd508fdfe6086c4150ed60"
},
{
"url": "https://git.kernel.org/stable/c/79a273df64238a4ade8b709689a78589f755b8ef"
},
{
"url": "https://git.kernel.org/stable/c/26f814187abceee90dbb29a02133adb4786fbb13"
},
{
"url": "https://git.kernel.org/stable/c/9d37aec9ffe4e743dabc3f84502e9723e17a30d4"
},
{
"url": "https://git.kernel.org/stable/c/75e82e8944ac1efe9fdb88bd2f14d9a031282bdf"
},
{
"url": "https://git.kernel.org/stable/c/0060ec912292a550198d8d18ac95b433c92a7091"
},
{
"url": "https://git.kernel.org/stable/c/5ecfcd5c05866f185357700b81b461dae4f5ebb2"
},
{
"url": "https://git.kernel.org/stable/c/937d61f86d377a3aa578adae7a3dfcecdddf9d89"
}
],
"title": "libceph: refresh auth-\u003eauthorizer_buf{,_len} after authorizer update",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68156",
"datePublished": "2026-08-10T11:59:22.514Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-10-19T20:58:54.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72288 (GCVE-0-2026-72288)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
Hyunwoo Kim reports some really bad races should the following
situation occur:
- LPI-I is pending in vcpu-B's AP list
- vcpu-A writes to vcpu-B's RD to disable its LPIs
- vcpu-C moves I from B to C
If the last two race nicely enough, vgic_prune_ap_list() can drop
the irq and AP list locks, reacquire them, and in the interval
the irq has been freed. UAF follows.
The fix is two-fold:
- Before dropping the irq and ap_list locks, take a reference on
the irq
- Do not try to handle migration of the pending bit: there is no
expectation that this state is retained, as per the architecture
With that, we're sure that the interrupt is still around, and we
safely remove it from the AP list as it has no target at this
stage (unless another interrupt fires, but that's another story).
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:45:49.610829Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:14.997Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eb74f3feb68e64cf69f86cb806a15d8cfb6757f4",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "77c61235d66246dd6a5f55587f0afc273d832775",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "d19dca8194ebed371e624331c6be2cb73b562caf",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "b1a89d12d35a8256d2b170ced0b1c86851f3def2",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "7258770e5814f15e8308ebda82ac9acf6964ba8e",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling\n\nHyunwoo Kim reports some really bad races should the following\nsituation occur:\n\n- LPI-I is pending in vcpu-B\u0027s AP list\n- vcpu-A writes to vcpu-B\u0027s RD to disable its LPIs\n- vcpu-C moves I from B to C\n\nIf the last two race nicely enough, vgic_prune_ap_list() can drop\nthe irq and AP list locks, reacquire them, and in the interval\nthe irq has been freed. UAF follows.\n\nThe fix is two-fold:\n\n- Before dropping the irq and ap_list locks, take a reference on\n the irq\n\n- Do not try to handle migration of the pending bit: there is no\n expectation that this state is retained, as per the architecture\n\nWith that, we\u0027re sure that the interrupt is still around, and we\nsafely remove it from the AP list as it has no target at this\nstage (unless another interrupt fires, but that\u0027s another story)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only from KVM guest MMIO traps on GICv3 redistributor GICR_CTLR LPI-disable writes, ITS MOVI affinity changes, and vCPU-exit paths into vgic_prune_ap_list(); no network-facing host protocol is involved.\nAC:L - A guest controls all three racing vCPUs by pinning threads to concurrently issue ITS MOVI, cross-vCPU GICR_CTLR LPI-disable writes, and vCPU exits that invoke vgic_prune_ap_list(); the attacker creates and wins the race rather than depending on uncontrollable host timing.\nPR:N - No host privileges are required beyond running code in an assigned KVM guest (e.g. a cloud VM tenant on arm64); exploitation needs guest-kernel access to GIC/ITS MMIO, not host root or capabilities in the init namespace.\nUI:N - Exploitation is fully attacker-driven from within a multi-vCPU guest VM and does not require any victim user or administrator action on the host.\nS:C - The use-after-free corrupts host-kernel heap memory (struct vgic_irq) from guest-controlled VGIC operations, crossing the guest-to-host virtualization security boundary with VM-escape impact.\nC:H - vgic_flush_pending_lpis() can free the LPI vgic_irq while vgic_prune_ap_list() still dereferences it after reacquiring dropped locks, yielding a kernel heap use-after-free exploitable for arbitrary host memory disclosure via heap grooming.\nI:H - The dangling vgic_irq pointer permits attacker-influenced writes through irq_lock, list_head, vcpu, and target_vcpu fields during ap_list migration, enabling host control-flow or data corruption primitives.\nA:H - The race frees live kernel objects still referenced by the ap_list migration path, causing host kernel oops, panic, or hang during list_del, lock operations, or subsequent LPI delivery on arm64 KVM hosts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:30.737Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eb74f3feb68e64cf69f86cb806a15d8cfb6757f4"
},
{
"url": "https://git.kernel.org/stable/c/77c61235d66246dd6a5f55587f0afc273d832775"
},
{
"url": "https://git.kernel.org/stable/c/d19dca8194ebed371e624331c6be2cb73b562caf"
},
{
"url": "https://git.kernel.org/stable/c/b1a89d12d35a8256d2b170ced0b1c86851f3def2"
},
{
"url": "https://git.kernel.org/stable/c/7258770e5814f15e8308ebda82ac9acf6964ba8e"
}
],
"title": "KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72288",
"datePublished": "2026-08-15T05:55:10.256Z",
"dateReserved": "2026-08-09T03:40:39.917Z",
"dateUpdated": "2026-10-21T12:44:30.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80590 (GCVE-0-2026-80590)
Vulnerability from cvelistv5
Published
2026-08-28 06:35
Modified
2026-10-19 08:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
inet: frags: strip GSO state from fragments before reassembly
A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark
an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.
inet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first
fragment's skb as the head of the reassembled datagram, including its
shinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments
on frag_list with whatever linear/paged layout they arrived with.
After ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the
reassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and
the next software segmentation point - udp_rcv_segment() on local
delivery, validate_xmit_skb(), or the ip_finish_output_gso() slow
path - hands it to skb_segment(). skb_segment()'s frag_list walk
assumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to
a tap by an unprivileged user in its own userns are enough:
kernel BUG at net/core/skbuff.c:4899!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2
RIP: 0010:skb_segment+0x20ca/0x48b0
Call Trace:
<TASK>
__udp_gso_segment+0x29a/0x27d0
udp4_ufo_fragment+0x458/0x6c0
inet_gso_segment+0x429/0x1340
skb_mac_gso_segment+0x233/0x4f0
__skb_gso_segment+0x308/0x660
udp_queue_rcv_skb+0x440/0xad0
udp_unicast_rcv_skb+0xc7/0x2c0
udp_rcv+0x16ce/0x2260
ip_protocol_deliver_rcu+0x197/0x2d0
ip_local_deliver+0x430/0x690
ip_rcv+0x16f/0x1f0
__netif_receive_skb_one_core+0x15e/0x1c0
__netif_receive_skb+0x1e/0x110
netif_receive_skb+0xf6/0x5c0
tun_rx_batched.isra.0+0x3ab/0x790
tun_get_user+0x17c3/0x3550
tun_chr_write_iter+0xba/0x1b0
vfs_write+0x646/0x1130
</TASK>
Kernel panic - not syncing: Fatal exception in interrupt
This runs with BH disabled, so it is a panic rather than an oops. The
same is reachable with CAP_NET_RAW in a netns where a defrag point
precedes a GSO point, and from a guest whose VMM forwards
virtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by
commit 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting
gso_size mangled skb having linear-headed frag_list") and by
commit 9e4b7a99a03a ("net: gso: fix panic on frag_list with mixed head
alloc types") do not cover it: page-backed heads skip them, and kmalloc
heads skip them when gso_size == skb_headlen(head), which the sender
controls.
An skb entering a frag queue is an IP fragment by definition and
cannot legitimately carry GSO state: GRO does not merge fragments and
the stack segments before it fragments, so only untrusted sources are
affected. This has been reachable since
commit f43798c27684 ("tun: Allow GSO using virtio_net_hdr"), the first
path that let userspace attach GSO metadata to an IP fragment. Reset
the GSO fields of every fragment as it is queued, in
inet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and
6lowpan reassembly share; then neither the head nor the frag_list
members of the reassembled skb carry them (the members matter too:
the ip_do_fragment()/ip6_fragment() fast paths send them out as they
are). The head may remain CHECKSUM_PARTIAL; that is already accepted
on receive and resolved by skb_checksum_help() in
ip_do_fragment()/ip6_fragment() on forward.
Tested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer
above, two further IPv4 frag_list geometries that reach
BUG_ON(i >= nfrags) and BUG_ON(!list_skb->head_frag), and an IPv6
fragment-header variant (udp6_ufo_fragment()) each panic the unpatched
kernel; with this patch all four datagrams are delivered intact and
nothing is logged.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:18:13.413771Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:29.280Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_fragment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "29dda278a5ed272f2230ff4eaa23cf403107bba0",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "3edf721bb4b99d272c336631b44e3d8ff9a4f31b",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "dec2edb7aaf12a8878b3a03172ea8fc277b8eaad",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "69b73b74d9eb45f5560a8fe4fa406ada580e1340",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "da857e448322a2e871ce3ecc2900027041160d43",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "d5dc1e69fd7258ea605c9952e5d5947539159ae3",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_fragment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.268",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.219",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.186",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.155",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.107",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.48",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.268",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.219",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.186",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.155",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.107",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.48",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.12",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.2",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.\ninet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first\nfragment\u0027s skb as the head of the reassembled datagram, including its\nshinfo-\u003egso_size/gso_type/gso_segs, and chain the remaining fragments\non frag_list with whatever linear/paged layout they arrived with.\n\nAfter ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the\nreassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and\nthe next software segmentation point - udp_rcv_segment() on local\ndelivery, validate_xmit_skb(), or the ip_finish_output_gso() slow\npath - hands it to skb_segment(). skb_segment()\u0027s frag_list walk\nassumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to\na tap by an unprivileged user in its own userns are enough:\n\n kernel BUG at net/core/skbuff.c:4899!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2\n RIP: 0010:skb_segment+0x20ca/0x48b0\n Call Trace:\n \u003cTASK\u003e\n __udp_gso_segment+0x29a/0x27d0\n udp4_ufo_fragment+0x458/0x6c0\n inet_gso_segment+0x429/0x1340\n skb_mac_gso_segment+0x233/0x4f0\n __skb_gso_segment+0x308/0x660\n udp_queue_rcv_skb+0x440/0xad0\n udp_unicast_rcv_skb+0xc7/0x2c0\n udp_rcv+0x16ce/0x2260\n ip_protocol_deliver_rcu+0x197/0x2d0\n ip_local_deliver+0x430/0x690\n ip_rcv+0x16f/0x1f0\n __netif_receive_skb_one_core+0x15e/0x1c0\n __netif_receive_skb+0x1e/0x110\n netif_receive_skb+0xf6/0x5c0\n tun_rx_batched.isra.0+0x3ab/0x790\n tun_get_user+0x17c3/0x3550\n tun_chr_write_iter+0xba/0x1b0\n vfs_write+0x646/0x1130\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThis runs with BH disabled, so it is a panic rather than an oops. The\nsame is reachable with CAP_NET_RAW in a netns where a defrag point\nprecedes a GSO point, and from a guest whose VMM forwards\nvirtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by\ncommit 3dcbdb134f32 (\"net: gso: Fix skb_segment splat when splitting\ngso_size mangled skb having linear-headed frag_list\") and by\ncommit 9e4b7a99a03a (\"net: gso: fix panic on frag_list with mixed head\nalloc types\") do not cover it: page-backed heads skip them, and kmalloc\nheads skip them when gso_size == skb_headlen(head), which the sender\ncontrols.\n\nAn skb entering a frag queue is an IP fragment by definition and\ncannot legitimately carry GSO state: GRO does not merge fragments and\nthe stack segments before it fragments, so only untrusted sources are\naffected. This has been reachable since\ncommit f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\"), the first\npath that let userspace attach GSO metadata to an IP fragment. Reset\nthe GSO fields of every fragment as it is queued, in\ninet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and\n6lowpan reassembly share; then neither the head nor the frag_list\nmembers of the reassembled skb carry them (the members matter too:\nthe ip_do_fragment()/ip6_fragment() fast paths send them out as they\nare). The head may remain CHECKSUM_PARTIAL; that is already accepted\non receive and resolved by skb_checksum_help() in\nip_do_fragment()/ip6_fragment() on forward.\n\nTested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer\nabove, two further IPv4 frag_list geometries that reach\nBUG_ON(i \u003e= nfrags) and BUG_ON(!list_skb-\u003ehead_frag), and an IPv6\nfragment-header variant (udp6_ufo_fragment()) each panic the unpatched\nkernel; with this patch all four datagrams are delivered intact and\nnothing is logged."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious cloud VM guest injects virtio_net_hdr-marked IPv4/IPv6 fragments through virtio-net/vhost-tap into the host ip_rcv() path; the same inet_frag reassembly and skb_segment() crash also fires on validate_xmit_skb()/ip_finish_output_gso() when such skbs traverse forwarding.\nAC:L - The attacker fully controls virtio_net_hdr gso_type/gso_size and fragment geometry; the commit reproduces a host panic from two tap writes with no races, timing, or uncontrollable memory layout required.\nPR:N - On typical KVM/QEMU tap-backed virtio-net deployments a tenant VM needs no host account or capability; exploitation uses only the pre-provisioned virtual NIC, not init-namespace root or CAP_NET_ADMIN on the host.\nUI:N - Packet injection, ip_defrag reassembly, and GSO segmentation run automatically in softirq once crafted virtio fragments are sent; no victim mount, click, or other cooperative action is required.\nS:C - A guest VM tenant can panic the host kernel by crossing the hypervisor virtio/tap boundary, impacting resources outside the guest security authority even though the demonstrated primitive is denial of service rather than full escape.\nC:N - Impact is an intentional BUG_ON in skb_segment() frag_list handling; there is no demonstrated out-of-bounds read, use-after-free, or other information-disclosure primitive before the assertion aborts.\nI:N - The failure aborts in skb_segment() before any out-of-bounds write, page-desc conversion, or control-flow hijack; attacker-controlled metadata only reaches a defensive assertion, not a memory modification primitive.\nA:H - Triggering skb_segment() BUG_ON from tun_rx/tun_get_user runs with BH disabled and causes a fatal kernel panic, fully and repeatedly denying availability of the affected host until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:43:12.426Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee"
},
{
"url": "https://git.kernel.org/stable/c/29dda278a5ed272f2230ff4eaa23cf403107bba0"
},
{
"url": "https://git.kernel.org/stable/c/14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234"
},
{
"url": "https://git.kernel.org/stable/c/3edf721bb4b99d272c336631b44e3d8ff9a4f31b"
},
{
"url": "https://git.kernel.org/stable/c/dec2edb7aaf12a8878b3a03172ea8fc277b8eaad"
},
{
"url": "https://git.kernel.org/stable/c/c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace"
},
{
"url": "https://git.kernel.org/stable/c/69b73b74d9eb45f5560a8fe4fa406ada580e1340"
},
{
"url": "https://git.kernel.org/stable/c/da857e448322a2e871ce3ecc2900027041160d43"
},
{
"url": "https://git.kernel.org/stable/c/d5dc1e69fd7258ea605c9952e5d5947539159ae3"
}
],
"title": "inet: frags: strip GSO state from fragments before reassembly",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80590",
"datePublished": "2026-08-28T06:35:12.516Z",
"dateReserved": "2026-08-26T14:34:25.770Z",
"dateUpdated": "2026-10-19T08:43:12.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53091 (GCVE-0-2026-53091)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-10-21 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: pull headers in qdisc_pkt_len_segs_init()
Most ndo_start_xmit() methods expects headers of gso packets
to be already in skb->head.
net/core/tso.c users are particularly at risk, because tso_build_hdr()
does a memcpy(hdr, skb->data, hdr_len);
qdisc_pkt_len_segs_init() already does a dissection of gso packets.
Use pskb_may_pull() instead of skb_header_pointer() to make
sure drivers do not have to reimplement this.
Some malicious packets could be fed, detect them so that we can
drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.53.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.162.1.rt7.503.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.162.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s handling of Generic Segmentation Offload (GSO) packet headers. This vulnerability occurs when the `qdisc_pkt_len_segs_init()` function does not properly pull headers into the expected memory location, which can lead to incorrect processing by network drivers. A remote attacker could exploit this by sending specially crafted malicious packets, potentially causing a denial of service (DoS) or other unexpected system behavior."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T12:04:34.429Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53091"
},
{
"name": "RHBZ#2492270",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492270"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53091.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:65334"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67150"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:66325"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:66324"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:65334: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:67150: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:66325: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:66324: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: net: pull headers in qdisc_pkt_len_segs_init()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53091",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:25:34.531794Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "CWE-131 Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:57:24.238Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/dropreason-core.h",
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5895cfc76924a629c6eaa5e5f049de642860045f",
"status": "affected",
"version": "e876f208af18b074f800656e4d1b99da75b2135f",
"versionType": "git"
},
{
"lessThan": "7564dc804d8289d2e5c6edb8173754051b71bff4",
"status": "affected",
"version": "e876f208af18b074f800656e4d1b99da75b2135f",
"versionType": "git"
},
{
"lessThan": "9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a",
"status": "affected",
"version": "e876f208af18b074f800656e4d1b99da75b2135f",
"versionType": "git"
},
{
"lessThan": "7fb4c19670110f052c04e1ec1d2b953b9f4f57e4",
"status": "affected",
"version": "e876f208af18b074f800656e4d1b99da75b2135f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/dropreason-core.h",
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pull headers in qdisc_pkt_len_segs_init()\n\nMost ndo_start_xmit() methods expects headers of gso packets\nto be already in skb-\u003ehead.\n\nnet/core/tso.c users are particularly at risk, because tso_build_hdr()\ndoes a memcpy(hdr, skb-\u003edata, hdr_len);\n\nqdisc_pkt_len_segs_init() already does a dissection of gso packets.\n\nUse pskb_may_pull() instead of skb_header_pointer() to make\nsure drivers do not have to reimplement this.\n\nSome malicious packets could be fed, detect them so that we can\ndrop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through local transmit paths such as AF_PACKET, TUN/TAP, or guest virtio/tap injection where an attacker can supply GSO metadata. Ordinary remote packets do not carry this malformed skb/GSO state on the wire.\nAC:L - No race or external timing condition is required. The attacker controls the GSO header metadata and packet layout needed to make qdisc accept a header that later TX code expects to be linear.\nPR:L - AF_PACKET requires CAP_NET_RAW in the target network namespace, and TUN/TAP style paths require CAP_NET_ADMIN or access to an existing tap/tun file descriptor. These are reachable as low privilege in user-namespace or guest/tap deployments rather than requiring init-namespace root in the highest reasonable scenario.\nUI:N - No victim user action is needed once the attacker can inject the crafted local/guest packet. The transmit path processes the skb automatically.\nS:C - In virtualization deployments, a guest-controlled GSO packet can be processed by the host kernel tap/vhost transmit path and affect host kernel memory or availability. That crosses the guest-to-host security boundary.\nC:H - TSO helpers copy header bytes directly from skb-\u003edata, so a header accepted via skb_header_pointer() but not pulled into skb-\u003ehead can leak adjacent kernel memory into transmitted segment headers. This is an out-of-bounds kernel read and is scored High.\nI:N - The investigated primitive is incorrect header linearity causing out-of-bounds reads and crashes, not a demonstrated attacker-controlled write or protected data modification. I did not find a reliable integrity-impacting write primitive from this fix.\nA:H - Malformed GSO packets can trigger kernel faults or invalid driver/TSO behavior during transmit, including panics reported for this issue. Repeated local injection can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:41:56.505Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5895cfc76924a629c6eaa5e5f049de642860045f"
},
{
"url": "https://git.kernel.org/stable/c/7564dc804d8289d2e5c6edb8173754051b71bff4"
},
{
"url": "https://git.kernel.org/stable/c/9d4f5c68f5ad4ab425f3ce1500c97c9f9743999a"
},
{
"url": "https://git.kernel.org/stable/c/7fb4c19670110f052c04e1ec1d2b953b9f4f57e4"
}
],
"title": "net: pull headers in qdisc_pkt_len_segs_init()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53091",
"datePublished": "2026-06-24T16:30:30.290Z",
"dateReserved": "2026-06-09T07:44:35.384Z",
"dateUpdated": "2026-10-21T12:41:56.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68160 (GCVE-0-2026-68160)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
ceph_handle_caps() reads snap_trace_len from the wire-format
ceph_mds_caps header and uses it unconditionally to build a fake
end pointer (snaptrace + snaptrace_len) that is later handed to
ceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case:
snaptrace = h + 1;
snaptrace_len = le32_to_cpu(h->snap_trace_len);
p = snaptrace + snaptrace_len;
...
case CEPH_CAP_OP_IMPORT:
if (snaptrace_len) {
...
if (ceph_update_snap_trace(mdsc, snaptrace,
snaptrace + snaptrace_len,
false, &realm)) { ... }
ceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm
from snaptrace using ceph_decode_need(&p, e, sizeof(*ri), bad)
with the attacker-supplied fake end e == snaptrace + snaptrace_len.
With snaptrace_len == 0xFFFFFFFF the bound check is trivially
satisfied, ri = p reads sizeof(struct ceph_mds_snap_realm) past
the legitimate msg->front buffer, and ri->num_snaps /
ri->num_prior_parent_snaps then drive further out-of-bounds
reads of the encoded snap arrays.
The eleven msg_version >= 2 .. msg_version >= 12 decoder blocks
above the op switch each catch this OOB through their
ceph_decode_*_safe() / ceph_decode_need() helpers, but they sit
behind a hdr.version-gated if, so a malicious or compromised
MDS that sets msg->hdr.version = 1 reaches the IMPORT path with
no version-gated decoder having validated snap_trace_len. The
shape has been present since ceph_handle_caps() was introduced.
Validate snap_trace_len against the message front buffer before
consuming it, using the canonical ceph_decode_need() / ceph_has_room()
helper. The helper bounds the length with subtraction (n <= end - p,
guarded by end >= p) rather than pointer addition, so it is wrap-safe
for the attacker-controlled u32 length on 32-bit builds where
p + snap_trace_len could overflow the address space. This matches the
rest of the ceph decode path (e.g. the pool_ns_len check a few lines
below), and the existing goto bad cleanup already covers this exit
path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a8599bd821d084d04a3290fffae1071624ec00ea Version: a8599bd821d084d04a3290fffae1071624ec00ea Version: a8599bd821d084d04a3290fffae1071624ec00ea Version: a8599bd821d084d04a3290fffae1071624ec00ea Version: a8599bd821d084d04a3290fffae1071624ec00ea Version: a8599bd821d084d04a3290fffae1071624ec00ea Version: a8599bd821d084d04a3290fffae1071624ec00ea Version: a8599bd821d084d04a3290fffae1071624ec00ea |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68160",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:45:20.340785Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:55.403Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ceph/caps.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f913192fc782288e060dafc329b2346934be34cc",
"status": "affected",
"version": "a8599bd821d084d04a3290fffae1071624ec00ea",
"versionType": "git"
},
{
"lessThan": "0c011137194036424e974677e0f1592e22a33d8c",
"status": "affected",
"version": "a8599bd821d084d04a3290fffae1071624ec00ea",
"versionType": "git"
},
{
"lessThan": "cc93f68a31c9b831abf2db8647b5f5b10329d793",
"status": "affected",
"version": "a8599bd821d084d04a3290fffae1071624ec00ea",
"versionType": "git"
},
{
"lessThan": "9081c71796724ffe96cba253f68fbe42363c5295",
"status": "affected",
"version": "a8599bd821d084d04a3290fffae1071624ec00ea",
"versionType": "git"
},
{
"lessThan": "03b417afce19ee6b6e61f1bbbbebac924c9f36d1",
"status": "affected",
"version": "a8599bd821d084d04a3290fffae1071624ec00ea",
"versionType": "git"
},
{
"lessThan": "a4228b93706fb74a484e6ffb271c1cc2af3a2ddb",
"status": "affected",
"version": "a8599bd821d084d04a3290fffae1071624ec00ea",
"versionType": "git"
},
{
"lessThan": "71893c342a26bcff92eaab0b2b75d64aed19308a",
"status": "affected",
"version": "a8599bd821d084d04a3290fffae1071624ec00ea",
"versionType": "git"
},
{
"lessThan": "4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02",
"status": "affected",
"version": "a8599bd821d084d04a3290fffae1071624ec00ea",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ceph/caps.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()\n\nceph_handle_caps() reads snap_trace_len from the wire-format\nceph_mds_caps header and uses it unconditionally to build a fake\nend pointer (snaptrace + snaptrace_len) that is later handed to\nceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case:\n\n snaptrace = h + 1;\n snaptrace_len = le32_to_cpu(h-\u003esnap_trace_len);\n p = snaptrace + snaptrace_len;\n ...\n case CEPH_CAP_OP_IMPORT:\n if (snaptrace_len) {\n ...\n if (ceph_update_snap_trace(mdsc, snaptrace,\n snaptrace + snaptrace_len,\n false, \u0026realm)) { ... }\n\nceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm\nfrom snaptrace using ceph_decode_need(\u0026p, e, sizeof(*ri), bad)\nwith the attacker-supplied fake end e == snaptrace + snaptrace_len.\nWith snaptrace_len == 0xFFFFFFFF the bound check is trivially\nsatisfied, ri = p reads sizeof(struct ceph_mds_snap_realm) past\nthe legitimate msg-\u003efront buffer, and ri-\u003enum_snaps /\nri-\u003enum_prior_parent_snaps then drive further out-of-bounds\nreads of the encoded snap arrays.\n\nThe eleven msg_version \u003e= 2 .. msg_version \u003e= 12 decoder blocks\nabove the op switch each catch this OOB through their\nceph_decode_*_safe() / ceph_decode_need() helpers, but they sit\nbehind a hdr.version-gated if, so a malicious or compromised\nMDS that sets msg-\u003ehdr.version = 1 reaches the IMPORT path with\nno version-gated decoder having validated snap_trace_len. The\nshape has been present since ceph_handle_caps() was introduced.\n\nValidate snap_trace_len against the message front buffer before\nconsuming it, using the canonical ceph_decode_need() / ceph_has_room()\nhelper. The helper bounds the length with subtraction (n \u003c= end - p,\nguarded by end \u003e= p) rather than pointer addition, so it is wrap-safe\nfor the attacker-controlled u32 length on 32-bit builds where\np + snap_trace_len could overflow the address space. This matches the\nrest of the ceph decode path (e.g. the pool_ns_len check a few lines\nbelow), and the existing goto bad cleanup already covers this exit\npath."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - CEPH_MSG_CLIENT_CAPS is received over the kernel Ceph messenger TCP connection from an MDS peer; mds_dispatch() passes it directly to ceph_handle_caps(), so a malicious or compromised MDS (or on-path attacker on an unsigned msgr session) reaches the bug with network data alone.\nAC:L - The attacker fully controls msg-\u003ehdr.version and snap_trace_len in the caps header; setting version=1 bypasses all version-gated decoders and snap_trace_len=0xFFFFFFFF yields a fake end pointer that reliably defeats ceph_decode_need(), with no race or memory-layout dependency.\nPR:N - Exploitation requires only the ability to send crafted caps messages as the remote MDS peer on an established session; the attacker needs no account, mount privilege, or other credentials on the victim host beyond the client already being connected to that cluster.\nUI:N - Once CephFS is mounted and the MDS session is open, CEPH_CAP_OP_IMPORT caps messages are delivered and processed automatically during normal cap migration and MDS failover; no additional local user action is needed at exploit time beyond prior cluster connectivity.\nS:U - The out-of-bounds read and resulting snap-realm corruption affect only the kernel CephFS client\u2019s internal state within the same kernel security authority; there is no VM escape, sandbox breakout, or cross-authority boundary crossing.\nC:H - ceph_update_snap_trace() decodes struct ceph_mds_snap_realm and snap arrays using an attacker-supplied fake end pointer, reading sizeof(*ri) and further attacker-influenced extents past the legitimate msg-\u003efront buffer into adjacent kernel memory without copying to userspace.\nI:H - Out-of-bounds kernel memory is interpreted as snap-realm metadata and copied via dup_array() into newly allocated kernel heap structures (realm-\u003esnaps, realm-\u003eprior_parent_snaps), corrupting authoritative snap state and providing a memory-corruption primitive that could be leveraged for further kernel compromise.\nA:H - Out-of-bounds reads can fault on unmapped pages causing a kernel oops; the ceph_update_snap_trace() error path issues WARN(1), fences I/O via CEPH_MOUNT_FENCE_IO, and can close all MDS sessions\u2014effects an attacker can trigger repeatedly at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:30:32.455Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f913192fc782288e060dafc329b2346934be34cc"
},
{
"url": "https://git.kernel.org/stable/c/0c011137194036424e974677e0f1592e22a33d8c"
},
{
"url": "https://git.kernel.org/stable/c/cc93f68a31c9b831abf2db8647b5f5b10329d793"
},
{
"url": "https://git.kernel.org/stable/c/9081c71796724ffe96cba253f68fbe42363c5295"
},
{
"url": "https://git.kernel.org/stable/c/03b417afce19ee6b6e61f1bbbbebac924c9f36d1"
},
{
"url": "https://git.kernel.org/stable/c/a4228b93706fb74a484e6ffb271c1cc2af3a2ddb"
},
{
"url": "https://git.kernel.org/stable/c/71893c342a26bcff92eaab0b2b75d64aed19308a"
},
{
"url": "https://git.kernel.org/stable/c/4dbc71bcaf9a30abf3920a4e2cc4ed33bba78c02"
}
],
"title": "ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68160",
"datePublished": "2026-08-10T11:59:26.741Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-10-19T20:58:55.403Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74416 (GCVE-0-2026-74416)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-08-17 05:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
radeon_ring_restore() takes ownership of the data buffer allocated by
radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in
the non-restore branch; in the restore branch it relies on
radeon_ring_restore() to free it.
If radeon_ring_lock() fails, the function returned early without calling
kvfree(data), leaking the ring backup buffer on every GPU reset that
fails at the lock stage. During repeated GPU resets this causes
cumulative kernel memory exhaustion.
Free data before returning the error.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 55d7c22192becd0ec827a6901899ff56fa985658 Version: 55d7c22192becd0ec827a6901899ff56fa985658 Version: 55d7c22192becd0ec827a6901899ff56fa985658 Version: 55d7c22192becd0ec827a6901899ff56fa985658 Version: 55d7c22192becd0ec827a6901899ff56fa985658 Version: 55d7c22192becd0ec827a6901899ff56fa985658 Version: 55d7c22192becd0ec827a6901899ff56fa985658 Version: 55d7c22192becd0ec827a6901899ff56fa985658 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/radeon/radeon_ring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "63912418f1fbb6456ea04bbcdf8f4d5090d23350",
"status": "affected",
"version": "55d7c22192becd0ec827a6901899ff56fa985658",
"versionType": "git"
},
{
"lessThan": "919e3e398bf301c6418dffdcd5e5c4fd9be39cf7",
"status": "affected",
"version": "55d7c22192becd0ec827a6901899ff56fa985658",
"versionType": "git"
},
{
"lessThan": "07c213f3499dd72e2922c1c73fe9ffea24874bef",
"status": "affected",
"version": "55d7c22192becd0ec827a6901899ff56fa985658",
"versionType": "git"
},
{
"lessThan": "1c9ba32308c02c198c378fcdf06be9ffc3111147",
"status": "affected",
"version": "55d7c22192becd0ec827a6901899ff56fa985658",
"versionType": "git"
},
{
"lessThan": "eecfb76129ebef7e3aa41e18a4668cd91dfc6267",
"status": "affected",
"version": "55d7c22192becd0ec827a6901899ff56fa985658",
"versionType": "git"
},
{
"lessThan": "06dc892561f5a08b2493c34c8ec2cb94dea33159",
"status": "affected",
"version": "55d7c22192becd0ec827a6901899ff56fa985658",
"versionType": "git"
},
{
"lessThan": "ccc42187fc2d0720947a63ce1b9e399d2c068ff4",
"status": "affected",
"version": "55d7c22192becd0ec827a6901899ff56fa985658",
"versionType": "git"
},
{
"lessThan": "82f1d6042611d45b8b9de423bbcb4e0ced9ec62b",
"status": "affected",
"version": "55d7c22192becd0ec827a6901899ff56fa985658",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/radeon/radeon_ring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix memory leak in radeon_ring_restore() on lock failure\n\nradeon_ring_restore() takes ownership of the data buffer allocated by\nradeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in\nthe non-restore branch; in the restore branch it relies on\nradeon_ring_restore() to free it.\n\nIf radeon_ring_lock() fails, the function returned early without calling\nkvfree(data), leaking the ring backup buffer on every GPU reset that\nfails at the lock stage. During repeated GPU resets this causes\ncumulative kernel memory exhaustion.\n\nFree data before returning the error."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:18:58.660Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/63912418f1fbb6456ea04bbcdf8f4d5090d23350"
},
{
"url": "https://git.kernel.org/stable/c/919e3e398bf301c6418dffdcd5e5c4fd9be39cf7"
},
{
"url": "https://git.kernel.org/stable/c/07c213f3499dd72e2922c1c73fe9ffea24874bef"
},
{
"url": "https://git.kernel.org/stable/c/1c9ba32308c02c198c378fcdf06be9ffc3111147"
},
{
"url": "https://git.kernel.org/stable/c/eecfb76129ebef7e3aa41e18a4668cd91dfc6267"
},
{
"url": "https://git.kernel.org/stable/c/06dc892561f5a08b2493c34c8ec2cb94dea33159"
},
{
"url": "https://git.kernel.org/stable/c/ccc42187fc2d0720947a63ce1b9e399d2c068ff4"
},
{
"url": "https://git.kernel.org/stable/c/82f1d6042611d45b8b9de423bbcb4e0ced9ec62b"
}
],
"title": "drm/radeon: fix memory leak in radeon_ring_restore() on lock failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74416",
"datePublished": "2026-08-15T05:59:22.077Z",
"dateReserved": "2026-08-15T05:44:03.893Z",
"dateUpdated": "2026-08-17T05:18:58.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64313 (GCVE-0-2026-64313)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: ecc - Fix carry overflow in vli multiplication
The carry flag calculation fails when r01.m_high is saturated
(0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows.
The condition (r01.m_high < product.m_high) doesn't handle the case
where r01.m_high == product.m_high and an additional carry exists
from lower-bit overflow.
When commit 3c4b23901a0c ("crypto: ecdh - Add ECDH software support")
introduced crypto/ecc.c, it split the muladd() function in the
micro-ecc library into separate mul_64_64() and add_128_128() helpers.
It seems the check got lost in translation.
Add proper handling for this boundary by accounting for the carry
from the lower addition.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 Version: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 Version: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 Version: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 Version: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 Version: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 Version: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 Version: 3c4b23901a0c766879dff680cd6bdab47bcdbbd2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64313",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:38:54.142625Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:23.266Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/ecc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d11b2bb99bec1f5557c01cac42231e23745f49b8",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "b709e0e768766abe29a49e1c1922a1604be602f4",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "24a54dfa06d09813b4802a374fad3d2c0e16a884",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "677450e5ef850c4d28b7956aa01104548c2a894e",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "5275e0fca256d081e2e7d4ba3dd8216c6e50d44e",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "774ddddf5eb26eeca177350413e3e2bc50930ee9",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "ebaae7c4251cc0cdb2602f334d4f08a3e82d271e",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
},
{
"lessThan": "27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406",
"status": "affected",
"version": "3c4b23901a0c766879dff680cd6bdab47bcdbbd2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/ecc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ecc - Fix carry overflow in vli multiplication\n\nThe carry flag calculation fails when r01.m_high is saturated\n(0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows.\n\nThe condition (r01.m_high \u003c product.m_high) doesn\u0027t handle the case\nwhere r01.m_high == product.m_high and an additional carry exists\nfrom lower-bit overflow.\n\nWhen commit 3c4b23901a0c (\"crypto: ecdh - Add ECDH software support\")\nintroduced crypto/ecc.c, it split the muladd() function in the\nmicro-ecc library into separate mul_64_64() and add_128_128() helpers.\nIt seems the check got lost in translation.\n\nAdd proper handling for this boundary by accounting for the carry\nfrom the lower addition."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The concrete unauthenticated external path is Bluetooth LE Secure Connections, where a nearby peer\u0027s SMP Public Key message reaches the flawed ECC multiplication. Bluetooth requires proximity rather than routable network access.\nAC:L - The attacker controls the ECC operands and can repeatedly submit deliberately constructed values that trigger the carry error. No race, unpredictable memory layout, or victim-controlled state is required.\nPR:N - SMP permits a peer to negotiate Secure Connections and submit its public key before credential validation, DHKey confirmation, or bonding completes. No local account or capability is required.\nUI:N - The peer\u0027s public key is validated and the ECDH secret is computed before authentication-method completion. Headless and Just Works deployments require no human action.\nS:U - The vulnerable arithmetic and affected cryptographic consumers operate within the same kernel security authority. The vulnerability does not inherently cross a VM, IOMMU, or comparable security boundary.\nC:H - Incorrect field multiplication can undermine public-key validation and ECDH shared-secret computation. Faulty-curve or key-agreement attacks could expose secrets and all data protected by derived session keys.\nI:H - The same faulty multiplication supports ECDSA and ECRDSA verification, making false cryptographic results and signature or peer-authentication bypass defensible. This can authorize attacker-controlled content, code, or commands.\nA:H - Authentication bypass can authorize attacker-controlled code or commands capable of halting the system, while repeated crafted exchanges can prevent secure pairing. Safety-critical or headless devices dependent on the affected trust path can lose their protected function completely."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:13.285Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d11b2bb99bec1f5557c01cac42231e23745f49b8"
},
{
"url": "https://git.kernel.org/stable/c/b709e0e768766abe29a49e1c1922a1604be602f4"
},
{
"url": "https://git.kernel.org/stable/c/24a54dfa06d09813b4802a374fad3d2c0e16a884"
},
{
"url": "https://git.kernel.org/stable/c/677450e5ef850c4d28b7956aa01104548c2a894e"
},
{
"url": "https://git.kernel.org/stable/c/5275e0fca256d081e2e7d4ba3dd8216c6e50d44e"
},
{
"url": "https://git.kernel.org/stable/c/774ddddf5eb26eeca177350413e3e2bc50930ee9"
},
{
"url": "https://git.kernel.org/stable/c/ebaae7c4251cc0cdb2602f334d4f08a3e82d271e"
},
{
"url": "https://git.kernel.org/stable/c/27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406"
}
],
"title": "crypto: ecc - Fix carry overflow in vli multiplication",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64313",
"datePublished": "2026-07-25T08:49:44.546Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-10-19T20:38:23.266Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68202 (GCVE-0-2026-68202)
Vulnerability from cvelistv5
Published
2026-08-10 12:00
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: close a re-opened queue timer in the destructor
queue_delete() closes the queue timer, then frees it. snd_seq_timer_close()
clears q->timer->timeri. snd_use_lock_sync() then drains borrowers, and
snd_seq_timer_delete() frees q->timer.
A borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT
that took a queueptr() use_lock reference before the queue was unlinked
runs snd_seq_timer_open() after the close. Open refuses re-open only while
timeri is set, and the close just cleared it, so it re-opens timeri.
snd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop()
is a no-op, because running was cleared first. So it frees q->timer with the
instance still live. The queue is freed next.
The instance stays on the global timer with callback_data pointing at the
freed queue. A non-owner START on the unlocked queue arms it. The next tick
derefs the freed queue in snd_seq_timer_interrupt().
Reachable by an unprivileged user with access to /dev/snd/seq. No CAP and
no queue ownership required.
Close any lingering instance in the destructor. There, ->timeri can no
longer change: the queue is unlinked and all use_lock borrowers have
drained, so no snd_seq_queue_use() can re-open it. Close it before clearing
q->timer. snd_timer_close() waits for any in-flight snd_seq_timer_interrupt()
to finish, and that callback still reads q->timer (via snd_seq_check_queue()),
so q->timer must stay valid until it drains.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68202",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:45:51.106270Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:57.086Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/seq/seq_timer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7feeaca1f53b10df9b4de9eaf611767ca70dc92",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7478ef94b49bc9789cf1a003deec58b42283dde4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9d9be6fc30f384f92c4e1b8ed40bd9d4796b7833",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fb40d03ed792a8a8bf77aa0ee15df57b0ff78b07",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "24f0cabf173539f048946c8fc221131dc221f277",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6a10025c7fd09a7d2af37a3ae1da188569fce470",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "31a6163e301d832060f8236f1ed17cbc1ca198df",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2c4dc0ed50b05cd847a4b34b8cebf0775f19aeb9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/seq/seq_timer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: close a re-opened queue timer in the destructor\n\nqueue_delete() closes the queue timer, then frees it. snd_seq_timer_close()\nclears q-\u003etimer-\u003etimeri. snd_use_lock_sync() then drains borrowers, and\nsnd_seq_timer_delete() frees q-\u003etimer.\n\nA borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT\nthat took a queueptr() use_lock reference before the queue was unlinked\nruns snd_seq_timer_open() after the close. Open refuses re-open only while\ntimeri is set, and the close just cleared it, so it re-opens timeri.\n\nsnd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop()\nis a no-op, because running was cleared first. So it frees q-\u003etimer with the\ninstance still live. The queue is freed next.\n\nThe instance stays on the global timer with callback_data pointing at the\nfreed queue. A non-owner START on the unlocked queue arms it. The next tick\nderefs the freed queue in snd_seq_timer_interrupt().\n\nReachable by an unprivileged user with access to /dev/snd/seq. No CAP and\nno queue ownership required.\n\nClose any lingering instance in the destructor. There, -\u003etimeri can no\nlonger change: the queue is unlinked and all use_lock borrowers have\ndrained, so no snd_seq_queue_use() can re-open it. Close it before clearing\nq-\u003etimer. snd_timer_close() waits for any in-flight snd_seq_timer_interrupt()\nto finish, and that callback still reads q-\u003etimer (via snd_seq_check_queue()),\nso q-\u003etimer must stay valid until it drains."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached through ioctls on the local character device /dev/snd/seq (SNDRV_SEQ_IOCTL_CREATE_QUEUE/DELETE_QUEUE/SET_QUEUE_CLIENT); no network or adjacent-network path exists to the ALSA sequencer.\nAC:L - The attacker controls both sides of the race \u2014 one thread deletes the queue while another spins on SET_QUEUE_CLIENT holding a queueptr() reference \u2014 and can retry the loop indefinitely on a default kernel with CONFIG_SND_SEQUENCER, so the window is reliably hit.\nPR:L - Only an unprivileged local user able to open /dev/snd/seq is needed; snd_seq_queue_use() performs no owner or access check and no capability is required, as the fix commit states explicitly.\nUI:N - The attacker\u0027s own threads create, delete and re-use the queue and the global system timer fires on its own; no victim action is involved.\nS:U - The use-after-free corrupts kernel heap objects within the same kernel security authority, giving at most kernel privilege escalation rather than crossing a VM, IOMMU or sandbox boundary.\nC:H - The stale timer instance dereferences the freed snd_seq_queue and snd_seq_timer, reading tick/time fields and freed prioq pointers that can be reclaimed by attacker-sprayed objects, giving a route to disclose arbitrary kernel memory.\nI:H - snd_seq_timer_interrupt() writes cur_time, tick and last_update into the freed snd_seq_timer slab and snd_seq_check_queue() dispatches events through freed queue pointers, yielding a controllable write primitive on reclaimed heap memory suitable for privilege escalation.\nA:H - Even unexploited, the timer callback derefs freed memory and takes a spinlock in a freed object from interrupt context, causing oops, lock corruption or panic \u2014 a repeatable denial of service for any local user."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:08.116Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7feeaca1f53b10df9b4de9eaf611767ca70dc92"
},
{
"url": "https://git.kernel.org/stable/c/7478ef94b49bc9789cf1a003deec58b42283dde4"
},
{
"url": "https://git.kernel.org/stable/c/9d9be6fc30f384f92c4e1b8ed40bd9d4796b7833"
},
{
"url": "https://git.kernel.org/stable/c/fb40d03ed792a8a8bf77aa0ee15df57b0ff78b07"
},
{
"url": "https://git.kernel.org/stable/c/24f0cabf173539f048946c8fc221131dc221f277"
},
{
"url": "https://git.kernel.org/stable/c/6a10025c7fd09a7d2af37a3ae1da188569fce470"
},
{
"url": "https://git.kernel.org/stable/c/31a6163e301d832060f8236f1ed17cbc1ca198df"
},
{
"url": "https://git.kernel.org/stable/c/2c4dc0ed50b05cd847a4b34b8cebf0775f19aeb9"
}
],
"title": "ALSA: seq: close a re-opened queue timer in the destructor",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68202",
"datePublished": "2026-08-10T12:00:21.279Z",
"dateReserved": "2026-07-30T09:28:09.374Z",
"dateUpdated": "2026-10-19T20:58:57.086Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63860 (GCVE-0-2026-63860)
Vulnerability from cvelistv5
Published
2026-07-19 14:04
Modified
2026-10-19 20:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Prefer NLA_NUL_STRING
These attributes are evaluated as c-string (passed to strcmp), but
NLA_STRING doesn't check for the presence of a \0 terminator.
Either this needs to switch to nla_strcmp() and needs to adjust printf fmt
specifier to not use plain %s, or this needs to use NLA_NUL_STRING.
As the code has been this way for long time, it seems to me that userspace
does include the terminating nul, even tough its not enforced so far, and
thus NLA_NUL_STRING use is the simpler solution.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:32:29.749777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-170",
"description": "CWE-170 Improper Null Termination",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:07:52.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/iwpm_msg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "87111356d58d86edb221ba144d261ed83a5b8bbe",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "abda65bdd13084c771842adaac1f652d0660dd82",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "137b5918931d4d05aa8ea8d3adf67f7224eef63c",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "5877c043398d5fa0e93919a3d837e5cd7a98a961",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "f2c7b39dde2e61df8157066969cc2a408cd3dcd9",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "c26a0052cceed4c4d380ee5808b699f937fb58d8",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "6ed3d14fc45d3da6025e7fe4a6a09066856698e2",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/iwpm_msg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Prefer NLA_NUL_STRING\n\nThese attributes are evaluated as c-string (passed to strcmp), but\nNLA_STRING doesn\u0027t check for the presence of a \\0 terminator.\n\nEither this needs to switch to nla_strcmp() and needs to adjust printf fmt\nspecifier to not use plain %s, or this needs to use NLA_NUL_STRING.\n\nAs the code has been this way for long time, it seems to me that userspace\ndoes include the terminating nul, even tough its not enforced so far, and\nthus NLA_NUL_STRING use is the simpler solution."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached when userspace sends crafted NETLINK_RDMA (protocol 20) messages to the iWARP Port Mapper netlink handlers in `iwpm_register_pid_cb()` and `iwpm_mapping_info_cb()`, not from remote network packets.\nAC:L - An attacker fully controls the netlink attribute payload and can send a maximal-length string without a NUL terminator to reliably trigger unbounded `strcmp()` reads; no race or victim-dependent state is required beyond reaching the handler.\nPR:N - IWPM netlink ops lack `RDMA_NL_ADMIN_PERM`, and `netlink_sendmsg()` only enforces `CAP_NET_ADMIN` when `dst_pid` or `dst_group` is non-zero, so an unprivileged local process can send messages to the kernel RDMA netlink socket without capabilities or user-namespace tricks.\nUI:N - Exploitation requires only a local process sending a crafted netlink message; no victim interaction such as mounting a filesystem or opening a device is needed.\nS:U - Impact is confined to kernel RDMA/iWARP port-mapper state (e.g., `iwpm_user_pid`, mapping tables) within the same kernel security authority and does not cross VM, container, or IOMMU boundaries.\nC:H - `NLA_STRING` does not enforce a NUL terminator, yet `strcmp()` reads until `\\0`, causing an out-of-bounds kernel read past the attribute boundary; error paths also pass the pointer to `%s` in `pr_info()`, enabling further kernel memory disclosure.\nI:H - By sending exactly 19 bytes of `iWarpPortMapperUser` without a terminator, an attacker can make `strcmp()` read a NUL from NLA padding and pass validation, hijacking `iwpm_user_pid` and redirecting subsequent iWARP port-mapping operations to attacker-controlled userspace.\nA:H - Unbounded `strcmp()` on a non-NUL-terminated netlink attribute can read beyond the skb buffer and trigger a kernel page fault/oops, and successful port-mapper impersonation can disrupt iWARP connectivity on affected systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:36:38.134Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf"
},
{
"url": "https://git.kernel.org/stable/c/87111356d58d86edb221ba144d261ed83a5b8bbe"
},
{
"url": "https://git.kernel.org/stable/c/abda65bdd13084c771842adaac1f652d0660dd82"
},
{
"url": "https://git.kernel.org/stable/c/137b5918931d4d05aa8ea8d3adf67f7224eef63c"
},
{
"url": "https://git.kernel.org/stable/c/5877c043398d5fa0e93919a3d837e5cd7a98a961"
},
{
"url": "https://git.kernel.org/stable/c/f2c7b39dde2e61df8157066969cc2a408cd3dcd9"
},
{
"url": "https://git.kernel.org/stable/c/c26a0052cceed4c4d380ee5808b699f937fb58d8"
},
{
"url": "https://git.kernel.org/stable/c/6ed3d14fc45d3da6025e7fe4a6a09066856698e2"
}
],
"title": "RDMA/core: Prefer NLA_NUL_STRING",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63860",
"datePublished": "2026-07-19T14:04:48.153Z",
"dateReserved": "2026-07-19T07:54:57.017Z",
"dateUpdated": "2026-10-19T20:07:52.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74669 (GCVE-0-2026-74669)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-10-16 19:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the
quoted original request before passing it to icmp_send(). However,
IPCB(skb)->opt still describes the outer IPv4 header.
A timestamp option in the outer header can therefore leave an offset
that points into the quoted transport header after the rebase.
__ip_options_echo() treats a byte at that stale location as the option
length and copies it into the fixed-size option storage on the
__icmp_send() stack, causing a stack out-of-bounds write.
Clear the stale option metadata after resetting the network header.
Keep the remaining control block fields, including the ingress
interface used by the ICMP response path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e Version: f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74669",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:14:21.602938Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:08.572Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "79ffa99202c944467e28b13b513bf2998732edff",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "c9413b50204738fbc429bb86bf01353c393a6c28",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "37c61b3745129cbd682c557b51345828120972e5",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "ed246dd85ebf27c1f6b7897834d40786c0ca3006",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "6f46fc460e9316062bdcdf89199eb5d7a33da33b",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "75eec935444db4af2123e0491936f6e273d7ea00",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "384b4dae14277d369221d187e9b3af56c79d2e50",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
},
{
"lessThan": "e0ba936287dfe9783426aac27e5fd76fe35b38c9",
"status": "affected",
"version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)-\u003eopt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:24.114Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff"
},
{
"url": "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28"
},
{
"url": "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5"
},
{
"url": "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006"
},
{
"url": "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b"
},
{
"url": "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00"
},
{
"url": "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50"
},
{
"url": "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9"
}
],
"title": "ipvs: clear IPv4 options after rebasing tunnel ICMP errors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74669",
"datePublished": "2026-08-22T15:32:40.221Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-10-16T19:16:08.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64011 (GCVE-0-2026-64011)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-08-05 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: Fix use-after-free in llcp_sock_release()
llcp_sock_release() unconditionally unlinks the socket from the local
sockets list. However, if the socket is still in connecting state, it
is on the connecting list.
Fix this by checking the socket state and unlinking from the correct list.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 Version: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 Version: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 Version: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 Version: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 Version: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 Version: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 Version: b4011239a08e7e6c2c6e970dfa9e8ecb73139261 Version: da989ee1c7702050741a551df6866cc1588f277b Version: 3.10.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/nfc/llcp_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89ba026747019ee643d29407435ddc118e6ca908",
"status": "affected",
"version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
"versionType": "git"
},
{
"lessThan": "fb29f6bbe433f3decad227588809636c25f2a287",
"status": "affected",
"version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
"versionType": "git"
},
{
"lessThan": "2dfdaaf7d933b676124aadec6698825e95f94fe9",
"status": "affected",
"version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
"versionType": "git"
},
{
"lessThan": "e00f50f8697724a6f1d2d35744c1332c9912dac5",
"status": "affected",
"version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
"versionType": "git"
},
{
"lessThan": "cdc17e09a636c7f936f771902535a7515a7608fc",
"status": "affected",
"version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
"versionType": "git"
},
{
"lessThan": "912ebc49d4406a17fe73e5671d674fbc2f6b2634",
"status": "affected",
"version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
"versionType": "git"
},
{
"lessThan": "bc421d0826dedbba37580a25405eafb599e76d42",
"status": "affected",
"version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
"versionType": "git"
},
{
"lessThan": "f4268b466190dae95a7585f69b4f1f8ad097632c",
"status": "affected",
"version": "b4011239a08e7e6c2c6e970dfa9e8ecb73139261",
"versionType": "git"
},
{
"status": "affected",
"version": "da989ee1c7702050741a551df6866cc1588f277b",
"versionType": "git"
},
{
"lessThan": "3.11",
"status": "affected",
"version": "3.10.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/nfc/llcp_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.11"
},
{
"lessThan": "3.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix use-after-free in llcp_sock_release()\n\nllcp_sock_release() unconditionally unlinks the socket from the local\nsockets list. However, if the socket is still in connecting state, it\nis on the connecting list.\n\nFix this by checking the socket state and unlinking from the correct list."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is triggered in llcp_sock_release() via the local close(2) syscall on an AF_NFC LLCP socket left in LLCP_CONNECTING after a non-blocking connect(); no remote network protocol reaches this unlink path directly.\nAC:L - An attacker fully controls the race by opening an LLCP socket, calling connect() with O_NONBLOCK, and immediately closing it; no privileged setup or uncontrollable memory-layout conditions are required beyond an active NFC DEP link.\nPR:L - SOCK_STREAM/SOCK_DGRAM LLCP sockets require no capability checks at creation or release (only SOCK_RAW needs CAP_NET_RAW), so any unprivileged local process in init_net can reach the vulnerable close() path once an NFC DEP session is up.\nUI:N - Exploitation requires only programmatic socket connect/close calls from a malicious local process; no victim user action (such as tapping, mounting, or opening a file) is needed at exploit time if an NFC link is already established.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security boundary and can lead to local privilege escalation, not a cross-boundary escape such as VM or sandbox breakout.\nC:H - This is a kernel heap use-after-free of struct nfc_llcp_sock; freed socket objects can be reallocated and read through subsequent list lookups or concurrent recv_cc()/recv_dm() processing, enabling arbitrary kernel memory disclosure.\nI:H - A use-after-free on a socket structure embedded in struct sock provides standard kernel heap-spray primitives that can be leveraged for arbitrary write and local privilege escalation via control-flow hijacking.\nA:H - The use-after-free can cause immediate kernel oops/panic during concurrent list traversal or socket teardown, and successful exploitation yields full kernel compromise with total system unavailability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:11.263Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/89ba026747019ee643d29407435ddc118e6ca908"
},
{
"url": "https://git.kernel.org/stable/c/fb29f6bbe433f3decad227588809636c25f2a287"
},
{
"url": "https://git.kernel.org/stable/c/2dfdaaf7d933b676124aadec6698825e95f94fe9"
},
{
"url": "https://git.kernel.org/stable/c/e00f50f8697724a6f1d2d35744c1332c9912dac5"
},
{
"url": "https://git.kernel.org/stable/c/cdc17e09a636c7f936f771902535a7515a7608fc"
},
{
"url": "https://git.kernel.org/stable/c/912ebc49d4406a17fe73e5671d674fbc2f6b2634"
},
{
"url": "https://git.kernel.org/stable/c/bc421d0826dedbba37580a25405eafb599e76d42"
},
{
"url": "https://git.kernel.org/stable/c/f4268b466190dae95a7585f69b4f1f8ad097632c"
}
],
"title": "nfc: llcp: Fix use-after-free in llcp_sock_release()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64011",
"datePublished": "2026-07-19T14:56:25.901Z",
"dateReserved": "2026-07-19T07:54:57.027Z",
"dateUpdated": "2026-08-05T12:38:11.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68129 (GCVE-0-2026-68129)
Vulnerability from cvelistv5
Published
2026-08-10 11:58
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gve: fix Rx queue stall on alloc failure
When the system is under extreme memory pressure, page allocations can
fail during the Rx buffer refill loop. If the number of buffers posted
to hardware falls below a critical low threshold and the refill loop
exits due to allocation failures, the queue can stall:
1. The device drops incoming packets because there are no descriptors.
2. Since no packets are processed, no Rx completions are generated.
3. Because no completions occur, NAPI is never scheduled, preventing
the refill loop from running again even after memory is freed.
This results in a permanent queue stall.
Resolve this by introducing a starvation recovery timer for each Rx queue.
If the number of buffers posted to hardware falls below a critical low
threshold, start a timer to periodically reschedule NAPI. Once NAPI runs
and successfully refills the queue above the threshold, the timer is
not rescheduled.
The threshold is set to 32 because a single maximum-sized Receive Segment
Coalescing (RSC) packet can consume up to 19 descriptors in the Rx path.
Lower thresholds (such as 8 or 16) would be insufficient to process a
complete maximum-sized RSC packet, risking packet drops or unexpected
hardware behavior under memory pressure. Setting the threshold to 32
guarantees a safe margin to handle at least one full RSC packet.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 Version: 9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 Version: 9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 Version: 9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 Version: 9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 Version: 9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 Version: 9b8dd5e5ea48bbb7532d20c4093a79d8283e4029 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68129",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:44:23.505805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:52.534Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/google/gve/gve.h",
"drivers/net/ethernet/google/gve/gve_rx_dqo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9db46e19e5d6bdcd4bf811284a5b0df1b984ef80",
"status": "affected",
"version": "9b8dd5e5ea48bbb7532d20c4093a79d8283e4029",
"versionType": "git"
},
{
"lessThan": "42d525e751c61b876b2b0ae4e71ba7a8ab0c2777",
"status": "affected",
"version": "9b8dd5e5ea48bbb7532d20c4093a79d8283e4029",
"versionType": "git"
},
{
"lessThan": "299d5728a7312fdd02059b074aebbe4ebbd391e4",
"status": "affected",
"version": "9b8dd5e5ea48bbb7532d20c4093a79d8283e4029",
"versionType": "git"
},
{
"lessThan": "0c317349b4baa5038d1fc373bf46d5a2419d1710",
"status": "affected",
"version": "9b8dd5e5ea48bbb7532d20c4093a79d8283e4029",
"versionType": "git"
},
{
"lessThan": "91e0249f3ef62b75fe8c9c9372eaba32876e4b3a",
"status": "affected",
"version": "9b8dd5e5ea48bbb7532d20c4093a79d8283e4029",
"versionType": "git"
},
{
"lessThan": "689b9f588d2d7323dc66293fe594a68d030f400f",
"status": "affected",
"version": "9b8dd5e5ea48bbb7532d20c4093a79d8283e4029",
"versionType": "git"
},
{
"lessThan": "b65352a1bac64442ad95e64f385b40ccb9f1b0db",
"status": "affected",
"version": "9b8dd5e5ea48bbb7532d20c4093a79d8283e4029",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/google/gve/gve.h",
"drivers/net/ethernet/google/gve/gve_rx_dqo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: fix Rx queue stall on alloc failure\n\nWhen the system is under extreme memory pressure, page allocations can\nfail during the Rx buffer refill loop. If the number of buffers posted\nto hardware falls below a critical low threshold and the refill loop\nexits due to allocation failures, the queue can stall:\n\n1. The device drops incoming packets because there are no descriptors.\n2. Since no packets are processed, no Rx completions are generated.\n3. Because no completions occur, NAPI is never scheduled, preventing\n the refill loop from running again even after memory is freed.\n\nThis results in a permanent queue stall.\n\nResolve this by introducing a starvation recovery timer for each Rx queue.\nIf the number of buffers posted to hardware falls below a critical low\nthreshold, start a timer to periodically reschedule NAPI. Once NAPI runs\nand successfully refills the queue above the threshold, the timer is\nnot rescheduled.\n\nThe threshold is set to 32 because a single maximum-sized Receive Segment\nCoalescing (RSC) packet can consume up to 19 descriptors in the Rx path.\nLower thresholds (such as 8 or 16) would be insufficient to process a\ncomplete maximum-sized RSC packet, risking packet drops or unexpected\nhardware behavior under memory pressure. Setting the threshold to 32\nguarantees a safe margin to handle at least one full RSC packet."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is in the gVNIC receive/refill path driven by incoming network traffic on internet-facing Google Cloud VMs; remote packets trigger NAPI polling that reaches gve_rx_post_buffers_dqo() where the stall occurs.\nAC:L - An attacker can reliably drive the vulnerable refill loop by sending high-volume traffic to exhaust RX page-pool buffers and pressure GFP_ATOMIC allocations; no race or rare layout is required beyond sustained network load.\nPR:N - Exploitation requires only the ability to send packets to the VM\u0027s gVNIC interface; no local account, capabilities, or authentication is needed on internet-reachable cloud instances.\nUI:N - No victim interaction is required; the permanent RX queue stall is triggered automatically during kernel packet receive processing under memory pressure.\nS:U - Impact is confined to the affected guest\u0027s network stack and does not cross VM, container, or IOMMU security boundaries; it is a guest-local denial of service, not an escape.\nC:N - This is a resource-management logic bug causing queue starvation with no out-of-bounds access, use-after-free, or information disclosure; no kernel or user memory is read by the attacker.\nI:N - The bug causes a permanent receive-queue stall without modifying kernel data structures, user data, or enabling code execution; there is no integrity impact beyond loss of connectivity.\nA:H - A failed refill below the 32-descriptor threshold permanently stalls the RX queue because no completions schedule NAPI again, causing lasting loss of network receive capability until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:44.226Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9db46e19e5d6bdcd4bf811284a5b0df1b984ef80"
},
{
"url": "https://git.kernel.org/stable/c/42d525e751c61b876b2b0ae4e71ba7a8ab0c2777"
},
{
"url": "https://git.kernel.org/stable/c/299d5728a7312fdd02059b074aebbe4ebbd391e4"
},
{
"url": "https://git.kernel.org/stable/c/0c317349b4baa5038d1fc373bf46d5a2419d1710"
},
{
"url": "https://git.kernel.org/stable/c/91e0249f3ef62b75fe8c9c9372eaba32876e4b3a"
},
{
"url": "https://git.kernel.org/stable/c/689b9f588d2d7323dc66293fe594a68d030f400f"
},
{
"url": "https://git.kernel.org/stable/c/b65352a1bac64442ad95e64f385b40ccb9f1b0db"
}
],
"title": "gve: fix Rx queue stall on alloc failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68129",
"datePublished": "2026-08-10T11:58:51.406Z",
"dateReserved": "2026-07-30T09:28:09.370Z",
"dateUpdated": "2026-10-19T20:58:52.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45941 (GCVE-0-2026-45941)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
get_burstcount() can return -EBUSY on timeout. When this happens, the
function returns directly without releasing the locality that was
acquired at the beginning of tpm_tis_i2c_send().
Use goto out_err to ensure proper cleanup when get_burstcount() fails.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/tpm/tpm_i2c_infineon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8f124c5582d443ac9fb690db26d08cab5d6ba76e",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "c24c9c4cab11858f22f309521ba7ea5b1e7385f2",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "1bb8f8826d0748b4b92a98fb6b6dfe52081739f5",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "948966e546f29af04391d98b8e378e4a7670c1c1",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "a61b8412e3eb8b71646dba867e8252d8560a1a27",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "1a22048c1117cdfac185ba450aba67ed6b65dc87",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "2f7a665e1323359d99c74301d1e180f5e2c40181",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "bbd6e97c836cbeb9606d7b7e5dcf8a1d89525713",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/tpm/tpm_i2c_infineon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure\n\nget_burstcount() can return -EBUSY on timeout. When this happens, the\nfunction returns directly without releasing the locality that was\nacquired at the beginning of tpm_tis_i2c_send().\n\nUse goto out_err to ensure proper cleanup when get_burstcount() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:57.155Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8f124c5582d443ac9fb690db26d08cab5d6ba76e"
},
{
"url": "https://git.kernel.org/stable/c/c24c9c4cab11858f22f309521ba7ea5b1e7385f2"
},
{
"url": "https://git.kernel.org/stable/c/1bb8f8826d0748b4b92a98fb6b6dfe52081739f5"
},
{
"url": "https://git.kernel.org/stable/c/948966e546f29af04391d98b8e378e4a7670c1c1"
},
{
"url": "https://git.kernel.org/stable/c/a61b8412e3eb8b71646dba867e8252d8560a1a27"
},
{
"url": "https://git.kernel.org/stable/c/1a22048c1117cdfac185ba450aba67ed6b65dc87"
},
{
"url": "https://git.kernel.org/stable/c/2f7a665e1323359d99c74301d1e180f5e2c40181"
},
{
"url": "https://git.kernel.org/stable/c/bbd6e97c836cbeb9606d7b7e5dcf8a1d89525713"
}
],
"title": "tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45941",
"datePublished": "2026-05-27T12:17:57.155Z",
"dateReserved": "2026-05-13T15:03:33.087Z",
"dateUpdated": "2026-05-27T12:17:57.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64471 (GCVE-0-2026-64471)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: fix use-after-free on registration failure
Make sure to release the sibling interfaces in case controller
registration fails to avoid use-after-free and double-free when they are
eventually disconnected.
This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9bfa35fe422c74882e27cc54450a5f76c96aad68 Version: 9bfa35fe422c74882e27cc54450a5f76c96aad68 Version: 9bfa35fe422c74882e27cc54450a5f76c96aad68 Version: 9bfa35fe422c74882e27cc54450a5f76c96aad68 Version: 9bfa35fe422c74882e27cc54450a5f76c96aad68 Version: 9bfa35fe422c74882e27cc54450a5f76c96aad68 Version: 9bfa35fe422c74882e27cc54450a5f76c96aad68 Version: 9bfa35fe422c74882e27cc54450a5f76c96aad68 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e09ac7d0c6859a360bf36e7104aef03f88184e0b",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "468fcdfaeb937163dd250773a9fed17ab1fa203c",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "1ce5012944afaddbda939ec6bae9800fce84abbc",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "e6313b800da61a26c2fdd5eba0105e197c0ab3bc",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "14e02f1449ba425a44dedbec9a21efafb056e09f",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "8db0ce3de78367f61c2970c0f16d9adee8830a23",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "da7d7758fe884b256ddc9fef562e5ddef7952383",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
},
{
"lessThan": "eedc6867ebad73edbfaf9a0a65fbef7115cc4753",
"status": "affected",
"version": "9bfa35fe422c74882e27cc54450a5f76c96aad68",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: fix use-after-free on registration failure\n\nMake sure to release the sibling interfaces in case controller\nregistration fails to avoid use-after-free and double-free when they are\neventually disconnected.\n\nThis issue was reported by Sashiko while reviewing a fix for a wakeup\nsource leak in the btusb probe errors paths."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:56:17.111Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e09ac7d0c6859a360bf36e7104aef03f88184e0b"
},
{
"url": "https://git.kernel.org/stable/c/468fcdfaeb937163dd250773a9fed17ab1fa203c"
},
{
"url": "https://git.kernel.org/stable/c/1ce5012944afaddbda939ec6bae9800fce84abbc"
},
{
"url": "https://git.kernel.org/stable/c/e6313b800da61a26c2fdd5eba0105e197c0ab3bc"
},
{
"url": "https://git.kernel.org/stable/c/14e02f1449ba425a44dedbec9a21efafb056e09f"
},
{
"url": "https://git.kernel.org/stable/c/8db0ce3de78367f61c2970c0f16d9adee8830a23"
},
{
"url": "https://git.kernel.org/stable/c/da7d7758fe884b256ddc9fef562e5ddef7952383"
},
{
"url": "https://git.kernel.org/stable/c/eedc6867ebad73edbfaf9a0a65fbef7115cc4753"
}
],
"title": "Bluetooth: btusb: fix use-after-free on registration failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64471",
"datePublished": "2026-07-25T08:51:35.245Z",
"dateReserved": "2026-07-19T15:36:31.790Z",
"dateUpdated": "2026-08-17T04:56:17.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74302 (GCVE-0-2026-74302)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
hci_unregister_dev() does not disable cmd_timer and ncmd_timer
before the hci_dev structure is freed. If a timeout fires
during device teardown, the callback dereferences freed memory
(including the hdev->reset function pointer), leading to a
use-after-free.
Add disable_delayed_work_sync() calls alongside the existing
disable_work_sync() calls to ensure both timers are fully
quiesced before teardown proceeds.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d6cbce18370641a21dd889e8613d8153df15eb39 Version: 0d151a103775dd9645c78c97f77d6e2a5298d913 Version: 0d151a103775dd9645c78c97f77d6e2a5298d913 Version: 0d151a103775dd9645c78c97f77d6e2a5298d913 Version: 0d151a103775dd9645c78c97f77d6e2a5298d913 Version: 48542881997e17b49dc16b93fe910e0cfcf7a9f9 Version: 9cfc84b1d464cc024286f42a090718f9067b80ed Version: ddeda6ca5f218b668b560d90fc31ae469adbfd92 Version: d2ce562a5aff1dcd0c50d9808ea825ef90da909f Version: 96600c2e5ee8213dbab5df1617293d8e847bb4fa Version: 3f939bd73fed12dddc2a32a76116c19ca47c7678 Version: 6.6.42 ≤ Version: 4.19.319 ≤ Version: 5.4.281 ≤ Version: 5.10.223 ≤ Version: 5.15.164 ≤ Version: 6.1.101 ≤ Version: 6.9.11 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:52:48.387407Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:31.734Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bce2eec05bce548b548aca52c1834540f97d5d60",
"status": "affected",
"version": "d6cbce18370641a21dd889e8613d8153df15eb39",
"versionType": "git"
},
{
"lessThan": "48c7ad6afcc58c2cda11fed39791708103b6a644",
"status": "affected",
"version": "0d151a103775dd9645c78c97f77d6e2a5298d913",
"versionType": "git"
},
{
"lessThan": "a0fd1086a57b982f8c24ae4ab165c2af39fe1735",
"status": "affected",
"version": "0d151a103775dd9645c78c97f77d6e2a5298d913",
"versionType": "git"
},
{
"lessThan": "672d52d9412252e61b8de8d773ccdf5a277cf540",
"status": "affected",
"version": "0d151a103775dd9645c78c97f77d6e2a5298d913",
"versionType": "git"
},
{
"lessThan": "5edcc018fa6e80b2c478454a4a8229c23d67c181",
"status": "affected",
"version": "0d151a103775dd9645c78c97f77d6e2a5298d913",
"versionType": "git"
},
{
"status": "affected",
"version": "48542881997e17b49dc16b93fe910e0cfcf7a9f9",
"versionType": "git"
},
{
"status": "affected",
"version": "9cfc84b1d464cc024286f42a090718f9067b80ed",
"versionType": "git"
},
{
"status": "affected",
"version": "ddeda6ca5f218b668b560d90fc31ae469adbfd92",
"versionType": "git"
},
{
"status": "affected",
"version": "d2ce562a5aff1dcd0c50d9808ea825ef90da909f",
"versionType": "git"
},
{
"status": "affected",
"version": "96600c2e5ee8213dbab5df1617293d8e847bb4fa",
"versionType": "git"
},
{
"status": "affected",
"version": "3f939bd73fed12dddc2a32a76116c19ca47c7678",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.42",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.319",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.281",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.223",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.164",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.101",
"versionType": "semver"
},
{
"lessThan": "6.10",
"status": "affected",
"version": "6.9.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.319",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.281",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.223",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.164",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.101",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix UAF in hci_unregister_dev()\n\nhci_unregister_dev() does not disable cmd_timer and ncmd_timer\nbefore the hci_dev structure is freed. If a timeout fires\nduring device teardown, the callback dereferences freed memory\n(including the hdev-\u003ereset function pointer), leading to a\nuse-after-free.\n\nAdd disable_delayed_work_sync() calls alongside the existing\ndisable_work_sync() calls to ensure both timers are fully\nquiesced before teardown proceeds."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached only during hci_unregister_dev() teardown (e.g. closing /dev/vhci, USB/btusb disconnect, hci_ldisc detach, or driver removal); adjacent Bluetooth peers can arm cmd_timer/ncmd_timer via HCI timeouts but cannot invoke unregister, so exploitation requires local device/syscall access.\nAC:L - An attacker controls both sides of the race\u2014arming cmd_timer (2s) or ncmd_timer (4s) by withholding HCI command completions while closing /dev/vhci to run hci_unregister_dev(), and disable_work_sync(cmd_work) can queue cmd_timer immediately before teardown; the cycle is repeatable.\nPR:L - vhci_open() has no capable() check, so any principal granted /dev/vhci (syzkaller, containers, Android bluetooth uid, permissive udev) can create/destroy virtual HCI controllers and inject frames without init-namespace root, matching prior hci_unregister_dev teardown UAF scores.\nUI:N - The attacker performs device creation, HCI traffic injection, and teardown from its own process via open/write/close on /dev/vhci or equivalent local transport; no victim interaction or cooperation is required beyond existing device-node access.\nS:U - Corruption is confined to kernel slab memory and workqueue/timer state within the same kernel security authority; exploitation yields standard kernel privilege escalation, not VM escape, IOMMU bypass, or cross-sandbox boundary crossing.\nC:H - hci_cmd_timeout() and hci_ncmd_timeout() dereference the freed hci_dev (req_skb, flags, workqueue, name) after kfree(); UAF on the hci_dev slab enables controlled reallocation and arbitrary kernel memory read/pointer disclosure via heap spraying.\nI:H - hci_cmd_timeout() invokes the freed hdev-\u003ereset function pointer and re-queues cmd_work on hdev-\u003eworkqueue; attacker-controlled contents in the reclaimed hci_dev object provide arbitrary write and control-flow hijack primitives per kernel UAF scoring guidance.\nA:H - Timer callbacks operating on freed hci_dev memory cause KASAN slab-use-after-free reports, kernel oops/panic, and can queue work onto destroyed workqueues; even failed exploitation reliably crashes or hangs the affected controller path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:17.382Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bce2eec05bce548b548aca52c1834540f97d5d60"
},
{
"url": "https://git.kernel.org/stable/c/48c7ad6afcc58c2cda11fed39791708103b6a644"
},
{
"url": "https://git.kernel.org/stable/c/a0fd1086a57b982f8c24ae4ab165c2af39fe1735"
},
{
"url": "https://git.kernel.org/stable/c/672d52d9412252e61b8de8d773ccdf5a277cf540"
},
{
"url": "https://git.kernel.org/stable/c/5edcc018fa6e80b2c478454a4a8229c23d67c181"
}
],
"title": "Bluetooth: hci_core: Fix UAF in hci_unregister_dev()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74302",
"datePublished": "2026-08-15T05:58:04.638Z",
"dateReserved": "2026-08-15T05:44:03.882Z",
"dateUpdated": "2026-10-21T12:45:17.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64551 (GCVE-0-2026-64551)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate STALE_COOKIE cause length before reading staleness
When an ERROR chunk with a STALE_COOKIE cause is received in the
COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure
of Staleness that follows the cause header:
err = (struct sctp_errhdr *)(chunk->skb->data);
stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
err is the first cause in the chunk, not the STALE_COOKIE cause that
caused the dispatch, and nothing guarantees the staleness field is
present. sctp_walk_errors() only requires a cause to be as long as the
4-byte header, so for a STALE_COOKIE cause of length 4 the read runs
past the cause, and for a minimal ERROR chunk past skb->tail. The value
is echoed to the peer in the Cookie Preservative of the reply INIT,
leaking uninitialized memory.
sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so
check its length there and pass it to sctp_sf_do_5_2_6_stale(), which
reads that cause instead of the first one. A STALE_COOKIE cause too
short to hold the staleness field is discarded.
The read is reachable by any peer that can drive an association into
COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket
in a user and network namespace.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64551",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:25.961430Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:40.456Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6022da37786701df1fc5dd946a6dcba59d5473b1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "861f884f5471632c731cbbd612a1c072e391a624",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "588706ebaf8cdb4a4161602949eba365514b1db1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a257b41ddfe9e327b26581ad2777f04b23ac73f5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "08a8f2d13f703924316e9aeac863a88ef50990c7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ebe0a55d954fa8da383b6192edb8f763dcb002d5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bbd6b2ea966cf57b6ae095cf5a8dbc993cd197a0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1cd23ca80784223fa2204e16203f754da4e821f8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate STALE_COOKIE cause length before reading staleness\n\nWhen an ERROR chunk with a STALE_COOKIE cause is received in the\nCOOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure\nof Staleness that follows the cause header:\n\n\terr = (struct sctp_errhdr *)(chunk-\u003eskb-\u003edata);\n\tstale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));\n\nerr is the first cause in the chunk, not the STALE_COOKIE cause that\ncaused the dispatch, and nothing guarantees the staleness field is\npresent. sctp_walk_errors() only requires a cause to be as long as the\n4-byte header, so for a STALE_COOKIE cause of length 4 the read runs\npast the cause, and for a minimal ERROR chunk past skb-\u003etail. The value\nis echoed to the peer in the Cookie Preservative of the reply INIT,\nleaking uninitialized memory.\n\nsctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so\ncheck its length there and pass it to sctp_sf_do_5_2_6_stale(), which\nreads that cause instead of the first one. A STALE_COOKIE cause too\nshort to hold the staleness field is discarded.\n\nThe read is reachable by any peer that can drive an association into\nCOOKIE_ECHOED, including an unprivileged process using a raw SCTP socket\nin a user and network namespace."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is in the SCTP receive-side state machine and is driven entirely by an attacker-crafted ERROR chunk arriving over the network; no local access is needed. Per kernel guidance, net/ stack bugs reachable via received packets (SCTP explicitly) are Network.\nAC:L - The attacker fully controls the trigger: acting as the SCTP peer it answers INIT with INIT-ACK to place the association in COOKIE_ECHOED, then sends a minimal ERROR chunk with a 4-byte STALE_COOKIE cause as the last chunk in the packet. There is no race, no memory-layout dependency, and the vtag needed is the one the victim itself advertised in its INIT.\nPR:N - SCTP association setup is unauthenticated; the only check is sctp_vtag_verify() against a tag the peer already received in the victim\u0027s INIT. The attacker needs no credentials or privileges on the target system.\nUI:N - No human user action is required \u2014 SCTP client daemons (SIGTRAN, Diameter, cluster transports) establish and retry associations automatically, and an on-path attacker can inject the ERROR into an in-progress handshake. In the local variant an unprivileged process creates both sides itself with no user involved.\nS:U - The out-of-bounds read and the resulting disclosure stay within the kernel\u0027s own security authority; no VM, sandbox, or IOMMU boundary is crossed.\nC:H - Uninitialized kernel memory past skb-\u003etail is read and then transmitted straight back to the attacker inside the reply INIT\u0027s Cookie Preservative parameter, and the attack can be repeated indefinitely to sample recycled network-buffer memory that may contain remnants of other connections\u0027 traffic. This is a remote, unauthenticated, repeatable kernel heap disclosure oracle, matching the C:H treatment given to the sibling SCTP uninit-read CVE-2026-53225.\nI:N - The bug is a pure read; nothing in kernel memory or in the victim\u0027s association state is modified. The only affected value is a protocol field in a packet sent to the attacker itself.\nA:H - The read runs past the end of the received packet data, a memory-safety violation whose target is not proven to remain inside the skb\u0027s allocation across all receive paths (GSO/frag_list segments, UDP-encapsulated and linearized skbs), so it can fault and oops; kernel guidance and the CNA\u0027s scoring of the equivalent SCTP out-of-bounds-read bug both treat this class as A:H."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:28.771Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6022da37786701df1fc5dd946a6dcba59d5473b1"
},
{
"url": "https://git.kernel.org/stable/c/861f884f5471632c731cbbd612a1c072e391a624"
},
{
"url": "https://git.kernel.org/stable/c/588706ebaf8cdb4a4161602949eba365514b1db1"
},
{
"url": "https://git.kernel.org/stable/c/a257b41ddfe9e327b26581ad2777f04b23ac73f5"
},
{
"url": "https://git.kernel.org/stable/c/08a8f2d13f703924316e9aeac863a88ef50990c7"
},
{
"url": "https://git.kernel.org/stable/c/ebe0a55d954fa8da383b6192edb8f763dcb002d5"
},
{
"url": "https://git.kernel.org/stable/c/bbd6b2ea966cf57b6ae095cf5a8dbc993cd197a0"
},
{
"url": "https://git.kernel.org/stable/c/1cd23ca80784223fa2204e16203f754da4e821f8"
}
],
"title": "sctp: validate STALE_COOKIE cause length before reading staleness",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64551",
"datePublished": "2026-07-27T20:10:40.012Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-10-19T20:48:40.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68197 (GCVE-0-2026-68197)
Vulnerability from cvelistv5
Published
2026-08-10 12:00
Modified
2026-08-19 16:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
mwifiex_tdls_add_ht_oper() gates its follow-the-AP-bandwidth path on
bss_desc->bcn_ht_cap being present, but then dereferences a different
pointer, bss_desc->bcn_ht_oper:
if (ISSUPP_CHANWIDTH40(priv->adapter->hw_dot_11n_dev_cap) &&
bss_desc->bcn_ht_cap &&
ISALLOWED_CHANWIDTH40(bss_desc->bcn_ht_oper->ht_param))
bcn_ht_cap and bcn_ht_oper are populated independently while parsing the
associated AP's beacon in mwifiex_update_bss_desc_with_ie(): an AP that
advertises an HT Capabilities element but no HT Operation element leaves
bcn_ht_cap non-NULL and bcn_ht_oper NULL. Setting up a TDLS link to a
peer while associated to such an AP then dereferences the NULL
bcn_ht_oper and crashes the kernel. Every other bcn_ht_oper user in the
driver NULL-checks it first.
Guard on the pointer that is actually dereferenced.
Found by 0sec automated security-research tooling (https://0sec.ai).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 396939f94084d5923d558e9f22db48bc51156e47 Version: 396939f94084d5923d558e9f22db48bc51156e47 Version: 396939f94084d5923d558e9f22db48bc51156e47 Version: 396939f94084d5923d558e9f22db48bc51156e47 Version: 396939f94084d5923d558e9f22db48bc51156e47 Version: 396939f94084d5923d558e9f22db48bc51156e47 Version: 396939f94084d5923d558e9f22db48bc51156e47 Version: 396939f94084d5923d558e9f22db48bc51156e47 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/tdls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e1770f7410b4232a0267924f99751dc9c5ca31af",
"status": "affected",
"version": "396939f94084d5923d558e9f22db48bc51156e47",
"versionType": "git"
},
{
"lessThan": "8c2058717fd06f05d421c2d3adf1dff3c3abcda1",
"status": "affected",
"version": "396939f94084d5923d558e9f22db48bc51156e47",
"versionType": "git"
},
{
"lessThan": "fba7eb7b248ea0618235f504158b685d752a153a",
"status": "affected",
"version": "396939f94084d5923d558e9f22db48bc51156e47",
"versionType": "git"
},
{
"lessThan": "eb42c3c8fd479166c42984728754cd779c71fd60",
"status": "affected",
"version": "396939f94084d5923d558e9f22db48bc51156e47",
"versionType": "git"
},
{
"lessThan": "45011e4d9ba3f2182e5df64be65888044fa20771",
"status": "affected",
"version": "396939f94084d5923d558e9f22db48bc51156e47",
"versionType": "git"
},
{
"lessThan": "9375a4ea4121625ef27a46b74781cda66a5cc61b",
"status": "affected",
"version": "396939f94084d5923d558e9f22db48bc51156e47",
"versionType": "git"
},
{
"lessThan": "cca4398aa305c22016d1714f388e2fa6ea4e5ad4",
"status": "affected",
"version": "396939f94084d5923d558e9f22db48bc51156e47",
"versionType": "git"
},
{
"lessThan": "c3d68e294cbb6a4090bb219d3dcaca85a011809b",
"status": "affected",
"version": "396939f94084d5923d558e9f22db48bc51156e47",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/tdls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper\n\nmwifiex_tdls_add_ht_oper() gates its follow-the-AP-bandwidth path on\nbss_desc-\u003ebcn_ht_cap being present, but then dereferences a different\npointer, bss_desc-\u003ebcn_ht_oper:\n\n\tif (ISSUPP_CHANWIDTH40(priv-\u003eadapter-\u003ehw_dot_11n_dev_cap) \u0026\u0026\n\t bss_desc-\u003ebcn_ht_cap \u0026\u0026\n\t ISALLOWED_CHANWIDTH40(bss_desc-\u003ebcn_ht_oper-\u003eht_param))\n\nbcn_ht_cap and bcn_ht_oper are populated independently while parsing the\nassociated AP\u0027s beacon in mwifiex_update_bss_desc_with_ie(): an AP that\nadvertises an HT Capabilities element but no HT Operation element leaves\nbcn_ht_cap non-NULL and bcn_ht_oper NULL. Setting up a TDLS link to a\npeer while associated to such an AP then dereferences the NULL\nbcn_ht_oper and crashes the kernel. Every other bcn_ht_oper user in the\ndriver NULL-checks it first.\n\nGuard on the pointer that is actually dereferenced.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:31:16.085Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e1770f7410b4232a0267924f99751dc9c5ca31af"
},
{
"url": "https://git.kernel.org/stable/c/8c2058717fd06f05d421c2d3adf1dff3c3abcda1"
},
{
"url": "https://git.kernel.org/stable/c/fba7eb7b248ea0618235f504158b685d752a153a"
},
{
"url": "https://git.kernel.org/stable/c/eb42c3c8fd479166c42984728754cd779c71fd60"
},
{
"url": "https://git.kernel.org/stable/c/45011e4d9ba3f2182e5df64be65888044fa20771"
},
{
"url": "https://git.kernel.org/stable/c/9375a4ea4121625ef27a46b74781cda66a5cc61b"
},
{
"url": "https://git.kernel.org/stable/c/cca4398aa305c22016d1714f388e2fa6ea4e5ad4"
},
{
"url": "https://git.kernel.org/stable/c/c3d68e294cbb6a4090bb219d3dcaca85a011809b"
}
],
"title": "wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68197",
"datePublished": "2026-08-10T12:00:15.750Z",
"dateReserved": "2026-07-30T09:28:09.374Z",
"dateUpdated": "2026-08-19T16:31:16.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68329 (GCVE-0-2026-68329)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
need_sync is a per-IOMMU flag shared by all domains and devices behind
that IOMMU. It is set whenever a command is queued with sync == true and
cleared when a completion-wait (CWAIT) command is queued. However, a
cleared need_sync only means that a covering CWAIT has been queued, not
that all previously queued commands have actually completed in hardware.
iommu_completion_wait() read need_sync locklessly and returned early
when it was false. This breaks the "block until all previously queued
commands have completed" contract in a multi-CPU scenario:
CPU2: queue inv-B => need_sync = true
CPU1: queue CWAIT(N); need_sync = false; then wait_on_sem(N)
CPU2: read need_sync == false => return 0 (no wait!)
CPU2 returns without waiting for any sequence number even though its
inv-B may not have completed yet (CWAIT(N), queued after inv-B, has not
been signaled). CPU2 then proceeds to, for example, free page-table
pages while the IOMMU can still walk stale translations, opening a
use-after-free window. This is a logical race in the meaning of the
flag, not a memory-visibility issue, so barriers alone do not help.
Fix it without losing the optimization of avoiding redundant CWAIT
commands: take iommu->lock before testing need_sync, and when it is
false do not return early but wait for the last allocated sequence
number (cmd_sem_val). Since need_sync == false implies no sync command
was queued after the last CWAIT, that CWAIT is FIFO-ordered after every
not-yet-completed command, so waiting for its sequence number guarantees
all prior commands (possibly queued by another CPU) have completed. The
common path with pending work is unchanged and no extra hardware command
is issued.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68329",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:47:11.908134Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:05.106Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ab7faf5a172ebfdc423ebb3eea4d472740de82f9",
"status": "affected",
"version": "815b33fdc279d34ab40a8bfe1866623a4cc5669b",
"versionType": "git"
},
{
"lessThan": "93494bd446396c257fb589f59894577e96e406e2",
"status": "affected",
"version": "815b33fdc279d34ab40a8bfe1866623a4cc5669b",
"versionType": "git"
},
{
"lessThan": "d053eb7e09e10cbdca3fca8b35c1017d438091b2",
"status": "affected",
"version": "815b33fdc279d34ab40a8bfe1866623a4cc5669b",
"versionType": "git"
},
{
"lessThan": "02f8cefa2ad95ea3754f0cfd6fbae7f866202ccb",
"status": "affected",
"version": "815b33fdc279d34ab40a8bfe1866623a4cc5669b",
"versionType": "git"
},
{
"lessThan": "1e75a8255f11c81fb07e81e5029cfd75804350a0",
"status": "affected",
"version": "815b33fdc279d34ab40a8bfe1866623a4cc5669b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Wait for completion instead of returning early in iommu_completion_wait()\n\nneed_sync is a per-IOMMU flag shared by all domains and devices behind\nthat IOMMU. It is set whenever a command is queued with sync == true and\ncleared when a completion-wait (CWAIT) command is queued. However, a\ncleared need_sync only means that a covering CWAIT has been queued, not\nthat all previously queued commands have actually completed in hardware.\n\niommu_completion_wait() read need_sync locklessly and returned early\nwhen it was false. This breaks the \"block until all previously queued\ncommands have completed\" contract in a multi-CPU scenario:\n\n CPU2: queue inv-B =\u003e need_sync = true\n CPU1: queue CWAIT(N); need_sync = false; then wait_on_sem(N)\n CPU2: read need_sync == false =\u003e return 0 (no wait!)\n\nCPU2 returns without waiting for any sequence number even though its\ninv-B may not have completed yet (CWAIT(N), queued after inv-B, has not\nbeen signaled). CPU2 then proceeds to, for example, free page-table\npages while the IOMMU can still walk stale translations, opening a\nuse-after-free window. This is a logical race in the meaning of the\nflag, not a memory-visibility issue, so barriers alone do not help.\n\nFix it without losing the optimization of avoiding redundant CWAIT\ncommands: take iommu-\u003elock before testing need_sync, and when it is\nfalse do not return early but wait for the last allocated sequence\nnumber (cmd_sem_val). Since need_sync == false implies no sync command\nwas queued after the last CWAIT, that CWAIT is FIFO-ordered after every\nnot-yet-completed command, so waiting for its sequence number guarantees\nall prior commands (possibly queued by another CPU) have completed. The\ncommon path with pending work is unchanged and no extra hardware command\nis issued."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The racy `iommu_completion_wait()` is reached through local DMA map/unmap activity \u2014 iommu-dma unmap paths, VFIO/IOMMUFD unmap ioctls, and domain attach/detach \u2014 all driven from the local system rather than from network input.\nAC:L - The attacker drives both sides of the race by issuing concurrent unmap/flush operations on multiple CPUs against the same IOMMU, and can retry indefinitely; each hit frees page-table pages while translations are still live, so no condition outside the attacker\u0027s influence is required.\nPR:L - An unprivileged local user can generate the concurrent IOMMU invalidation traffic needed via ordinary parallel I/O through DMA-API device paths; no root or capability in the init namespace is required, and privileged VFIO users are only one of several entry points.\nUI:N - The race is triggered purely by the attacker\u0027s own concurrent unmap/flush workload; no victim action such as mounting a filesystem or opening a file is needed.\nS:C - The failure defeats IOMMU isolation itself: page-table pages are freed and reused while the IOMMU can still walk them and stale IOTLB entries persist, so a device (including one assigned to a guest or an external peripheral) retains DMA access to host memory outside its domain, crossing the DMA/IOMMU security boundary.\nC:H - Stale translations and use-after-free page tables let a device read host memory that was unmapped, freed, and reallocated to unrelated kernel or user data, yielding effectively arbitrary memory disclosure across the IOMMU boundary.\nI:H - The same stale translations permit device DMA writes into freed and reallocated pages, including page-table pages the IOMMU still walks, giving an arbitrary kernel-memory write primitive usable for control-flow hijacking and privilege escalation.\nA:H - Use-after-free of page-table pages and DMA into reallocated memory corrupt kernel structures and generate IOMMU I/O page faults, leading to oops or panic and full loss of availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:03:27.689Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ab7faf5a172ebfdc423ebb3eea4d472740de82f9"
},
{
"url": "https://git.kernel.org/stable/c/93494bd446396c257fb589f59894577e96e406e2"
},
{
"url": "https://git.kernel.org/stable/c/d053eb7e09e10cbdca3fca8b35c1017d438091b2"
},
{
"url": "https://git.kernel.org/stable/c/02f8cefa2ad95ea3754f0cfd6fbae7f866202ccb"
},
{
"url": "https://git.kernel.org/stable/c/1e75a8255f11c81fb07e81e5029cfd75804350a0"
}
],
"title": "iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68329",
"datePublished": "2026-08-10T12:03:05.526Z",
"dateReserved": "2026-07-30T09:28:09.383Z",
"dateUpdated": "2026-10-19T21:09:05.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72142 (GCVE-0-2026-72142)
Vulnerability from cvelistv5
Published
2026-08-15 05:53
Modified
2026-08-23 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)
SMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic
(polling) path rejects it as -EPROTO. Worse, it returns without a
NACK+STOP: the next receive cycle has already started, so the target
keeps holding SDA and the bus stays stuck until a power cycle for
this i2c controller.
Reading I2DR to obtain the count likewise arms the next byte on the
count > I2C_SMBUS_BLOCK_MAX path, which also returned -EPROTO directly
and left the bus held.
Handle both: NACK the in-flight dummy byte (TXAK) and extend msgs->len so
the existing last-byte handling emits STOP; the dummy byte is discarded.
A count of 0 is a valid empty block read; a count above
I2C_SMBUS_BLOCK_MAX is still reported as -EPROTO, but only after the bus
has been released.
The interrupt-driven path has the same flaw from a later commit and is
fixed separately, as it carries a different Fixes: tag and stable range.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8e8782c71595a5ad29e234ce6b3d2fce787fb07a Version: 8e8782c71595a5ad29e234ce6b3d2fce787fb07a Version: 8e8782c71595a5ad29e234ce6b3d2fce787fb07a Version: 8e8782c71595a5ad29e234ce6b3d2fce787fb07a Version: 8e8782c71595a5ad29e234ce6b3d2fce787fb07a Version: 8e8782c71595a5ad29e234ce6b3d2fce787fb07a Version: 8e8782c71595a5ad29e234ce6b3d2fce787fb07a Version: 8e8782c71595a5ad29e234ce6b3d2fce787fb07a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-imx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f29df3c3d607a9dbc14aed0e45504ced4d2e7ec",
"status": "affected",
"version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
"versionType": "git"
},
{
"lessThan": "38d4947431b2410850409fda016b2ac9f640a4dd",
"status": "affected",
"version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
"versionType": "git"
},
{
"lessThan": "e3e8b02d4773cfc5ad561d2e5505efde36c6927a",
"status": "affected",
"version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
"versionType": "git"
},
{
"lessThan": "016ef0f6ca4bc9bf0330ac41bd2ea349759643e3",
"status": "affected",
"version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
"versionType": "git"
},
{
"lessThan": "c882e8cc68fb993700dc21fd6e754001e6297934",
"status": "affected",
"version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
"versionType": "git"
},
{
"lessThan": "6d2c973926d0612360693bc559be2ffde836151b",
"status": "affected",
"version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
"versionType": "git"
},
{
"lessThan": "60ed00d46616a9232e42ea7a3e3c0273d7cf7543",
"status": "affected",
"version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
"versionType": "git"
},
{
"lessThan": "cb2fc37857693b55909fb77dc2c87cfbc1cdc476",
"status": "affected",
"version": "8e8782c71595a5ad29e234ce6b3d2fce787fb07a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-imx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: fix locked bus on SMBus block-read of 0 (atomic)\n\nSMBus 3.1 6.5.7 allows a Block Read byte count of 0, but the atomic\n(polling) path rejects it as -EPROTO. Worse, it returns without a\nNACK+STOP: the next receive cycle has already started, so the target\nkeeps holding SDA and the bus stays stuck until a power cycle for\nthis i2c controller.\n\nReading I2DR to obtain the count likewise arms the next byte on the\ncount \u003e I2C_SMBUS_BLOCK_MAX path, which also returned -EPROTO directly\nand left the bus held.\n\nHandle both: NACK the in-flight dummy byte (TXAK) and extend msgs-\u003elen so\nthe existing last-byte handling emits STOP; the dummy byte is discarded.\nA count of 0 is a valid empty block read; a count above\nI2C_SMBUS_BLOCK_MAX is still reported as -EPROTO, but only after the bus\nhas been released.\n\nThe interrupt-driven path has the same flaw from a later commit and is\nfixed separately, as it carries a different Fixes: tag and stable range."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:51.665Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f29df3c3d607a9dbc14aed0e45504ced4d2e7ec"
},
{
"url": "https://git.kernel.org/stable/c/38d4947431b2410850409fda016b2ac9f640a4dd"
},
{
"url": "https://git.kernel.org/stable/c/e3e8b02d4773cfc5ad561d2e5505efde36c6927a"
},
{
"url": "https://git.kernel.org/stable/c/016ef0f6ca4bc9bf0330ac41bd2ea349759643e3"
},
{
"url": "https://git.kernel.org/stable/c/c882e8cc68fb993700dc21fd6e754001e6297934"
},
{
"url": "https://git.kernel.org/stable/c/6d2c973926d0612360693bc559be2ffde836151b"
},
{
"url": "https://git.kernel.org/stable/c/60ed00d46616a9232e42ea7a3e3c0273d7cf7543"
},
{
"url": "https://git.kernel.org/stable/c/cb2fc37857693b55909fb77dc2c87cfbc1cdc476"
}
],
"title": "i2c: imx: fix locked bus on SMBus block-read of 0 (atomic)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72142",
"datePublished": "2026-08-15T05:53:15.489Z",
"dateReserved": "2026-08-09T03:40:39.908Z",
"dateUpdated": "2026-08-23T12:46:51.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39964 (GCVE-0-2025-39964)
Vulnerability from cvelistv5
Published
2025-10-13 13:48
Modified
2026-10-15 01:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
Issuing two writes to the same af_alg socket is bogus as the
data will be interleaved in an unpredictable fashion. Furthermore,
concurrent writes may create inconsistencies in the internal
socket state.
Disallow this by adding a new ctx->write field that indiciates
exclusive ownership for writing.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-39964",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-09-18",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T03:56:17.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-18T00:00:00.000Z",
"value": "CVE-2025-39964 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:08:42.257Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c",
"include/crypto/if_alg.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f28c4adbc4a97437874c9b669fd7958a8c6d6ce",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "e4c1ec11132ec466f7362a95f36a506ce4dc08c9",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "7c4491b5644e3a3708f3dbd7591be0a570135b84",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "9aee87da5572b3a14075f501752e209801160d3d",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "45bcf60fe49b37daab1acee57b27211ad1574042",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "1b34cbbf4f011a121ef7b2d7d6e6920a036d5285",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c",
"include/crypto/if_alg.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.245",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.194",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.245",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.194",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion. Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx-\u003ewrite field that indiciates\nexclusive ownership for writing."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached through the AF_ALG socket family via `socket()`/`bind()`/`sendmsg()`/`recvmsg()` syscalls, which requires local system access. There is no remote or adjacent-network path to `af_alg_sendmsg()`.\nAC:L - The attacker controls both sides of the race entirely \u2014 two of its own threads on a socket it owns \u2014 and can force writer A to park deterministically in `af_alg_wait_for_wmem()` by sizing `SO_SNDBUF` and filling it, then wake it on demand with its own `recvmsg()`. The error exit that leaves `cur == 0` is triggered at will with a deliberately faulting user buffer, so no condition is outside the attacker\u0027s control.\nPR:L - `alg_create()`, `alg_bind()` and `alg_setkey()` perform no capability checks whatsoever, so any unprivileged local user \u2014 including one inside a container or unprivileged user namespace \u2014 can open, bind and write to an AF_ALG skcipher/aead socket. The required modules are auto-loaded on demand via `MODULE_ALIAS_NETPROTO(AF_ALG)` and `request_module(\"algif-%s\")`.\nUI:N - The attacking process performs every step itself \u2014 socket creation, bind, and the two concurrent `sendmsg()` calls. No victim action or interaction of any kind is needed.\nS:U - The corruption is confined to kernel heap objects (`struct af_alg_tsgl`/scatterlist and adjacent slab memory) within the same security authority. No hypervisor, IOMMU, or other trust boundary is crossed.\nC:H - The out-of-bounds scatterlist entry is fabricated from kernel list pointers and is subsequently handed to the cipher by `skcipher_recvmsg`/`aead_recvmsg` via `af_alg_pull_tsgl()`, so arbitrary kernel memory is encrypted/decrypted and returned to userspace. This yields a kernel memory disclosure primitive, not merely a pointer leak.\nI:H - `memcpy_from_msg(page_address(sg_page(sg)) + sg-\u003eoffset + sg-\u003elength, msg, len)` on the underflowed scatterlist writes attacker-controlled data of attacker-chosen length to an address derived from attacker-influenceable heap contents. Combined with heap grooming of the 4KB tsgl allocations, this is a controlled kernel write suitable for privilege escalation.\nA:H - Dereferencing `page_address(sg_page(sg))` on a bogus page_link, and the later `put_page()` on that fabricated page, reliably produce an oops/panic or page refcount corruption. Any unprivileged user can trigger this repeatedly, crashing the machine."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:06:33.126Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce"
},
{
"url": "https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9"
},
{
"url": "https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8"
},
{
"url": "https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84"
},
{
"url": "https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d"
},
{
"url": "https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042"
},
{
"url": "https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285"
}
],
"title": "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39964",
"datePublished": "2025-10-13T13:48:30.334Z",
"dateReserved": "2025-04-16T07:20:57.149Z",
"dateUpdated": "2026-10-15T01:08:42.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64513 (GCVE-0-2026-64513)
Vulnerability from cvelistv5
Published
2026-07-25 08:52
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Unconditionally recompute CR8 intercept on PPR update
The TPR_THRESHOLD field in the VMCS is used by VMX to induce VM exits
when the guest's virtual TPR falls under the specified threshold,
allowing KVM to inject previously masked interrupts.
KVM handles these VM exits in handle_tpr_below_threshold().
Commit eb90f3417a0c ("KVM: vmx: speed up TPR below threshold vmexits")
optimized this function by calling apic_update_ppr() instead of raising
KVM_REQ_EVENT. apic_update_ppr() then raises KVM_REQ_EVENT if there is
a pending, deliverable interrupt.
However, if there are no new interrupts pending, apic_update_ppr() does
not issue the request. Thus, kvm_lapic_update_cr8_intercept() and
vmx_update_cr8_intercept() are not called before VM entry, which results
in a high, stale TPR_THRESHOLD. This is problematic due to the following
sentence in 28.2.1.1 "VM-Execution Control Fields" in the SDM:
The following check is performed if the “use TPR shadow” VM-execution
control is 1 and the “virtualize APIC accesses” and “virtual-interrupt
delivery” VM-execution controls are both 0: the value of bits 3:0 of
the TPR threshold VM-execution control field should not be greater
than the value of bits 7:4 of VTPR.
This error condition is typically not observed when KVM runs on a bare
metal system because modern processors support APICv, which enables
virtual-interrupt delivery, and which KVM uses when possible. This
causes the processor to no longer generate TPR-below-threshold exits
and to no longer check TPR_THRESHOLD on entry. However, when running
on older platforms, or under nested virtualization on a hypervisor that
does not support virtual-interrupt delivery and enforces this check
(like Hyper-V) this can cause a VM entry failure with hardware error
0x7, as seen in [1].
Call kvm_lapic_update_cr8_intercept() if apic_update_ppr() does not
find a deliverable interrupt (and thus does not raise KVM_REQ_EVENT).
Remove calls to kvm_lapic_update_cr8_intercept() on paths that end up in
apic_update_ppr(), as they now become redundant. This ensures that any
path that updates the guest's PPR also figures out if KVM needs to wait
for a TPR change (using TPR_THRESHOLD on VMX or CR8 intercepts on SVM).
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/lapic.c",
"arch/x86/kvm/x86.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7277b66511983b57e345c0fba21f1810fd07c0f",
"status": "affected",
"version": "eb90f3417a0cc4880e979ccc84e41890d410ea5b",
"versionType": "git"
},
{
"lessThan": "ff9c4c6428883182960cfe5c78928f0896d80ebc",
"status": "affected",
"version": "eb90f3417a0cc4880e979ccc84e41890d410ea5b",
"versionType": "git"
},
{
"lessThan": "8c8e8ac22ee17d52f9eb2bc814bca7fab90fb8df",
"status": "affected",
"version": "eb90f3417a0cc4880e979ccc84e41890d410ea5b",
"versionType": "git"
},
{
"lessThan": "bb365a506b1e6fb050c0fceaad354fe395385ef0",
"status": "affected",
"version": "eb90f3417a0cc4880e979ccc84e41890d410ea5b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/lapic.c",
"arch/x86/kvm/x86.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Unconditionally recompute CR8 intercept on PPR update\n\nThe TPR_THRESHOLD field in the VMCS is used by VMX to induce VM exits\nwhen the guest\u0027s virtual TPR falls under the specified threshold,\nallowing KVM to inject previously masked interrupts.\n\nKVM handles these VM exits in handle_tpr_below_threshold().\nCommit eb90f3417a0c (\"KVM: vmx: speed up TPR below threshold vmexits\")\noptimized this function by calling apic_update_ppr() instead of raising\nKVM_REQ_EVENT. apic_update_ppr() then raises KVM_REQ_EVENT if there is\na pending, deliverable interrupt.\n\nHowever, if there are no new interrupts pending, apic_update_ppr() does\nnot issue the request. Thus, kvm_lapic_update_cr8_intercept() and\nvmx_update_cr8_intercept() are not called before VM entry, which results\nin a high, stale TPR_THRESHOLD. This is problematic due to the following\nsentence in 28.2.1.1 \"VM-Execution Control Fields\" in the SDM:\n\n The following check is performed if the \u201cuse TPR shadow\u201d VM-execution\n control is 1 and the \u201cvirtualize APIC accesses\u201d and \u201cvirtual-interrupt\n delivery\u201d VM-execution controls are both 0: the value of bits 3:0 of\n the TPR threshold VM-execution control field should not be greater\n than the value of bits 7:4 of VTPR.\n\nThis error condition is typically not observed when KVM runs on a bare\nmetal system because modern processors support APICv, which enables\nvirtual-interrupt delivery, and which KVM uses when possible. This\ncauses the processor to no longer generate TPR-below-threshold exits\nand to no longer check TPR_THRESHOLD on entry. However, when running\non older platforms, or under nested virtualization on a hypervisor that\ndoes not support virtual-interrupt delivery and enforces this check\n(like Hyper-V) this can cause a VM entry failure with hardware error\n0x7, as seen in [1].\n\nCall kvm_lapic_update_cr8_intercept() if apic_update_ppr() does not\nfind a deliverable interrupt (and thus does not raise KVM_REQ_EVENT).\nRemove calls to kvm_lapic_update_cr8_intercept() on paths that end up in\napic_update_ppr(), as they now become redundant. This ensures that any\npath that updates the guest\u0027s PPR also figures out if KVM needs to wait\nfor a TPR change (using TPR_THRESHOLD on VMX or CR8 intercepts on SVM)."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:24.391Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7277b66511983b57e345c0fba21f1810fd07c0f"
},
{
"url": "https://git.kernel.org/stable/c/ff9c4c6428883182960cfe5c78928f0896d80ebc"
},
{
"url": "https://git.kernel.org/stable/c/8c8e8ac22ee17d52f9eb2bc814bca7fab90fb8df"
},
{
"url": "https://git.kernel.org/stable/c/bb365a506b1e6fb050c0fceaad354fe395385ef0"
}
],
"title": "KVM: x86: Unconditionally recompute CR8 intercept on PPR update",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64513",
"datePublished": "2026-07-25T08:52:05.119Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-10-21T12:43:24.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68284 (GCVE-0-2026-68284)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which
drops and reacquires the socket lock. Its error path tries to decide
whether msg_tx names the local temporary message by comparing it with
the current value of psock->cork.
This comparison is unsafe when two threads send on the same socket:
Thread A Thread B
msg_tx = psock->cork
sk_msg_alloc() fails
sk_stream_wait_memory()
releases the socket lock acquires the socket lock
completes the cork
psock->cork = NULL
frees the cork
reacquires the socket lock
msg_tx != psock->cork
sk_msg_free(msg_tx)
The stale cork is therefore mistaken for the local temporary message
and freed again. KASAN reported:
BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50
Read of size 4 at addr ffff88810c908800 by task poc/90
Call Trace:
sk_msg_free+0x49/0x50
tcp_bpf_sendmsg+0x14f5/0x1cc0
__sys_sendto+0x32c/0x3a0
__x64_sys_sendto+0xdb/0x1b0
Allocated by task 89:
__kasan_kmalloc+0x8f/0xa0
tcp_bpf_sendmsg+0x16b3/0x1cc0
Freed by task 91:
__kasan_slab_free+0x43/0x70
kfree+0x131/0x3c0
tcp_bpf_sendmsg+0xec3/0x1cc0
msg_tx can only name the stack-local tmp or the shared cork. Check for
tmp directly so a changed psock->cork cannot turn a shared message into
an apparent local one.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 604326b41a6fb9b4a78b6179335decee0365cd8c Version: 604326b41a6fb9b4a78b6179335decee0365cd8c Version: 604326b41a6fb9b4a78b6179335decee0365cd8c Version: 604326b41a6fb9b4a78b6179335decee0365cd8c Version: 604326b41a6fb9b4a78b6179335decee0365cd8c Version: 604326b41a6fb9b4a78b6179335decee0365cd8c Version: 604326b41a6fb9b4a78b6179335decee0365cd8c Version: 604326b41a6fb9b4a78b6179335decee0365cd8c |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68284",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:46:33.864710Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:59.373Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0688e6fe599d2d39147ae9ece97944c6e1815ebf",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "b2bcbeabfd843d47468fa095b1bd08ddb90cf616",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "54be47e7cbb936429c3bbdfc526ea943954aaf80",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "ee762f684eefa59de34d9ed93cab08336e834f47",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "cde4d6bcd9b73073c66498f6723c7b364c4dbc18",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "786d690257ec7a0c839f8710456e444ce3f1348b",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "752b1159ed5d0c48fe169a3721b96660a9822aa1",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "2d66a033864e27ab8d5e44cb36f31d9d2413bee4",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()\n\ntcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which\ndrops and reacquires the socket lock. Its error path tries to decide\nwhether msg_tx names the local temporary message by comparing it with\nthe current value of psock-\u003ecork.\n\nThis comparison is unsafe when two threads send on the same socket:\n\n Thread A Thread B\n msg_tx = psock-\u003ecork\n sk_msg_alloc() fails\n sk_stream_wait_memory()\n releases the socket lock acquires the socket lock\n completes the cork\n psock-\u003ecork = NULL\n frees the cork\n reacquires the socket lock\n msg_tx != psock-\u003ecork\n sk_msg_free(msg_tx)\n\nThe stale cork is therefore mistaken for the local temporary message\nand freed again. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50\n Read of size 4 at addr ffff88810c908800 by task poc/90\n Call Trace:\n sk_msg_free+0x49/0x50\n tcp_bpf_sendmsg+0x14f5/0x1cc0\n __sys_sendto+0x32c/0x3a0\n __x64_sys_sendto+0xdb/0x1b0\n Allocated by task 89:\n __kasan_kmalloc+0x8f/0xa0\n tcp_bpf_sendmsg+0x16b3/0x1cc0\n Freed by task 91:\n __kasan_slab_free+0x43/0x70\n kfree+0x131/0x3c0\n tcp_bpf_sendmsg+0xec3/0x1cc0\n\nmsg_tx can only name the stack-local tmp or the shared cork. Check for\ntmp directly so a changed psock-\u003ecork cannot turn a shared message into\nan apparent local one."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is triggered by local `sendmsg()`/`sendto()` syscalls issued concurrently by two threads on the same TCP socket attached to a BPF sockmap; the remote peer cannot drive the race, so this is a local attack surface.\nAC:L - The attacker controls both sides of the race: it owns both sending threads, can force the `wait_for_memory` path deterministically with a small SO_SNDBUF plus a large blocking send, and can force `sk_stream_wait_memory()` to fail via SO_SNDTIMEO or a socket error, making the stale-cork free reliably reachable.\nPR:L - Once the sockmap and sk_msg verdict/cork program are installed by the platform (a standard deployment such as Cilium/Istio sockops acceleration), an ordinary unprivileged local process owning a socket in the map triggers the bug with plain send syscalls; no capability check guards `tcp_bpf_sendmsg()` itself.\nUI:N - The attacker\u0027s own two threads perform all the required sends; no action by any other user or victim process is needed.\nS:U - The use-after-free corrupts kernel slab and page state within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `sk_msg_free()` reads the freed `sk_msg` cork object (KASAN slab-use-after-free read), and by reclaiming that slab object with attacker-groomed data the freed scatterlist can be steered to leak or expose arbitrary kernel memory contents.\nI:H - Beyond the stale read, the path re-frees the cork\u0027s scatterlist pages and uncharges socket memory, giving a double-free/page-refcount-underflow primitive on an attacker-groomable slab object, which is classically leveraged into arbitrary kernel write and control-flow hijack.\nA:H - The use-after-free and duplicate page release corrupt slab and page allocator state, reliably producing a kernel oops or panic and taking the whole system down."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:32:41.174Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0688e6fe599d2d39147ae9ece97944c6e1815ebf"
},
{
"url": "https://git.kernel.org/stable/c/b2bcbeabfd843d47468fa095b1bd08ddb90cf616"
},
{
"url": "https://git.kernel.org/stable/c/54be47e7cbb936429c3bbdfc526ea943954aaf80"
},
{
"url": "https://git.kernel.org/stable/c/ee762f684eefa59de34d9ed93cab08336e834f47"
},
{
"url": "https://git.kernel.org/stable/c/cde4d6bcd9b73073c66498f6723c7b364c4dbc18"
},
{
"url": "https://git.kernel.org/stable/c/786d690257ec7a0c839f8710456e444ce3f1348b"
},
{
"url": "https://git.kernel.org/stable/c/752b1159ed5d0c48fe169a3721b96660a9822aa1"
},
{
"url": "https://git.kernel.org/stable/c/2d66a033864e27ab8d5e44cb36f31d9d2413bee4"
}
],
"title": "bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68284",
"datePublished": "2026-08-10T12:02:16.572Z",
"dateReserved": "2026-07-30T09:28:09.379Z",
"dateUpdated": "2026-10-19T20:58:59.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68313 (GCVE-0-2026-68313)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-08-19 16:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix infinite loop in __tipc_nl_compat_dumpit
cmd->dumpit callback can return a negative errno, causing an infinite
loop due to the while(len) condition. As the loop never terminates,
genl_mutex is never released, and other tasks waiting on it starve in D
state.
Check dumpit's return value, propagate it and jump to err_out on error.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d0796d1ef63deb38147729664691ba3090930b26 Version: d0796d1ef63deb38147729664691ba3090930b26 Version: d0796d1ef63deb38147729664691ba3090930b26 Version: d0796d1ef63deb38147729664691ba3090930b26 Version: d0796d1ef63deb38147729664691ba3090930b26 Version: d0796d1ef63deb38147729664691ba3090930b26 Version: d0796d1ef63deb38147729664691ba3090930b26 Version: d0796d1ef63deb38147729664691ba3090930b26 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/netlink_compat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2a1c1397275f27e33b6a2a565d81cfef0deb6656",
"status": "affected",
"version": "d0796d1ef63deb38147729664691ba3090930b26",
"versionType": "git"
},
{
"lessThan": "98d09766cee3182aae292886e2fef0cbe8dba537",
"status": "affected",
"version": "d0796d1ef63deb38147729664691ba3090930b26",
"versionType": "git"
},
{
"lessThan": "9cd8c88e1336ec0fbe02af1ddf2b52838d30fae4",
"status": "affected",
"version": "d0796d1ef63deb38147729664691ba3090930b26",
"versionType": "git"
},
{
"lessThan": "f9c669d9f4cac832fe31193cdbc24c6a9d99398b",
"status": "affected",
"version": "d0796d1ef63deb38147729664691ba3090930b26",
"versionType": "git"
},
{
"lessThan": "1ab78af2140189b735b8d3b889b0284128cb2013",
"status": "affected",
"version": "d0796d1ef63deb38147729664691ba3090930b26",
"versionType": "git"
},
{
"lessThan": "e740e90ca8e7f70d9eac1aa31a8b3e0e4d32b2ef",
"status": "affected",
"version": "d0796d1ef63deb38147729664691ba3090930b26",
"versionType": "git"
},
{
"lessThan": "b8f3b8efa5f99081b14de1a7ffa68a81bf01bd48",
"status": "affected",
"version": "d0796d1ef63deb38147729664691ba3090930b26",
"versionType": "git"
},
{
"lessThan": "22f8aa35964e8f2ab026578f45befc9605fd1b28",
"status": "affected",
"version": "d0796d1ef63deb38147729664691ba3090930b26",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/netlink_compat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix infinite loop in __tipc_nl_compat_dumpit\n\ncmd-\u003edumpit callback can return a negative errno, causing an infinite\nloop due to the while(len) condition. As the loop never terminates,\ngenl_mutex is never released, and other tasks waiting on it starve in D\nstate.\n\nCheck dumpit\u0027s return value, propagate it and jump to err_out on error."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:33:05.750Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2a1c1397275f27e33b6a2a565d81cfef0deb6656"
},
{
"url": "https://git.kernel.org/stable/c/98d09766cee3182aae292886e2fef0cbe8dba537"
},
{
"url": "https://git.kernel.org/stable/c/9cd8c88e1336ec0fbe02af1ddf2b52838d30fae4"
},
{
"url": "https://git.kernel.org/stable/c/f9c669d9f4cac832fe31193cdbc24c6a9d99398b"
},
{
"url": "https://git.kernel.org/stable/c/1ab78af2140189b735b8d3b889b0284128cb2013"
},
{
"url": "https://git.kernel.org/stable/c/e740e90ca8e7f70d9eac1aa31a8b3e0e4d32b2ef"
},
{
"url": "https://git.kernel.org/stable/c/b8f3b8efa5f99081b14de1a7ffa68a81bf01bd48"
},
{
"url": "https://git.kernel.org/stable/c/22f8aa35964e8f2ab026578f45befc9605fd1b28"
}
],
"title": "tipc: fix infinite loop in __tipc_nl_compat_dumpit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68313",
"datePublished": "2026-08-10T12:02:48.120Z",
"dateReserved": "2026-07-30T09:28:09.381Z",
"dateUpdated": "2026-08-19T16:33:05.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64344 (GCVE-0-2026-64344)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: idmouse: fix use-after-free on disconnect race
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 54d2bc068fd21bcb096660938bce7c7265613a24 Version: 54d2bc068fd21bcb096660938bce7c7265613a24 Version: 54d2bc068fd21bcb096660938bce7c7265613a24 Version: 54d2bc068fd21bcb096660938bce7c7265613a24 Version: 54d2bc068fd21bcb096660938bce7c7265613a24 Version: 54d2bc068fd21bcb096660938bce7c7265613a24 Version: 54d2bc068fd21bcb096660938bce7c7265613a24 Version: 54d2bc068fd21bcb096660938bce7c7265613a24 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/idmouse.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "31e75fed8f90cfea9f8285e7ed135b0e452bf872",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "8d53b14ad4ccbff6d306b3a39c812303f4a87d41",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "f62622e947f82a3854a8502d09492ffbdeb252b4",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "54c2b7356b4aeea467f9fb13b85e9e036bc428cb",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "e88cff5fbaa629f3cab45c8b46f395d62c2eb515",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
},
{
"lessThan": "ff002c153f9722caece3983cc23dc4d9d4652cb4",
"status": "affected",
"version": "54d2bc068fd21bcb096660938bce7c7265613a24",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/idmouse.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: idmouse: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it\u0027s unlocked\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:48.283Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/31e75fed8f90cfea9f8285e7ed135b0e452bf872"
},
{
"url": "https://git.kernel.org/stable/c/8d53b14ad4ccbff6d306b3a39c812303f4a87d41"
},
{
"url": "https://git.kernel.org/stable/c/f62622e947f82a3854a8502d09492ffbdeb252b4"
},
{
"url": "https://git.kernel.org/stable/c/60fc5ef4ecea3e3d1fe556cecf53ddd13096ef09"
},
{
"url": "https://git.kernel.org/stable/c/d0f61acb51a8c8f3fd41c303ddb7770cd83e7ed4"
},
{
"url": "https://git.kernel.org/stable/c/54c2b7356b4aeea467f9fb13b85e9e036bc428cb"
},
{
"url": "https://git.kernel.org/stable/c/e88cff5fbaa629f3cab45c8b46f395d62c2eb515"
},
{
"url": "https://git.kernel.org/stable/c/ff002c153f9722caece3983cc23dc4d9d4652cb4"
}
],
"title": "USB: idmouse: fix use-after-free on disconnect race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64344",
"datePublished": "2026-07-25T08:50:06.461Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:48.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72284 (GCVE-0-2026-72284)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs
Ignore KVM's internal "service pending PV EOI" request if the vCPU has
disabled PV EOIs since the request was made. Asserting that PV EOIs are
enabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e.
if pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables
PV EOIs.
kernel BUG at arch/x86/kvm/lapic.c:3338!
Oops: invalid opcode: 0000 [#1] SMP
CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm]
Call Trace:
<TASK>
kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm]
kvm_vcpu_ioctl+0x2d5/0x980 [kvm]
__x64_sys_ioctl+0x8a/0xd0
do_syscall_64+0xb5/0xb40
entry_SYSCALL_64_after_hwframe+0x4b/0x53
</TASK>
Modules linked in: kvm_intel kvm irqbypass
---[ end trace 0000000000000000 ]---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb Version: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb Version: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb Version: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb Version: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb Version: ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72284",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:45:41.558671Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:14.664Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/lapic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "038b9ce6fafda1babd1e33d52cbc6039747a6d87",
"status": "affected",
"version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
"versionType": "git"
},
{
"lessThan": "8e9f7a95279bf608cf4c331ed89612e28c04564f",
"status": "affected",
"version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
"versionType": "git"
},
{
"lessThan": "ebd7845ca0471d251a1cb48d84eb165aff5b7123",
"status": "affected",
"version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
"versionType": "git"
},
{
"lessThan": "97542f15dc4cf6cd3fdc035e482dca54246ddf48",
"status": "affected",
"version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
"versionType": "git"
},
{
"lessThan": "32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e",
"status": "affected",
"version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
"versionType": "git"
},
{
"lessThan": "9285e4070df2c40585c3d7ec9571faa7a2b97e17",
"status": "affected",
"version": "ae7a2a3fb6f8b784c2752863f4f1f20c656f76fb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/lapic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs\n\nIgnore KVM\u0027s internal \"service pending PV EOI\" request if the vCPU has\ndisabled PV EOIs since the request was made. Asserting that PV EOIs are\nenabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e.\nif pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables\nPV EOIs.\n\n kernel BUG at arch/x86/kvm/lapic.c:3338!\n Oops: invalid opcode: 0000 [#1] SMP\n CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm]\n Call Trace:\n \u003cTASK\u003e\n kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm]\n kvm_vcpu_ioctl+0x2d5/0x980 [kvm]\n __x64_sys_ioctl+0x8a/0xd0\n do_syscall_64+0xb5/0xb40\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e\n Modules linked in: kvm_intel kvm irqbypass\n ---[ end trace 0000000000000000 ]---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached when malicious guest code in an x86 KVM VM races paravirtual EOI state, causing kvm_lapic_sync_from_vapic() to run on VM exit via KVM_RUN; this requires local guest execution on a KVM host, not remote network packets to the host kernel.\nAC:L - The attacker controls both sides of the race: guest wrmsr to MSR_KVM_PV_EOI_EN disables PV EOI while KVM_APIC_PV_EOI_PENDING remains set, then any VM exit reliably hits BUG_ON; optional guest memory unmapping can also force pv_eoi_get_user() failure without uncontrollable host timing.\nPR:N - No host root or init-namespace capabilities are required; exploitation needs only code execution inside an assigned KVM guest with KVM_FEATURE_PV_EOI (default on Linux/QEMU guests), typical for any cloud VM tenant without privileged host access.\nUI:N - No victim user or administrator action is required beyond the attacker operating their own guest workload; triggering is fully automated via guest MSR writes and deliberate VM exits that drive the KVM_RUN return path.\nS:C - A guest-triggered BUG_ON in host KVM LAPIC code panics the physical host kernel and denies all co-resident VMs, crossing the guest-to-host KVM virtualization security boundary even though exploitation is denial-of-service rather than memory corruption.\nC:N - The failure mode is BUG_ON in apic_sync_pv_eoi_from_guest with no out-of-bounds access, use-after-free, or memory corruption; it is a deterministic assertion panic without an information disclosure or memory-read primitive.\nI:N - No guest-controlled kernel memory write or control-flow hijack occurs; the host kernel aborts via BUG_ON before any exploitable state mutation beyond crashing the host, and the bug is a stale pending-bit assertion not type confusion.\nA:H - BUG_ON in kvm_lapic_sync_from_vapic provokes a host kernel oops/panic during KVM_RUN VM-exit processing, immediately denying availability of the hypervisor and every VM on the affected x86 KVM host; the attack is repeatable while PV EOI remains enabled for the guest."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:42:19.282Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/038b9ce6fafda1babd1e33d52cbc6039747a6d87"
},
{
"url": "https://git.kernel.org/stable/c/8e9f7a95279bf608cf4c331ed89612e28c04564f"
},
{
"url": "https://git.kernel.org/stable/c/ebd7845ca0471d251a1cb48d84eb165aff5b7123"
},
{
"url": "https://git.kernel.org/stable/c/97542f15dc4cf6cd3fdc035e482dca54246ddf48"
},
{
"url": "https://git.kernel.org/stable/c/32bdca80aa81c2cb906f50a88b220ce1ecdc5e6e"
},
{
"url": "https://git.kernel.org/stable/c/9285e4070df2c40585c3d7ec9571faa7a2b97e17"
}
],
"title": "KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72284",
"datePublished": "2026-08-15T05:55:07.765Z",
"dateReserved": "2026-08-09T03:40:39.917Z",
"dateUpdated": "2026-10-16T18:55:14.664Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72487 (GCVE-0-2026-72487)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: Check ROM header and data structure addr before accessing
We meet a crash when running stress-ng on x86_64 machine:
BUG: unable to handle page fault for address: ffa0000007f40000
RIP: 0010:pci_get_rom_size+0x52/0x220
Call Trace:
<TASK>
pci_map_rom+0x80/0x130
pci_read_rom+0x4b/0xe0
kernfs_file_read_iter+0x96/0x180
vfs_read+0x1b1/0x300
Our analysis reveals that the ROM space's start address is
0xffa0000007f30000, and size is 0x10000. Because of broken ROM space,
before calling readl(pds), the pds's value is 0xffa0000007f3ffff, which is
already pointed to the ROM space end, invoking readl() would read 4 bytes
therefore cause an out-of-bounds access and trigger a crash. Fix this by
adding image header and data structure checking.
We also found another crash on arm64 machine:
Unable to handle kernel paging request at virtual address ffff8000dd1393ff
Mem abort info:
ESR = 0x0000000096000021
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x21: alignment fault
The call trace is the same with x86_64, but the crash reason is that the
data structure addr is not aligned with 4, and arm64 machine report
"alignment fault". Fix this by adding alignment checking.
[bhelgaas: shorten function names, wrap comments]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 47b975d234eac39f3a72e5496d5f6158d8b806d1 Version: 47b975d234eac39f3a72e5496d5f6158d8b806d1 Version: 47b975d234eac39f3a72e5496d5f6158d8b806d1 Version: 47b975d234eac39f3a72e5496d5f6158d8b806d1 Version: 47b975d234eac39f3a72e5496d5f6158d8b806d1 Version: 47b975d234eac39f3a72e5496d5f6158d8b806d1 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72487",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:50:42.763719Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:26.195Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/rom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cd5b242d5848369b9e957340a7e30adee7b6763d",
"status": "affected",
"version": "47b975d234eac39f3a72e5496d5f6158d8b806d1",
"versionType": "git"
},
{
"lessThan": "4997873e3abbad47a9e1e4abd05f045f77a74f22",
"status": "affected",
"version": "47b975d234eac39f3a72e5496d5f6158d8b806d1",
"versionType": "git"
},
{
"lessThan": "724042f8f98d2594b9d164549fd4292c6bd58120",
"status": "affected",
"version": "47b975d234eac39f3a72e5496d5f6158d8b806d1",
"versionType": "git"
},
{
"lessThan": "1d495446ec7ace5b61da366ffb161ee8319dd9a2",
"status": "affected",
"version": "47b975d234eac39f3a72e5496d5f6158d8b806d1",
"versionType": "git"
},
{
"lessThan": "721ad5b72448b5065ed309017ab563205f162404",
"status": "affected",
"version": "47b975d234eac39f3a72e5496d5f6158d8b806d1",
"versionType": "git"
},
{
"lessThan": "538796b807fcfb81b2ce40cc97a614fd8588feb5",
"status": "affected",
"version": "47b975d234eac39f3a72e5496d5f6158d8b806d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/rom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Check ROM header and data structure addr before accessing\n\nWe meet a crash when running stress-ng on x86_64 machine:\n\n BUG: unable to handle page fault for address: ffa0000007f40000\n RIP: 0010:pci_get_rom_size+0x52/0x220\n Call Trace:\n \u003cTASK\u003e\n pci_map_rom+0x80/0x130\n pci_read_rom+0x4b/0xe0\n kernfs_file_read_iter+0x96/0x180\n vfs_read+0x1b1/0x300\n\nOur analysis reveals that the ROM space\u0027s start address is\n0xffa0000007f30000, and size is 0x10000. Because of broken ROM space,\nbefore calling readl(pds), the pds\u0027s value is 0xffa0000007f3ffff, which is\nalready pointed to the ROM space end, invoking readl() would read 4 bytes\ntherefore cause an out-of-bounds access and trigger a crash. Fix this by\nadding image header and data structure checking.\n\nWe also found another crash on arm64 machine:\n\n Unable to handle kernel paging request at virtual address ffff8000dd1393ff\n Mem abort info:\n ESR = 0x0000000096000021\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x21: alignment fault\n\nThe call trace is the same with x86_64, but the crash reason is that the\ndata structure addr is not aligned with 4, and arm64 machine report\n\"alignment fault\". Fix this by adding alignment checking.\n\n[bhelgaas: shorten function names, wrap comments]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only through local kernel paths\u2014sysfs rom reads, VFIO PCI ROM region access, or pci_map_rom() during driver probe\u2014not via any network-facing handler.\nAC:L - An attacker fully controls option-ROM header fields on a malicious or broken PCI device and can reliably craft pointers/lengths that place MMIO reads at the ROM window edge to trigger the fault.\nPR:N - Exploitation requires no OS privileges when a crafted option ROM on a hot-plugged PCIe/Thunderbolt device is parsed during automatic driver probe; VFIO ROM access also needs only standard device file permissions.\nUI:N - No victim interaction is required beyond attacker-initiated local ROM access or automatic kernel parsing when a malicious PCI device is inserted and bound to a driver.\nS:U - The impact is a kernel page fault/panic within the host kernel from malformed ROM parsing; it does not cross VM, IOMMU, or other security boundaries.\nC:H - pci_get_rom_size() performs unchecked readw/readl on attacker-controlled offsets, causing out-of-bounds MMIO reads past the ioremap window before faulting (CWE-125).\nI:N - The bug is an out-of-bounds read that faults immediately; it does not modify kernel memory, device state, or provide a write/control-flow primitive.\nA:H - Confirmed kernel crashes on x86_64 (page fault) and arm64 (alignment fault) when parsing malformed ROM data, causing denial of service via kernel oops/panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:44:48.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cd5b242d5848369b9e957340a7e30adee7b6763d"
},
{
"url": "https://git.kernel.org/stable/c/4997873e3abbad47a9e1e4abd05f045f77a74f22"
},
{
"url": "https://git.kernel.org/stable/c/724042f8f98d2594b9d164549fd4292c6bd58120"
},
{
"url": "https://git.kernel.org/stable/c/1d495446ec7ace5b61da366ffb161ee8319dd9a2"
},
{
"url": "https://git.kernel.org/stable/c/721ad5b72448b5065ed309017ab563205f162404"
},
{
"url": "https://git.kernel.org/stable/c/538796b807fcfb81b2ce40cc97a614fd8588feb5"
}
],
"title": "PCI: Check ROM header and data structure addr before accessing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72487",
"datePublished": "2026-08-15T05:57:23.490Z",
"dateReserved": "2026-08-09T03:40:39.936Z",
"dateUpdated": "2026-10-16T18:55:26.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74390 (GCVE-0-2026-74390)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs
The irdma_copy_user_pgaddrs function loops through all of the umem DMA
blocks to populate the PBLEs and will stop when either the last DMA
block is reached or palloc->total_cnt is reached. The issue is that
the logic for checking palloc->total_cnt would only work for non-zero
values.
When irdma_setup_pbles is called with lvl==0, it
calls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means
the only way to break out of the loop is to reach the last umem DMA
block, which means it could end up going beyond the fixed size of 4
iwmr->pgaddrmem array that is used in the lvl==0 case.
In the case of QP/CQ/SRQ rings, the value of lvl is determined by a
separate input (for example, req.cq_pages in the case of a CQ). So,
we must perform explicit checking to ensure we don't overflow the
pgaddrmem array if the user provides a umem that consists of more
blocks than their provided req.cq_pages.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74390",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:55:16.364309Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:40.715Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/irdma/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4780f58672ee6328accd54a95f9c00683477e499",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "79a20a8e201a779224b4bf115250a7713bde72c0",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "9f8f0d2099e3de1194e37dc933ae0c4206b09aaf",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "192a3be0e3759daa24af2841208b074ca6dbaabc",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "424d51d33c7541a86934067c2c0538124687fc90",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "abd27a977b419d584efa659488c22d2306987b29",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "5ebb3ed757be3e04cf803026004aa0beaeb13e9b",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/irdma/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs\n\nThe irdma_copy_user_pgaddrs function loops through all of the umem DMA\nblocks to populate the PBLEs and will stop when either the last DMA\nblock is reached or palloc-\u003etotal_cnt is reached. The issue is that\nthe logic for checking palloc-\u003etotal_cnt would only work for non-zero\nvalues.\n\nWhen irdma_setup_pbles is called with lvl==0, it\ncalls irdma_copy_user_pgaddrs with palloc-\u003etotal_cnt==0, which means\nthe only way to break out of the loop is to reach the last umem DMA\nblock, which means it could end up going beyond the fixed size of 4\niwmr-\u003epgaddrmem array that is used in the lvl==0 case.\n\nIn the case of QP/CQ/SRQ rings, the value of lvl is determined by a\nseparate input (for example, req.cq_pages in the case of a CQ). So,\nwe must perform explicit checking to ensure we don\u0027t overflow the\npgaddrmem array if the user provides a umem that consists of more\nblocks than their provided req.cq_pages."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local ioctl on /dev/infiniband/uverbs to register CQ/QP/SRQ memory via irdma_reg_user_mr; the bug is not reachable from remote iWARP/RoCE packet handling.\nAC:L - An attacker fully controls reg_type, cq_pages/sq_pages/rq_pages, and umem size; triggering lvl==0 with many DMA blocks is deterministic and needs no races or special memory layout.\nPR:L - Any unprivileged local user who can open the uverbs device (mode 0666) and use the RDMA NIC\u2014typical on cloud/HPC RDMA nodes\u2014can invoke the vulnerable MR registration path without real root.\nUI:N - No victim interaction is required; the attacker triggers the overflow directly through their own RDMA verbs memory registration calls.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel security boundary, not a cross-VM or cross-IOMMU sandbox escape.\nC:H - The out-of-bounds write of attacker-influenced DMA addresses into adjacent irdma_mr/iwpbl heap metadata can be leveraged for arbitrary kernel memory read primitives, not merely a bounded leak.\nI:H - Controlled out-of-bounds u64 writes past pgaddrmem[4] corrupt adjacent kernel heap structures and are suitable for control-flow or arbitrary kernel write exploitation.\nA:H - Heap corruption in a kzalloc\u0027d irdma_mr can cause immediate kernel oops/panic during registration or on subsequent use of corrupted queue memory metadata."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:46:38.735Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4780f58672ee6328accd54a95f9c00683477e499"
},
{
"url": "https://git.kernel.org/stable/c/79a20a8e201a779224b4bf115250a7713bde72c0"
},
{
"url": "https://git.kernel.org/stable/c/9f8f0d2099e3de1194e37dc933ae0c4206b09aaf"
},
{
"url": "https://git.kernel.org/stable/c/192a3be0e3759daa24af2841208b074ca6dbaabc"
},
{
"url": "https://git.kernel.org/stable/c/424d51d33c7541a86934067c2c0538124687fc90"
},
{
"url": "https://git.kernel.org/stable/c/abd27a977b419d584efa659488c22d2306987b29"
},
{
"url": "https://git.kernel.org/stable/c/5ebb3ed757be3e04cf803026004aa0beaeb13e9b"
}
],
"title": "RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74390",
"datePublished": "2026-08-15T05:59:04.479Z",
"dateReserved": "2026-08-15T05:44:03.891Z",
"dateUpdated": "2026-10-16T19:05:40.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63928 (GCVE-0-2026-63928)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-07-19 14:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: omninet: fix memory corruption with small endpoint
Make sure that the bulk-out buffers are at least as large as the
hardcoded transfer size to avoid user-controlled slab corruption should
a malicious device report a smaller endpoint max packet size than
expected.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/omninet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "180996f0ca774001944e4afa452d569ba2f6455c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b496e25ead5976bce2891dacaed09beb53a54f9f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4e7d32189d6219beb7db37cd0ea36b6bac7dfedb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9a3860454bdfb765f936965e975c594352602ffc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0bda1893e4cc4ad2b7dcdbaca246f2af688c6c2a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0fee0ccac29e088d4bfab7e2d075725dcecd803d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f34cf2928387fba01a78381f3258c7e1428897d9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "60df93d30f9bdd27db17c4d80ed80ef718d7226b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/omninet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: omninet: fix memory corruption with small endpoint\n\nMake sure that the bulk-out buffers are at least as large as the\nhardcoded transfer size to avoid user-controlled slab corruption should\na malicious device report a smaller endpoint max packet size than\nexpected."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T14:55:28.593Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/180996f0ca774001944e4afa452d569ba2f6455c"
},
{
"url": "https://git.kernel.org/stable/c/b496e25ead5976bce2891dacaed09beb53a54f9f"
},
{
"url": "https://git.kernel.org/stable/c/4e7d32189d6219beb7db37cd0ea36b6bac7dfedb"
},
{
"url": "https://git.kernel.org/stable/c/9a3860454bdfb765f936965e975c594352602ffc"
},
{
"url": "https://git.kernel.org/stable/c/0bda1893e4cc4ad2b7dcdbaca246f2af688c6c2a"
},
{
"url": "https://git.kernel.org/stable/c/0fee0ccac29e088d4bfab7e2d075725dcecd803d"
},
{
"url": "https://git.kernel.org/stable/c/f34cf2928387fba01a78381f3258c7e1428897d9"
},
{
"url": "https://git.kernel.org/stable/c/60df93d30f9bdd27db17c4d80ed80ef718d7226b"
}
],
"title": "USB: serial: omninet: fix memory corruption with small endpoint",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63928",
"datePublished": "2026-07-19T14:55:28.593Z",
"dateReserved": "2026-07-19T07:54:57.021Z",
"dateUpdated": "2026-07-19T14:55:28.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72323 (GCVE-0-2026-72323)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()
A race condition exists between device teardown (inetdev_destroy) and
incoming IGMP query processing (igmp_rcv), leading to a Use-After-Free
in the IGMP timer callback.
During device destruction, inetdev_destroy() drops the primary reference
to in_device, which can drop its refcount to 0. The actual freeing of
in_device memory is deferred via RCU (using call_rcu()).
Concurrently, igmp_rcv() runs under RCU read lock and obtains the
in_device pointer. Because the memory is RCU-protected, CPU-0 can safely
dereference in_device even if its refcount has hit 0.
However, if CPU-0 calls igmp_gq_start_timer() and re-arms the timer, it
attempts to acquire a reference using in_dev_hold(). This increments the
refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning.
Since the in_device memory is still scheduled to be freed after the RCU
grace period (as the free callback does not check the refcount again),
the device is freed while the timer is still armed. When the timer
expires, it accesses the freed memory, causing a kernel panic.
Fix this by using refcount_inc_not_zero() (via a new helper
in_dev_hold_safe()) to prevent acquiring a reference if the device is
already being destroyed. If the refcount is 0, we do not arm the timer.
A similar issue in IPv6 MLD is fixed in a subsequent patch.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72323",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:46:57.962757Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:17.940Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/inetdevice.h",
"net/ipv4/igmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7265c747eec415ca3109a6a14a419f7ae433b780",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d107b4c4f8274763b7ea5ab05d45cef78e4b81ba",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "74b301f7f197517016befb5f5dfab01f7bc64be5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "40a1e998cb266ed4cb529a0bb4fee2b0ba732702",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "165258303357e54b75fc19b341ae2a2b7c9e3910",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "75e984fe0cb9e7fbde0c8ee838c61ce8573d3ea3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8d4394ffa40508e0de72f464af351f6ca6a6cdc3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7b19c0f81ed1fdaec6bc522569be367199a9edf3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/inetdevice.h",
"net/ipv4/igmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.269",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.269",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.220",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: igmp: Fix potential UAF in igmp_gq_start_timer()\n\nA race condition exists between device teardown (inetdev_destroy) and\nincoming IGMP query processing (igmp_rcv), leading to a Use-After-Free\nin the IGMP timer callback.\n\nDuring device destruction, inetdev_destroy() drops the primary reference\nto in_device, which can drop its refcount to 0. The actual freeing of\nin_device memory is deferred via RCU (using call_rcu()).\n\nConcurrently, igmp_rcv() runs under RCU read lock and obtains the\nin_device pointer. Because the memory is RCU-protected, CPU-0 can safely\ndereference in_device even if its refcount has hit 0.\n\nHowever, if CPU-0 calls igmp_gq_start_timer() and re-arms the timer, it\nattempts to acquire a reference using in_dev_hold(). This increments the\nrefcount from 0 to 1, triggering a \"refcount_t: addition on 0\" warning.\nSince the in_device memory is still scheduled to be freed after the RCU\ngrace period (as the free callback does not check the refcount again),\nthe device is freed while the timer is still armed. When the timer\nexpires, it accesses the freed memory, causing a kernel panic.\n\nFix this by using refcount_inc_not_zero() (via a new helper\nin_dev_hold_safe()) to prevent acquiring a reference if the device is\nalready being destroyed. If the refcount is 0, we do not arm the timer.\n\nA similar issue in IPv6 MLD is fixed in a subsequent patch."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached from igmp_rcv(), registered as the IPPROTO_IGMP handler and invoked via ip_rcv \u2192 ip_local_deliver \u2192 ip_protocol_deliver_rcu() on received IPv4 packets; per kernel guidance, net/ stack flaws triggered by inbound packets are scored Network even when practical reachability is typically same-subnet.\nAC:L - An attacker controls both race sides: flooding IGMP general membership queries while concurrently deleting/tearing down the target netdev (e.g., veth in a user/net namespace, container CNI teardown, or parallel RTNETLINK unregister), and can retry until the timer is re-armed after ip_mc_down() during inetdev_destroy().\nPR:N - IGMP query processing has no authentication or capability checks on the receive path; any host that can deliver IPPROTO_IGMP packets to the interface can trigger igmp_heard_query() \u2192 igmp_gq_start_timer(), and concurrent interface destruction is normal system/orchestrator activity rather than attacker privilege on the victim.\nUI:N - Exploitation requires only attacker-sent IGMP packets timed against interface teardown; no victim must open files, click links, mount filesystems, or take any deliberate action beyond routine network interface lifecycle events.\nS:U - The use-after-free corrupts kernel heap memory within the same host kernel security authority; it is a standard in-kernel memory corruption issue, not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - This is a use-after-free of struct in_device: igmp_gq_timer_expire() dereferences freed memory and calls igmpv3_send_report(), enabling disclosure of reallocated slab contents and arbitrary kernel memory read primitives via heap grooming.\nI:H - The UAF arms mr_gq_timer on a freed in_device and the expiry handler writes through dangling pointers (mr_gq_running, igmpv3_send_report paths), providing attacker-influenced heap corruption that can be developed into arbitrary kernel write and privilege escalation.\nA:H - The fix commit states the timer callback accesses freed in_device memory and causes kernel panic; UAF on a timer-armed netdev structure is a reliable oops/panic and repeatable DoS, and can be retriggered by continued IGMP query flooding during interface churn."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:49:45.779Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7265c747eec415ca3109a6a14a419f7ae433b780"
},
{
"url": "https://git.kernel.org/stable/c/d107b4c4f8274763b7ea5ab05d45cef78e4b81ba"
},
{
"url": "https://git.kernel.org/stable/c/74b301f7f197517016befb5f5dfab01f7bc64be5"
},
{
"url": "https://git.kernel.org/stable/c/40a1e998cb266ed4cb529a0bb4fee2b0ba732702"
},
{
"url": "https://git.kernel.org/stable/c/165258303357e54b75fc19b341ae2a2b7c9e3910"
},
{
"url": "https://git.kernel.org/stable/c/75e984fe0cb9e7fbde0c8ee838c61ce8573d3ea3"
},
{
"url": "https://git.kernel.org/stable/c/8d4394ffa40508e0de72f464af351f6ca6a6cdc3"
},
{
"url": "https://git.kernel.org/stable/c/7b19c0f81ed1fdaec6bc522569be367199a9edf3"
}
],
"title": "ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72323",
"datePublished": "2026-08-15T05:55:34.828Z",
"dateReserved": "2026-08-09T03:40:39.919Z",
"dateUpdated": "2026-10-16T18:55:17.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74479 (GCVE-0-2026-74479)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: pktgen: fix proc entry use-after-free
pktgen_change_name() replaces pkt_dev->entry while holding t->if_lock.
pktgen_remove_device() removes the same entry before
_rem_dev_from_if_list() takes that lock.
This allows the following interleaving:
CPU 0 (NETDEV_CHANGENAME) CPU 1 (kpktgend)
if_lock(t)
proc_remove(pkt_dev->entry)
proc_remove(pkt_dev->entry)
pkt_dev->entry = proc_create_data(...)
if_unlock(t)
The kthread can pass the stale proc_dir_entry to proc_remove() after the
rename path has freed it. A reproducer with a widened race window reports:
BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80
Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67
Call Trace:
proc_remove+0x78/0x80
pktgen_remove_device.isra.0+0x11c/0x4c0
pktgen_thread_worker+0x1214/0x6bc0
kthread+0x2c6/0x3b0
Allocated by task 95:
__proc_create+0x204/0x790
proc_create_data+0x72/0xe0
pktgen_thread_write+0xd61/0x1510
Freed by task 28:
kmem_cache_free+0xcb/0x3d0
proc_free_inode+0x5b/0x80
rcu_core+0x50a/0x1850
The buggy address belongs to the object at ffff8881478fea00
which belongs to the cache proc_dir_entry of size 192
Move proc_remove() into the if_lock-protected list removal helper. Keep it
before list_del_rcu() to preserve the ordering required by add_device().
The rename path must then finish replacing the entry before removal, or
it observes that the device is no longer on the list.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 39df232f1a9ba48d41c68ee7d4046756e709cf91 Version: 39df232f1a9ba48d41c68ee7d4046756e709cf91 Version: 39df232f1a9ba48d41c68ee7d4046756e709cf91 Version: 39df232f1a9ba48d41c68ee7d4046756e709cf91 Version: 39df232f1a9ba48d41c68ee7d4046756e709cf91 Version: 39df232f1a9ba48d41c68ee7d4046756e709cf91 Version: 39df232f1a9ba48d41c68ee7d4046756e709cf91 Version: 39df232f1a9ba48d41c68ee7d4046756e709cf91 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74479",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:57:37.706862Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:48.651Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/pktgen.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "82ed3db9269cb61e3c15bad2f6e221efce90e1e0",
"status": "affected",
"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
"versionType": "git"
},
{
"lessThan": "d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4",
"status": "affected",
"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
"versionType": "git"
},
{
"lessThan": "7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4",
"status": "affected",
"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
"versionType": "git"
},
{
"lessThan": "577443530cb592d5782a1f79847411a9363a65c8",
"status": "affected",
"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
"versionType": "git"
},
{
"lessThan": "f85a58340b91f225de3299dfa782c6414098077c",
"status": "affected",
"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
"versionType": "git"
},
{
"lessThan": "4ef801b838d85c0ea5852c50667f7344ce3b6cd0",
"status": "affected",
"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
"versionType": "git"
},
{
"lessThan": "b006a5404470bd3eb2aa0425fc447183032047ef",
"status": "affected",
"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
"versionType": "git"
},
{
"lessThan": "817ff6efdb7f484ea547218e11e17d8e43daa3b4",
"status": "affected",
"version": "39df232f1a9ba48d41c68ee7d4046756e709cf91",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/pktgen.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: pktgen: fix proc entry use-after-free\n\npktgen_change_name() replaces pkt_dev-\u003eentry while holding t-\u003eif_lock.\npktgen_remove_device() removes the same entry before\n_rem_dev_from_if_list() takes that lock.\n\nThis allows the following interleaving:\n\n CPU 0 (NETDEV_CHANGENAME) CPU 1 (kpktgend)\n if_lock(t)\n proc_remove(pkt_dev-\u003eentry)\n proc_remove(pkt_dev-\u003eentry)\n pkt_dev-\u003eentry = proc_create_data(...)\n if_unlock(t)\n\nThe kthread can pass the stale proc_dir_entry to proc_remove() after the\nrename path has freed it. A reproducer with a widened race window reports:\n\n BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80\n Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67\n Call Trace:\n proc_remove+0x78/0x80\n pktgen_remove_device.isra.0+0x11c/0x4c0\n pktgen_thread_worker+0x1214/0x6bc0\n kthread+0x2c6/0x3b0\n Allocated by task 95:\n __proc_create+0x204/0x790\n proc_create_data+0x72/0xe0\n pktgen_thread_write+0xd61/0x1510\n Freed by task 28:\n kmem_cache_free+0xcb/0x3d0\n proc_free_inode+0x5b/0x80\n rcu_core+0x50a/0x1850\n The buggy address belongs to the object at ffff8881478fea00\n which belongs to the cache proc_dir_entry of size 192\n\nMove proc_remove() into the if_lock-protected list removal helper. Keep it\nbefore list_del_rcu() to preserve the ordering required by add_device().\nThe rename path must then finish replacing the entry before removal, or\nit observes that the device is no longer on the list."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local access to /proc/net/pktgen procfs writes and a SIOCSIFNAME/ip-link rename of a pktgen-bound netdev; pktgen is configured only via local proc and ioctl paths, not via remote network packets.\nAC:L - The UAF is a race between pktgen_change_name() on NETDEV_CHANGENAME and pktgen_remove_device() in kpktgend; an attacker controls both sides concurrently via rem_device_all/unregister and interface rename, so success does not depend on uncontrollable timing.\nPR:L - Triggering rename needs ns_capable(CAP_NET_ADMIN) and pktgen proc writes are mode 0600; CAP_NET_ADMIN is obtainable by an unprivileged user via user/network namespaces (unshare -Urn), so real init-namespace root is not required.\nUI:N - No victim interaction is required; the attacker drives pktgen device add/remove and netdev rename/unregister directly through local proc writes and netlink/ioctl without needing another user to act.\nS:U - Impact is kernel slab corruption and potential privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries without additional unrelated primitives.\nC:H - The bug is a slab use-after-free of a proc_dir_entry in proc_remove(); KASAN shows reads of freed 192-byte objects, and UAF on proc metadata can be turned into arbitrary kernel memory disclosure via heap grooming.\nI:H - Corrupting or reusing the freed proc_dir_entry during proc_remove()/procfs teardown can enable attacker-controlled writes and control-flow hijack in kernel context, not merely a benign NULL dereference crash.\nA:H - Concurrent rename and removal causes proc_remove() to dereference a freed proc_dir_entry, producing KASAN slab-use-after-free and kernel oops/panic; even without full exploit development, the UAF reliably threatens system availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:47:23.408Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/82ed3db9269cb61e3c15bad2f6e221efce90e1e0"
},
{
"url": "https://git.kernel.org/stable/c/d1cc9797cf8f7aeb87e7ad01b748c6a960a819e4"
},
{
"url": "https://git.kernel.org/stable/c/7991c7cff8b8622cddb3d8dee07dbe74aa4cbec4"
},
{
"url": "https://git.kernel.org/stable/c/577443530cb592d5782a1f79847411a9363a65c8"
},
{
"url": "https://git.kernel.org/stable/c/f85a58340b91f225de3299dfa782c6414098077c"
},
{
"url": "https://git.kernel.org/stable/c/4ef801b838d85c0ea5852c50667f7344ce3b6cd0"
},
{
"url": "https://git.kernel.org/stable/c/b006a5404470bd3eb2aa0425fc447183032047ef"
},
{
"url": "https://git.kernel.org/stable/c/817ff6efdb7f484ea547218e11e17d8e43daa3b4"
}
],
"title": "net: pktgen: fix proc entry use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74479",
"datePublished": "2026-08-15T12:27:13.172Z",
"dateReserved": "2026-08-15T05:44:03.904Z",
"dateUpdated": "2026-10-16T19:05:48.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64304 (GCVE-0-2026-64304)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - validate RSA CRT component lengths
The generic RSA key parser (rsa_helper.c) bounds each CRT component (p,
q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt()
allocates half-size DMA buffers (key_sz / 2) and right-aligns each
component with:
memcpy(dst + half_key_sz - len, src, len)
When a CRT component is larger than half_key_sz the subtraction
underflows and memcpy writes past the DMA buffer, causing memory
corruption.
Add a len > half_key_sz check next to the existing !len check for each
of the five CRT components so the driver falls back to the non-CRT path
instead of writing out of bounds.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 879f77e9071f029e1c9bd5a75814ecf51370f846 Version: 879f77e9071f029e1c9bd5a75814ecf51370f846 Version: 879f77e9071f029e1c9bd5a75814ecf51370f846 Version: 879f77e9071f029e1c9bd5a75814ecf51370f846 Version: 879f77e9071f029e1c9bd5a75814ecf51370f846 Version: 879f77e9071f029e1c9bd5a75814ecf51370f846 Version: 879f77e9071f029e1c9bd5a75814ecf51370f846 Version: 879f77e9071f029e1c9bd5a75814ecf51370f846 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64304",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:38:47.574944Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:22.981Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/intel/qat/qat_common/qat_asym_algs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6d99c5fadd2df488103f64d6475b63ba6852202b",
"status": "affected",
"version": "879f77e9071f029e1c9bd5a75814ecf51370f846",
"versionType": "git"
},
{
"lessThan": "c34369473bfe92a0b46ec78d6358e30341c7f481",
"status": "affected",
"version": "879f77e9071f029e1c9bd5a75814ecf51370f846",
"versionType": "git"
},
{
"lessThan": "1002719d13072a5e4be1e993aa61dffb4a604e82",
"status": "affected",
"version": "879f77e9071f029e1c9bd5a75814ecf51370f846",
"versionType": "git"
},
{
"lessThan": "500319830d76911c120dc0b9605f8c16d7702844",
"status": "affected",
"version": "879f77e9071f029e1c9bd5a75814ecf51370f846",
"versionType": "git"
},
{
"lessThan": "3d61a214fdcda41f1ebfabbb483404032a7b4d91",
"status": "affected",
"version": "879f77e9071f029e1c9bd5a75814ecf51370f846",
"versionType": "git"
},
{
"lessThan": "6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1a",
"status": "affected",
"version": "879f77e9071f029e1c9bd5a75814ecf51370f846",
"versionType": "git"
},
{
"lessThan": "ce42224487c504aee4b7ff3a7342e7b4d7e28cc9",
"status": "affected",
"version": "879f77e9071f029e1c9bd5a75814ecf51370f846",
"versionType": "git"
},
{
"lessThan": "b3ac78756588059729b9195fcc9f4b37d54057a5",
"status": "affected",
"version": "879f77e9071f029e1c9bd5a75814ecf51370f846",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/intel/qat/qat_common/qat_asym_algs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - validate RSA CRT component lengths\n\nThe generic RSA key parser (rsa_helper.c) bounds each CRT component (p,\nq, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt()\nallocates half-size DMA buffers (key_sz / 2) and right-aligns each\ncomponent with:\n\n memcpy(dst + half_key_sz - len, src, len)\n\nWhen a CRT component is larger than half_key_sz the subtraction\nunderflows and memcpy writes past the DMA buffer, causing memory\ncorruption.\n\nAdd a len \u003e half_key_sz check next to the existing !len check for each\nof the five CRT components so the driver falls back to the non-CRT path\ninstead of writing out of bounds."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An unprivileged local process can add a crafted PKCS#8 RSA private key to its own keyring and invoke KEYCTL_PKEY_QUERY, which selects qat-rsa and reaches the vulnerable key setup path.\nAC:L - With an active QAT asymmetric service and PKCS#8 parser, an oversized CRT integer deterministically causes unsigned offset underflow and an out-of-bounds memcpy. No race or attacker-uncontrollable condition is required.\nPR:L - An ordinary user can create, search, and use keys in a personal process, thread, or session keyring. No capability, administrator privilege, or user namespace is required.\nUI:N - The attacker directly performs the add_key and keyctl system calls without any victim action.\nS:U - The vulnerable QAT driver and the corrupted kernel resources share the same security authority. Ordinary kernel privilege escalation does not cross a CVSS scope boundary.\nC:H - The controlled kernel-memory overwrite can corrupt page tables, credentials, or control-flow objects and plausibly yield code execution with access to protected kernel memory.\nI:H - Attacker-controlled CRT bytes are written outside the coherent DMA allocation, potentially through multiple CRT components. This can provide powerful kernel-memory corruption and control-flow hijacking primitives.\nA:H - The invalid destination can cause an immediate kernel fault or corrupt unrelated kernel memory and subsequently panic or hang the system. The attack is repeatable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:03.298Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6d99c5fadd2df488103f64d6475b63ba6852202b"
},
{
"url": "https://git.kernel.org/stable/c/c34369473bfe92a0b46ec78d6358e30341c7f481"
},
{
"url": "https://git.kernel.org/stable/c/1002719d13072a5e4be1e993aa61dffb4a604e82"
},
{
"url": "https://git.kernel.org/stable/c/500319830d76911c120dc0b9605f8c16d7702844"
},
{
"url": "https://git.kernel.org/stable/c/3d61a214fdcda41f1ebfabbb483404032a7b4d91"
},
{
"url": "https://git.kernel.org/stable/c/6fb62b767f3e27661e8f8d2f7b85f4e098fcdb1a"
},
{
"url": "https://git.kernel.org/stable/c/ce42224487c504aee4b7ff3a7342e7b4d7e28cc9"
},
{
"url": "https://git.kernel.org/stable/c/b3ac78756588059729b9195fcc9f4b37d54057a5"
}
],
"title": "crypto: qat - validate RSA CRT component lengths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64304",
"datePublished": "2026-07-25T08:49:38.873Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-10-19T20:38:22.981Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63888 (GCVE-0-2026-63888)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-19 20:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()
Two latent bugs in the Text-phase handler, both present since the
original LIO integration in commit e48354ce078c ("iscsi-target: Add
iSCSI fabric support for target v4.1"):
1) DataDigest CRC buffer overread (4 bytes past text_in).
text_in is kzalloc()'d at ALIGN(payload_length, 4). rx_size is then
incremented by ISCSI_CRC_LEN to make room for the received DataDigest
in the iovec, but the same (now-bumped) rx_size is passed as the
buffer length to iscsit_crc_buf():
if (conn->conn_ops->DataDigest) {
...
rx_size += ISCSI_CRC_LEN;
}
...
if (conn->conn_ops->DataDigest) {
data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);
iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so
when DataDigest is negotiated it reads 4 bytes past the end of the
text_in allocation. KASAN reproduces this directly on the unpatched
mainline tree as slab-out-of-bounds in crc32c() called from the Text
PDU path. The OOB bytes feed crc32c() and are then compared against
the initiator-supplied checksum, so the value does not flow back to
the attacker, but the kernel does read past the buffer on every Text
PDU with DataDigest=CRC32C.
Fix by passing the actual padded payload length
(ALIGN(payload_length, 4)) that was used for the kzalloc().
2) Stale cmd->text_in_ptr re-free (double-free) on ERL>0 bad DataDigest
drop.
On DataDigest mismatch with ErrorRecoveryLevel > 0 the handler
silently drops the PDU and lets the initiator plug the CmdSN gap:
kfree(text_in);
return 0;
cmd->text_in_ptr still points at the freed buffer. The next Text
Request on the same ITT re-enters iscsit_setup_text_cmd(), which
unconditionally does
kfree(cmd->text_in_ptr);
cmd->text_in_ptr = NULL;
freeing the same pointer a second time. Session teardown via
iscsit_release_cmd() has the same shape and hits the same double-free
if the connection is dropped before a second Text Request arrives.
On an unmodified mainline tree the bug-1 CRC overread fires first on
the initial valid Text Request and perturbs the subsequent state, so
#4 was isolated by building a kernel with only the bug-1 hunk of this
patch applied plus temporary printk() observability around the three
relevant kfree() sites. The observability prints are not part of
this patch. On that build, a three-PDU Text Request sequence after
login produces two back-to-back splats:
BUG: KASAN: double-free in iscsit_setup_text_cmd+0x??
BUG: KASAN: double-free in iscsit_release_cmd+0x??
showing the same pointer freed in the ERL>0 drop path and again in
iscsit_setup_text_cmd() (next Text Request on the same ITT) and once
more in iscsit_release_cmd() (session teardown). On distro kernels
with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free
becomes a remote kernel BUG(); on non-hardened kernels it corrupts
the slab freelist.
Fix by clearing cmd->text_in_ptr after the kfree() in the ERL>0 drop
path. With both hunks applied #4 is directly observable on the stock
tree without observability printks; fixing bug-1 alone would mask #4
less, not more, so the hunks are submitted together.
Both fixes are one-liners. The Text PDU state machine is unchanged and
the wire protocol is unaffected.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 Version: e48354ce078c079996f89d715dfa44814b4eba01 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63888",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:32:59.424543Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:54.825Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/iscsi/iscsi_target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f7948af0dd03de84079dcd4dc215a69fd6fbb95d",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "badf178b76b0690851df00f4ca9cf2eb8eb0f963",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "6e22a1cdcc8277af4acc43710577157b77a02c5d",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "d3e9b79aa794f7a23e82de4d710e7d2df610e349",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "ec9f19d52074a191ed1756ed4a7d39fff1a2085c",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "5118ea225fe63b44207ba88047e4866e1ea43812",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "778c2ab142c625a8a8afa570e0f9b7873f445d99",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/iscsi/iscsi_target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()\n\nTwo latent bugs in the Text-phase handler, both present since the\noriginal LIO integration in commit e48354ce078c (\"iscsi-target: Add\niSCSI fabric support for target v4.1\"):\n\n1) DataDigest CRC buffer overread (4 bytes past text_in).\n\n text_in is kzalloc()\u0027d at ALIGN(payload_length, 4). rx_size is then\n incremented by ISCSI_CRC_LEN to make room for the received DataDigest\n in the iovec, but the same (now-bumped) rx_size is passed as the\n buffer length to iscsit_crc_buf():\n\n if (conn-\u003econn_ops-\u003eDataDigest) {\n ...\n rx_size += ISCSI_CRC_LEN;\n }\n ...\n if (conn-\u003econn_ops-\u003eDataDigest) {\n data_crc = iscsit_crc_buf(text_in, rx_size, 0, NULL);\n\n iscsit_crc_buf() walks rx_size bytes of text_in with crc32c(), so\n when DataDigest is negotiated it reads 4 bytes past the end of the\n text_in allocation. KASAN reproduces this directly on the unpatched\n mainline tree as slab-out-of-bounds in crc32c() called from the Text\n PDU path. The OOB bytes feed crc32c() and are then compared against\n the initiator-supplied checksum, so the value does not flow back to\n the attacker, but the kernel does read past the buffer on every Text\n PDU with DataDigest=CRC32C.\n\n Fix by passing the actual padded payload length\n (ALIGN(payload_length, 4)) that was used for the kzalloc().\n\n2) Stale cmd-\u003etext_in_ptr re-free (double-free) on ERL\u003e0 bad DataDigest\n drop.\n\n On DataDigest mismatch with ErrorRecoveryLevel \u003e 0 the handler\n silently drops the PDU and lets the initiator plug the CmdSN gap:\n\n kfree(text_in);\n return 0;\n\n cmd-\u003etext_in_ptr still points at the freed buffer. The next Text\n Request on the same ITT re-enters iscsit_setup_text_cmd(), which\n unconditionally does\n\n kfree(cmd-\u003etext_in_ptr);\n cmd-\u003etext_in_ptr = NULL;\n\n freeing the same pointer a second time. Session teardown via\n iscsit_release_cmd() has the same shape and hits the same double-free\n if the connection is dropped before a second Text Request arrives.\n\n On an unmodified mainline tree the bug-1 CRC overread fires first on\n the initial valid Text Request and perturbs the subsequent state, so\n #4 was isolated by building a kernel with only the bug-1 hunk of this\n patch applied plus temporary printk() observability around the three\n relevant kfree() sites. The observability prints are not part of\n this patch. On that build, a three-PDU Text Request sequence after\n login produces two back-to-back splats:\n\n BUG: KASAN: double-free in iscsit_setup_text_cmd+0x??\n BUG: KASAN: double-free in iscsit_release_cmd+0x??\n\n showing the same pointer freed in the ERL\u003e0 drop path and again in\n iscsit_setup_text_cmd() (next Text Request on the same ITT) and once\n more in iscsit_release_cmd() (session teardown). On distro kernels\n with CONFIG_SLAB_FREELIST_HARDENED=y (default) the double-free\n becomes a remote kernel BUG(); on non-hardened kernels it corrupts\n the slab freelist.\n\n Fix by clearing cmd-\u003etext_in_ptr after the kfree() in the ERL\u003e0 drop\n path. With both hunks applied #4 is directly observable on the stock\n tree without observability printks; fixing bug-1 alone would mask #4\n less, not more, so the hunks are submitted together.\n\nBoth fixes are one-liners. The Text PDU state machine is unchanged and\nthe wire protocol is unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the in-kernel LIO iSCSI target, reachable by sending iSCSI Text PDUs over TCP after connection setup on the network-facing iSCSI portal (typically port 3260), analogous to nfsd/ksmbd network exposure.\nAC:L - An attacker fully controls login parameter negotiation (DataDigest=CRC32C) and subsequent Text PDU content; the CRC overread fires deterministically on every qualifying Text PDU, and the double-free is reliably triggered by sending a bad DataDigest followed by another Text PDU on the same ITT when ERL\u003e0.\nPR:N - No Linux OS privileges are required; the default discovery session permits unauthenticated login (AuthMethod=None, authentication disabled), after which SendTargets Text requests reach the vulnerable handler without any credentials.\nUI:N - Exploitation requires only crafted iSCSI protocol traffic from the attacker; no victim user action such as mounting a filesystem or clicking a link is needed.\nS:U - The vulnerability corrupts kernel heap memory within the iSCSI target subsystem on the host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The CRC path performs a slab out-of-bounds read past the text_in allocation, and the double-free is a use-after-free class bug that reads freed heap metadata; per kernel guidance both OOB reads and UAFs warrant High confidentiality impact.\nI:H - The double-free corrupts the slab freelist (triggering CONFIG_SLAB_FREELIST_HARDENED BUG() on hardened kernels), providing a classic heap corruption primitive that can be leveraged for arbitrary kernel memory writes and code execution.\nA:H - The double-free provably crashes the kernel (KASAN splat or SLAB_FREELIST_HARDENED BUG()), and the heap corruption can cause kernel panics; any UAF is scored as High availability impact per kernel guidance."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:36:57.546Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f7948af0dd03de84079dcd4dc215a69fd6fbb95d"
},
{
"url": "https://git.kernel.org/stable/c/badf178b76b0690851df00f4ca9cf2eb8eb0f963"
},
{
"url": "https://git.kernel.org/stable/c/6e22a1cdcc8277af4acc43710577157b77a02c5d"
},
{
"url": "https://git.kernel.org/stable/c/d3e9b79aa794f7a23e82de4d710e7d2df610e349"
},
{
"url": "https://git.kernel.org/stable/c/ec9f19d52074a191ed1756ed4a7d39fff1a2085c"
},
{
"url": "https://git.kernel.org/stable/c/89c81d1228c00fa6dd91de6c1c5aa1ef8a7875e3"
},
{
"url": "https://git.kernel.org/stable/c/5118ea225fe63b44207ba88047e4866e1ea43812"
},
{
"url": "https://git.kernel.org/stable/c/778c2ab142c625a8a8afa570e0f9b7873f445d99"
}
],
"title": "scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63888",
"datePublished": "2026-07-19T14:55:00.803Z",
"dateReserved": "2026-07-19T07:54:57.018Z",
"dateUpdated": "2026-10-19T20:17:54.825Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72262 (GCVE-0-2026-72262)
Vulnerability from cvelistv5
Published
2026-08-15 05:54
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
The ipc_control_data buffer is allocated as kzalloc(max_size), where
max_size covers the entire struct sof_ipc_ctrl_data including its
flexible array payload. However, the bounds checks in bytes_ext_put
and _bytes_ext_get compared user data lengths against max_size
directly, ignoring that cdata->data sits at an offset of
sizeof(struct sof_ipc_ctrl_data) bytes into the allocation.
This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past
the end of the heap buffer from unprivileged userspace via the ALSA TLV
kcontrol interface, and similarly allowed over-reading adjacent heap
data on the get path.
Fix all bounds checks to subtract sizeof(*cdata) from max_size so they
reflect the actual space available at the cdata->data offset. Also fix
the error-path restore in bytes_ext_put which wrote to cdata->data
instead of cdata, causing the same overflow.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 Version: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 Version: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 Version: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 Version: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 Version: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72262",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:45:34.306028Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:14.172Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/ipc3-control.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af4b437a463ac0482ba705434a44da06783778e6",
"status": "affected",
"version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
"versionType": "git"
},
{
"lessThan": "1adde1941bba7b0d7104b86ed819d48d81cb0ad9",
"status": "affected",
"version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
"versionType": "git"
},
{
"lessThan": "eaa67e139c9217099e2a7b717aeeb46c65de3494",
"status": "affected",
"version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
"versionType": "git"
},
{
"lessThan": "121577383b5cf221e86581e0f2bcca4c66f17469",
"status": "affected",
"version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
"versionType": "git"
},
{
"lessThan": "f4933e1d11b97b6a0951648b7c3e53850e1b33a9",
"status": "affected",
"version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
"versionType": "git"
},
{
"lessThan": "fd46668d538993218eea19c6925c868ac0f2630c",
"status": "affected",
"version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/ipc3-control.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get\n\nThe ipc_control_data buffer is allocated as kzalloc(max_size), where\nmax_size covers the entire struct sof_ipc_ctrl_data including its\nflexible array payload. However, the bounds checks in bytes_ext_put\nand _bytes_ext_get compared user data lengths against max_size\ndirectly, ignoring that cdata-\u003edata sits at an offset of\nsizeof(struct sof_ipc_ctrl_data) bytes into the allocation.\n\nThis allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past\nthe end of the heap buffer from unprivileged userspace via the ALSA TLV\nkcontrol interface, and similarly allowed over-reading adjacent heap\ndata on the get path.\n\nFix all bounds checks to subtract sizeof(*cdata) from max_size so they\nreflect the actual space available at the cdata-\u003edata offset. Also fix\nthe error-path restore in bytes_ext_put which wrote to cdata-\u003edata\ninstead of cdata, causing the same overflow."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local ioctl on /dev/snd/controlC* (SNDRV_CTL_IOCTL_TLV_WRITE/READ) through the ALSA control device; there is no network, adjacent-radio, or physical-bus attack surface for this SOF IPC3 kcontrol path.\nAC:L - On affected SOF IPC3 systems with topology bytes_ext controls, an attacker can deterministically trigger the bug by issuing TLV writes with header.length equal to max_size, causing copy_from_user/memcpy to overrun the kzalloc(max_size) buffer by sizeof(struct sof_ipc_ctrl_data).\nPR:L - The fix commit states the overflow is reachable from unprivileged userspace via ALSA TLV kcontrols; any local user who can open the sound control device (typically membership in the audio group on Linux, or an app with audio access on Android/ChromeOS) can reach the vulnerable code without real root.\nUI:N - Exploitation is performed entirely by the attacker issuing ALSA TLV ioctls against an existing bytes_ext kcontrol; no victim click, mount, or other interactive action beyond the attacker\u0027s own access to the sound control interface is required.\nS:U - The vulnerability corrupts kernel heap memory from a local userspace context and enables standard kernel privilege escalation or denial of service; it does not cross a VM, container, or IOMMU security boundary into a separate authority.\nC:H - The get path can copy_to_user up to sizeof(struct sof_ipc_ctrl_data) bytes beyond the allocated ipc_control_data buffer, leaking adjacent kernel heap contents; combined with the controllable overflow, this is an out-of-bounds read/memory corruption primitive consistent with arbitrary disclosure potential.\nI:H - The put path performs an out-of-bounds heap write of up to sizeof(struct sof_ipc_ctrl_data) bytes past the kzalloc(max_size) allocation (including via the err_restore memcpy), enabling heap metadata/object corruption that can be developed into arbitrary kernel write or code execution.\nA:H - Heap out-of-bounds writes of roughly 96 bytes into adjacent slab objects can corrupt kernel structures and trigger oops/panic or wedged audio/subsystem state; repeated TLV operations make denial of service reliably achievable even without full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:47:11.302Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af4b437a463ac0482ba705434a44da06783778e6"
},
{
"url": "https://git.kernel.org/stable/c/1adde1941bba7b0d7104b86ed819d48d81cb0ad9"
},
{
"url": "https://git.kernel.org/stable/c/eaa67e139c9217099e2a7b717aeeb46c65de3494"
},
{
"url": "https://git.kernel.org/stable/c/121577383b5cf221e86581e0f2bcca4c66f17469"
},
{
"url": "https://git.kernel.org/stable/c/f4933e1d11b97b6a0951648b7c3e53850e1b33a9"
},
{
"url": "https://git.kernel.org/stable/c/fd46668d538993218eea19c6925c868ac0f2630c"
}
],
"title": "ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72262",
"datePublished": "2026-08-15T05:54:49.635Z",
"dateReserved": "2026-08-09T03:40:39.915Z",
"dateUpdated": "2026-10-16T18:55:14.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74488 (GCVE-0-2026-74488)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames
mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with
ieee80211_amsdu_to_8023s() and walks the resulting subframes. For each
subframe it passes the subframe data pointer to
mwifiex_process_tdls_action_frame(), but pairs it with skb->len, the
length of the A-MSDU parent, instead of rx_skb->len:
rx_skb = __skb_dequeue(&list);
rx_hdr = (struct rx_packet_hdr *)rx_skb->data;
if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) {
mwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr,
skb->len);
}
The parent is not a valid description of that buffer, and may not be
valid memory at all. ieee80211_amsdu_to_8023s() ends with
if (!reuse_skb)
dev_kfree_skb(skb);
and it only sets reuse_skb when the parent is linear, is not a
head_frag, and is being consumed as the *last* subframe. So when the
parent does not qualify for reuse it has already been freed, and the
read of skb->len is a use-after-free. When it is reused, skb->len is
the length of the last subframe, applied to every earlier subframe,
which over-states the buffer whenever an earlier subframe is shorter.
The callee cannot absorb a wrong length, because it derives its own
ceiling from the value it is given. Each frame type computes
ies_len = len - sizeof(struct ethhdr) - TDLS_*_FIX_LEN;
and the element walk is then bounded entirely against that ceiling,
for (end = pos + ies_len; pos + 1 < end; pos += 2 + pos[1]) {
u8 ie_len = pos[1];
if (pos + 2 + ie_len > end)
break;
so a too-large len moves end past the end of the subframe and the walk
reads and copies beyond it. The A-MSDU layout is chosen by the sender,
which makes the difference between the last subframe and a shorter
earlier one remotely selectable. Reaching this requires TDLS support in
firmware and the TDLS ethertype on the subframe.
The other caller, mwifiex_process_rx_packet(), is correct: it passes a
pointer and a length that describe the same region of the RX buffer.
Pass rx_skb->len, the length of the subframe actually being parsed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 776f742040ca5eb6242c60f29ac73d5752a5b621 Version: 776f742040ca5eb6242c60f29ac73d5752a5b621 Version: 776f742040ca5eb6242c60f29ac73d5752a5b621 Version: 776f742040ca5eb6242c60f29ac73d5752a5b621 Version: 776f742040ca5eb6242c60f29ac73d5752a5b621 Version: 776f742040ca5eb6242c60f29ac73d5752a5b621 Version: 776f742040ca5eb6242c60f29ac73d5752a5b621 Version: 776f742040ca5eb6242c60f29ac73d5752a5b621 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74488",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:57:58.234804Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:49.470Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "707664027bb9307f7268eda403af7c4ccd9b8644",
"status": "affected",
"version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
"versionType": "git"
},
{
"lessThan": "3b02275833a0d3e6583627995d614fa99bdf364f",
"status": "affected",
"version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
"versionType": "git"
},
{
"lessThan": "a1f0f7dc7eb15754e6931b433edb7beb754c996a",
"status": "affected",
"version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
"versionType": "git"
},
{
"lessThan": "25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79",
"status": "affected",
"version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
"versionType": "git"
},
{
"lessThan": "ece2ebb34247d573142617dfc534a9dc11ba59be",
"status": "affected",
"version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
"versionType": "git"
},
{
"lessThan": "c9dcfe6b8b71369e1d732e2ff622c3696a2f032c",
"status": "affected",
"version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
"versionType": "git"
},
{
"lessThan": "5a21ab03829cb6d2682c127f22e2b9cd63b4393f",
"status": "affected",
"version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
"versionType": "git"
},
{
"lessThan": "99a948382af8a225e2d5e54a7052158cd6281cc6",
"status": "affected",
"version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames\n\nmwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with\nieee80211_amsdu_to_8023s() and walks the resulting subframes. For each\nsubframe it passes the subframe data pointer to\nmwifiex_process_tdls_action_frame(), but pairs it with skb-\u003elen, the\nlength of the A-MSDU parent, instead of rx_skb-\u003elen:\n\n\trx_skb = __skb_dequeue(\u0026list);\n\trx_hdr = (struct rx_packet_hdr *)rx_skb-\u003edata;\n\tif (ISSUPP_TDLS_ENABLED(priv-\u003eadapter-\u003efw_cap_info) \u0026\u0026\n\t ntohs(rx_hdr-\u003eeth803_hdr.h_proto) == ETH_P_TDLS) {\n\t\tmwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr,\n\t\t\t\t\t\t skb-\u003elen);\n\t}\n\nThe parent is not a valid description of that buffer, and may not be\nvalid memory at all. ieee80211_amsdu_to_8023s() ends with\n\n\tif (!reuse_skb)\n\t\tdev_kfree_skb(skb);\n\nand it only sets reuse_skb when the parent is linear, is not a\nhead_frag, and is being consumed as the *last* subframe. So when the\nparent does not qualify for reuse it has already been freed, and the\nread of skb-\u003elen is a use-after-free. When it is reused, skb-\u003elen is\nthe length of the last subframe, applied to every earlier subframe,\nwhich over-states the buffer whenever an earlier subframe is shorter.\n\nThe callee cannot absorb a wrong length, because it derives its own\nceiling from the value it is given. Each frame type computes\n\n\ties_len = len - sizeof(struct ethhdr) - TDLS_*_FIX_LEN;\n\nand the element walk is then bounded entirely against that ceiling,\n\n\tfor (end = pos + ies_len; pos + 1 \u003c end; pos += 2 + pos[1]) {\n\t\tu8 ie_len = pos[1];\n\n\t\tif (pos + 2 + ie_len \u003e end)\n\t\t\tbreak;\n\nso a too-large len moves end past the end of the subframe and the walk\nreads and copies beyond it. The A-MSDU layout is chosen by the sender,\nwhich makes the difference between the last subframe and a shorter\nearlier one remotely selectable. Reaching this requires TDLS support in\nfirmware and the TDLS ethertype on the subframe.\n\nThe other caller, mwifiex_process_rx_packet(), is correct: it passes a\npointer and a length that describe the same region of the RX buffer.\n\nPass rx_skb-\u003elen, the length of the subframe actually being parsed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is reached when the mwifiex driver processes attacker-supplied A-MSDU TDLS frames received over WiFi from a nearby peer, AP, or injector on the same wireless segment, which is an adjacent RF attack vector rather than remote Internet or local syscall access.\nAC:L - Once TDLS-capable mwifiex firmware receives an A-MSDU, the attacker fully controls subframe sizes and TDLS content to trigger either the skb use-after-free or the overstated-length out-of-bounds parse reliably without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation requires only the ability to deliver crafted 802.11 data frames to the victim radio; it does not require any local account, capability, or root access on the Linux host and is not gated by user-namespace privilege boundaries.\nUI:N - No victim user action beyond normal wireless operation is required; the driver parses malicious TDLS subframes automatically during receive and A-MSDU decomposition before forwarding traffic to the network stack.\nS:U - Impact is confined to kernel memory corruption and driver state within the host kernel security authority; it does not by itself cross a VM, container, or IOMMU boundary to affect a separate security domain.\nC:H - The skb use-after-free reads freed sk_buff metadata and the inflated length drives an out-of-bounds IE walk that reads kernel memory beyond the subframe, including attacker-positioned bytes from subsequent A-MSDU subframes, enabling substantial information disclosure.\nI:H - The same out-of-bounds parse copies attacker-controlled IE data from beyond the subframe into heap-allocated sta_node/tdls_cap structures via memcpy, providing a memory-corruption primitive that can be developed into arbitrary kernel write or code execution.\nA:H - Reading skb-\u003elen after the parent A-MSDU skb may already be freed can immediately fault or corrupt memory, and the out-of-bounds TDLS element parsing can provoke kernel oopses or panics even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:43.361Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/707664027bb9307f7268eda403af7c4ccd9b8644"
},
{
"url": "https://git.kernel.org/stable/c/3b02275833a0d3e6583627995d614fa99bdf364f"
},
{
"url": "https://git.kernel.org/stable/c/a1f0f7dc7eb15754e6931b433edb7beb754c996a"
},
{
"url": "https://git.kernel.org/stable/c/25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79"
},
{
"url": "https://git.kernel.org/stable/c/ece2ebb34247d573142617dfc534a9dc11ba59be"
},
{
"url": "https://git.kernel.org/stable/c/c9dcfe6b8b71369e1d732e2ff622c3696a2f032c"
},
{
"url": "https://git.kernel.org/stable/c/5a21ab03829cb6d2682c127f22e2b9cd63b4393f"
},
{
"url": "https://git.kernel.org/stable/c/99a948382af8a225e2d5e54a7052158cd6281cc6"
}
],
"title": "wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74488",
"datePublished": "2026-08-15T12:27:18.867Z",
"dateReserved": "2026-08-15T05:44:03.905Z",
"dateUpdated": "2026-10-16T19:05:49.470Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74582 (GCVE-0-2026-74582)
Vulnerability from cvelistv5
Published
2026-08-21 16:31
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
packet: use consistent hard_header_len in non-ring send paths
packet_snd() reads dev->hard_header_len multiple times while allocating
and constructing an skb. Device reconfiguration can change this value
concurrently, for example through bonding device type changes.
For SOCK_RAW, packet_snd() can save a larger value in reserve and later
allocate headroom using a smaller value. Moving skb->data back by reserve
then places it before skb->head, and the following copy from userspace can
attempt an out-of-bounds write.
packet_sendmsg_spkt() has the same issue because it calculates its
reservation and header offset from separate reads before dropping the RCU
read lock to allocate the skb.
Add LL_RESERVED_SPACE_EX() for callers that already saved a header length.
Read hard_header_len once in packet_snd() and use it for allocation and
construction. In packet_sendmsg_spkt(), preserve the allocation-time value
through the device lookup retry.
The separate SOCK_DGRAM consistency problem between hard_header_len and
header_ops->create is not addressed here.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba Version: d9fb8cc230b2a4757e9fe4f81468f81212d4deaa Version: 6190cce26e40bf71c4d375b21eea74bb07b6a0f3 Version: 01a658c1b9d4b5393c38d5a92d9112ab1425382a Version: 8809ae6747e760e6f1d2453ceb08c9bcc4939766 Version: 4.4.133 ≤ Version: 4.9.103 ≤ Version: 4.14.44 ≤ Version: 4.16.12 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74582",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:01:14.406882Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:58.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h",
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "78a47127e33c340bc6d38dcc4552a094b4f5cc77",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "142e287b3a25cfe909215177c23243e7fc5ae2b1",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "91f041451f967cd87ed722a8f43c0b767a64f1a0",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "9052756290962ffb9a661bcf319e92dedaaedfed",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "5bb10753d428aadfc356a2bfe9acea09c82a62ec",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "b06b6fce6d7deaf7238e09b48ce3b1125ff41acd",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"lessThan": "03390aa32e669cc4ecd7d34108e2e1afc13d689d",
"status": "affected",
"version": "b84bbaf7a6c8cca24f8acf25a2c8e46913a947ba",
"versionType": "git"
},
{
"status": "affected",
"version": "d9fb8cc230b2a4757e9fe4f81468f81212d4deaa",
"versionType": "git"
},
{
"status": "affected",
"version": "6190cce26e40bf71c4d375b21eea74bb07b6a0f3",
"versionType": "git"
},
{
"status": "affected",
"version": "01a658c1b9d4b5393c38d5a92d9112ab1425382a",
"versionType": "git"
},
{
"status": "affected",
"version": "8809ae6747e760e6f1d2453ceb08c9bcc4939766",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.133",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.103",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.44",
"versionType": "semver"
},
{
"lessThan": "4.17",
"status": "affected",
"version": "4.16.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h",
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.133",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.16.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in non-ring send paths\n\npacket_snd() reads dev-\u003ehard_header_len multiple times while allocating\nand constructing an skb. Device reconfiguration can change this value\nconcurrently, for example through bonding device type changes.\n\nFor SOCK_RAW, packet_snd() can save a larger value in reserve and later\nallocate headroom using a smaller value. Moving skb-\u003edata back by reserve\nthen places it before skb-\u003ehead, and the following copy from userspace can\nattempt an out-of-bounds write.\n\npacket_sendmsg_spkt() has the same issue because it calculates its\nreservation and header offset from separate reads before dropping the RCU\nread lock to allocate the skb.\n\nAdd LL_RESERVED_SPACE_EX() for callers that already saved a header length.\nRead hard_header_len once in packet_snd() and use it for allocation and\nconstruction. In packet_sendmsg_spkt(), preserve the allocation-time value\nthrough the device lookup retry.\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb-\u003edata before skb-\u003ehead, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:47.499Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bcd4df60ac9481b1ceffdfe5ec38fe51dcaae812"
},
{
"url": "https://git.kernel.org/stable/c/78a47127e33c340bc6d38dcc4552a094b4f5cc77"
},
{
"url": "https://git.kernel.org/stable/c/142e287b3a25cfe909215177c23243e7fc5ae2b1"
},
{
"url": "https://git.kernel.org/stable/c/91f041451f967cd87ed722a8f43c0b767a64f1a0"
},
{
"url": "https://git.kernel.org/stable/c/9052756290962ffb9a661bcf319e92dedaaedfed"
},
{
"url": "https://git.kernel.org/stable/c/5bb10753d428aadfc356a2bfe9acea09c82a62ec"
},
{
"url": "https://git.kernel.org/stable/c/b06b6fce6d7deaf7238e09b48ce3b1125ff41acd"
},
{
"url": "https://git.kernel.org/stable/c/03390aa32e669cc4ecd7d34108e2e1afc13d689d"
}
],
"title": "packet: use consistent hard_header_len in non-ring send paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74582",
"datePublished": "2026-08-21T16:31:55.283Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-10-16T19:05:58.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80609 (GCVE-0-2026-80609)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-10-16 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
qede: fix out-of-bounds check for cqe->len_list[]
Move index check before element access.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ecbb12caf399d7cf364b7553ed5aebeaa2f255bc Version: a778912b4a53587ea07d85526d152f85d109cbfe Version: f0923011c1261b33a2ac1de349256d39cb750dd0 Version: 917a9d02182ac8b4f25eb47dc02f3ec679608c24 Version: 896f1a2493b59beb2b5ccdf990503dbb16cb2256 Version: 896f1a2493b59beb2b5ccdf990503dbb16cb2256 Version: 896f1a2493b59beb2b5ccdf990503dbb16cb2256 Version: e441db07f208184e0466abf44b389a81d70c340e Version: 5.15.197 ≤ Version: 6.1.159 ≤ Version: 6.6.118 ≤ Version: 6.12.60 ≤ Version: 6.17.10 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80609",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:18:42.466773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:30.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qlogic/qede/qede_fp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6d203bdd227fca1787f8a80cf84b990936633c5a",
"status": "affected",
"version": "ecbb12caf399d7cf364b7553ed5aebeaa2f255bc",
"versionType": "git"
},
{
"lessThan": "bd3a6a083b408e96437dbd86ff543ba9ec3a788b",
"status": "affected",
"version": "a778912b4a53587ea07d85526d152f85d109cbfe",
"versionType": "git"
},
{
"lessThan": "e30af53dca803893a29eb3bbe0539752ba435410",
"status": "affected",
"version": "f0923011c1261b33a2ac1de349256d39cb750dd0",
"versionType": "git"
},
{
"lessThan": "1aacefd074b5dcc99b8dbcd73e1c963ed5010110",
"status": "affected",
"version": "917a9d02182ac8b4f25eb47dc02f3ec679608c24",
"versionType": "git"
},
{
"lessThan": "b17751a2ebc4aef3ce6be6f71ee8df92bf5ddfcd",
"status": "affected",
"version": "896f1a2493b59beb2b5ccdf990503dbb16cb2256",
"versionType": "git"
},
{
"lessThan": "6d46ab395803f162cdc50e8d346e5f1a4e766771",
"status": "affected",
"version": "896f1a2493b59beb2b5ccdf990503dbb16cb2256",
"versionType": "git"
},
{
"lessThan": "f9ba47fce5932c15891c89c60e76dfaca919cb8d",
"status": "affected",
"version": "896f1a2493b59beb2b5ccdf990503dbb16cb2256",
"versionType": "git"
},
{
"status": "affected",
"version": "e441db07f208184e0466abf44b389a81d70c340e",
"versionType": "git"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.197",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.159",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.118",
"versionType": "semver"
},
{
"lessThan": "6.12.97",
"status": "affected",
"version": "6.12.60",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qlogic/qede/qede_fp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.197",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.159",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12.60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: fix out-of-bounds check for cqe-\u003elen_list[]\n\nMove index check before element access."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in qede TPA completion handling on the NAPI RX fastpath; remote TCP traffic to a Marvell/QLogic FastLinQ NIC causes firmware to post TPA CQEs that are parsed in qede_poll()-\u003eqede_rx_int()-\u003eqede_rx_process_tpa_cqe()-\u003eqede_tpa_cont()/qede_tpa_end().\nAC:L - An attacker can repeatedly send high-rate crafted TCP bursts to maximize TPA aggregation BD counts so all len_list[] slots are non-zero, deterministically hitting the misordered bounds check without races, special memory layout, or victim-specific state.\nPR:N - Only the ability to send Ethernet/TCP packets to a listening host with a qede interface is required; RX and TPA CQE processing occur in softirq before any authentication, capability checks, or local account access.\nUI:N - No victim action is needed beyond normal network operation; packet reception, interrupt handling, and NAPI polling automatically process attacker-supplied frames and completion descriptors.\nS:U - The out-of-bounds read and resulting skb/RX-ring corruption stay within the host kernel security boundary and do not cross VM, container, IOMMU, or sandbox isolation by themselves.\nC:H - The loop reads past len_list[] into adjacent completion-descriptor memory before the bound check, and the same malformed CQE drives qede_fill_frag_skb() with attacker-influenced lengths that can leak uninitialized RX-ring/page data up the network stack.\nI:H - Extra qede_fill_frag_skb() iterations advance frag_id without MAX_SKB_FRAGS limits and consume RX BDs using firmware-supplied lengths, enabling controllable skb shared-info and RX-ring corruption exploitable for arbitrary kernel writes.\nA:H - Corrupted skb fragment metadata and desynchronized RX BD consumption reliably trigger kernel oops/panic or wedged RX processing in softirq, and the condition is remotely repeatable for sustained denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T06:21:19.318Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6d203bdd227fca1787f8a80cf84b990936633c5a"
},
{
"url": "https://git.kernel.org/stable/c/bd3a6a083b408e96437dbd86ff543ba9ec3a788b"
},
{
"url": "https://git.kernel.org/stable/c/e30af53dca803893a29eb3bbe0539752ba435410"
},
{
"url": "https://git.kernel.org/stable/c/1aacefd074b5dcc99b8dbcd73e1c963ed5010110"
},
{
"url": "https://git.kernel.org/stable/c/b17751a2ebc4aef3ce6be6f71ee8df92bf5ddfcd"
},
{
"url": "https://git.kernel.org/stable/c/6d46ab395803f162cdc50e8d346e5f1a4e766771"
},
{
"url": "https://git.kernel.org/stable/c/f9ba47fce5932c15891c89c60e76dfaca919cb8d"
}
],
"title": "qede: fix out-of-bounds check for cqe-\u003elen_list[]",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80609",
"datePublished": "2026-08-28T06:48:32.751Z",
"dateReserved": "2026-08-26T14:34:25.773Z",
"dateUpdated": "2026-10-16T19:26:30.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74334 (GCVE-0-2026-74334)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/nldev: Fix locking when accessing mr->pd
Sashiko points out that, due to rereg_mr, the PD is actually variable and
all the touches in nldev are racy.
Use mr->device instead of mr->pd->device.
Getting the PD restrack ID is more tricky. To avoid disturbing all the
happy paths, add an rdma_restrack_sync() operation which is sort of like
flush_workqueue() or synchronize_irq(): after it returns, all the old
nldev touches to the mr are gone and everything sees the new PD. This
makes it safe to reach into the PD pointer.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: da5c8507821573b8ed6e3f47e009f273493ffaf7 Version: da5c8507821573b8ed6e3f47e009f273493ffaf7 Version: da5c8507821573b8ed6e3f47e009f273493ffaf7 Version: da5c8507821573b8ed6e3f47e009f273493ffaf7 Version: da5c8507821573b8ed6e3f47e009f273493ffaf7 Version: da5c8507821573b8ed6e3f47e009f273493ffaf7 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74334",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:53:49.608601Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:33.821Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/nldev.c",
"drivers/infiniband/core/restrack.c",
"drivers/infiniband/core/restrack.h",
"drivers/infiniband/core/uverbs_cmd.c",
"include/rdma/ib_verbs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "845c6b355226195dad1f26b300c4830f57034e8b",
"status": "affected",
"version": "da5c8507821573b8ed6e3f47e009f273493ffaf7",
"versionType": "git"
},
{
"lessThan": "7a0cbb5721a1da81e902d73b6049f85ca8f3fc0a",
"status": "affected",
"version": "da5c8507821573b8ed6e3f47e009f273493ffaf7",
"versionType": "git"
},
{
"lessThan": "05e26f34597e9c38bb5b340d86b179b23673869f",
"status": "affected",
"version": "da5c8507821573b8ed6e3f47e009f273493ffaf7",
"versionType": "git"
},
{
"lessThan": "a07cba1296aaa81bf9b914486ca957aaff196247",
"status": "affected",
"version": "da5c8507821573b8ed6e3f47e009f273493ffaf7",
"versionType": "git"
},
{
"lessThan": "1a132ee4e655288d9a0937ea5109a0d038431ae9",
"status": "affected",
"version": "da5c8507821573b8ed6e3f47e009f273493ffaf7",
"versionType": "git"
},
{
"lessThan": "50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3",
"status": "affected",
"version": "da5c8507821573b8ed6e3f47e009f273493ffaf7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/nldev.c",
"drivers/infiniband/core/restrack.c",
"drivers/infiniband/core/restrack.h",
"drivers/infiniband/core/uverbs_cmd.c",
"include/rdma/ib_verbs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/nldev: Fix locking when accessing mr-\u003epd\n\nSashiko points out that, due to rereg_mr, the PD is actually variable and\nall the touches in nldev are racy.\n\nUse mr-\u003edevice instead of mr-\u003epd-\u003edevice.\n\nGetting the PD restrack ID is more tricky. To avoid disturbing all the\nhappy paths, add an rdma_restrack_sync() operation which is sort of like\nflush_workqueue() or synchronize_irq(): after it returns, all the old\nnldev touches to the mr are gone and everything sees the new PD. This\nmakes it safe to reach into the PD pointer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached via local NETLINK_RDMA nldev MR resource dumps and concurrent IB_USER_VERBS_CMD_REREG_MR ioctl on /dev/infiniband/uverbs; it is not triggered by remote RDMA/InfiniBand/RoCE network traffic.\nAC:L - An attacker controls both race sides by spawning threads that hammer rereg_mr with IB_MR_REREG_PD and nldev RES_MR_GET dumps, optionally deallocating the old PD; no timing or layout conditions outside attacker control are required.\nPR:L - Exploitation needs only local uverbs access (device nodes default 0666) plus NETLINK_RDMA dumps; CAP_NET_ADMIN for netlink send is obtainable by unprivileged users via user namespaces, not real init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers both the rereg_mr PD change and the concurrent nldev MR dump from their own process.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel security boundary, not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Concurrent rereg_mr can free the old ib_pd while nldev still dereferences mr-\u003epd for device and res.id, creating a use-after-free that enables arbitrary kernel memory disclosure via controlled reuse of freed slab objects.\nI:H - The ib_pd UAF is exploitable for heap grooming and arbitrary kernel write or control-flow hijack, not merely a bounded data corruption or guaranteed crash.\nA:H - The race reliably causes kernel oops or panic from dereferencing a freed ib_pd during nldev dumps, and UAF exploitation can additionally crash or hang the system during heap manipulation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:58:43.928Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/845c6b355226195dad1f26b300c4830f57034e8b"
},
{
"url": "https://git.kernel.org/stable/c/7a0cbb5721a1da81e902d73b6049f85ca8f3fc0a"
},
{
"url": "https://git.kernel.org/stable/c/05e26f34597e9c38bb5b340d86b179b23673869f"
},
{
"url": "https://git.kernel.org/stable/c/a07cba1296aaa81bf9b914486ca957aaff196247"
},
{
"url": "https://git.kernel.org/stable/c/1a132ee4e655288d9a0937ea5109a0d038431ae9"
},
{
"url": "https://git.kernel.org/stable/c/50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3"
}
],
"title": "RDMA/nldev: Fix locking when accessing mr-\u003epd",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74334",
"datePublished": "2026-08-15T05:58:26.455Z",
"dateReserved": "2026-08-15T05:44:03.885Z",
"dateUpdated": "2026-10-16T18:55:33.821Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64323 (GCVE-0-2026-64323)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
udf: validate VAT header length against the VAT inode size
udf_load_vat() takes the virtual partition's start offset straight from
the on-disk VAT 2.0 header without checking it against the VAT inode
size:
map->s_type_specific.s_virtual.s_start_offset =
le16_to_cpu(vat20->lengthHeader);
map->s_type_specific.s_virtual.s_num_entries =
(sbi->s_vat_inode->i_size -
map->s_type_specific.s_virtual.s_start_offset) >> 2;
lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds
the VAT inode size, the s_num_entries subtraction underflows to a huge
count, which defeats the "block > s_num_entries" bound in
udf_get_pblock_virt15(); and on the ICB-inline path that function reads
((__le32 *)(iinfo->i_data + s_start_offset))[block]
so a large s_start_offset indexes past the inode's in-ICB data. Mounting
a crafted UDF image with a virtual (VAT) partition then triggers an
out-of-bounds read.
Reject a VAT whose header length does not leave room for at least one
entry within the VAT inode.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fa5e08156335d0687c85b4e724db9448fb166601 Version: fa5e08156335d0687c85b4e724db9448fb166601 Version: fa5e08156335d0687c85b4e724db9448fb166601 Version: fa5e08156335d0687c85b4e724db9448fb166601 Version: fa5e08156335d0687c85b4e724db9448fb166601 Version: fa5e08156335d0687c85b4e724db9448fb166601 Version: fa5e08156335d0687c85b4e724db9448fb166601 Version: fa5e08156335d0687c85b4e724db9448fb166601 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64323",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:39:09.958903Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:24.010Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/udf/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "883962731420ec271ed8c1cd76524f4b17faa982",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "55287a3555ff0515b3aff181d2c08c0462a41709",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "74580fdf022909e184223cacc364feb826982d96",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
},
{
"lessThan": "d8202786b3d75125c84ebc4de6d946f92fde0ee8",
"status": "affected",
"version": "fa5e08156335d0687c85b4e724db9448fb166601",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/udf/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: validate VAT header length against the VAT inode size\n\nudf_load_vat() takes the virtual partition\u0027s start offset straight from\nthe on-disk VAT 2.0 header without checking it against the VAT inode\nsize:\n\n\tmap-\u003es_type_specific.s_virtual.s_start_offset =\n\t\tle16_to_cpu(vat20-\u003elengthHeader);\n\tmap-\u003es_type_specific.s_virtual.s_num_entries =\n\t\t(sbi-\u003es_vat_inode-\u003ei_size -\n\t\t\tmap-\u003es_type_specific.s_virtual.s_start_offset) \u003e\u003e 2;\n\nlengthHeader is a fully attacker-controlled 16-bit value. If it exceeds\nthe VAT inode size, the s_num_entries subtraction underflows to a huge\ncount, which defeats the \"block \u003e s_num_entries\" bound in\nudf_get_pblock_virt15(); and on the ICB-inline path that function reads\n\n\t((__le32 *)(iinfo-\u003ei_data + s_start_offset))[block]\n\nso a large s_start_offset indexes past the inode\u0027s in-ICB data. Mounting\na crafted UDF image with a virtual (VAT) partition then triggers an\nout-of-bounds read.\n\nReject a VAT whose header length does not leave room for at least one\nentry within the VAT inode."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable parser is reached by mounting a crafted local UDF image or removable volume; no network-facing protocol reaches it.\nAC:L - The VAT type, inline allocation, header length, and virtual block index are attacker-controlled on disk, with no race or uncontrollable condition required.\nPR:L - Although direct mounting requires init-namespace CAP_SYS_ADMIN, common UDisks/polkit deployments let an active unprivileged local user create a loop device and request the mount.\nUI:N - In the low-privilege UDisks scenario, the attacker can initiate the mount and trigger VAT resolution without another user\u0027s action.\nS:U - The vulnerable UDF parser and affected kernel resources remain within the host kernel\u0027s security authority.\nC:H - The underflow permits repeatable 32-bit reads at attacker-selected offsets potentially many gigabytes beyond the VAT buffer, enabling disclosure of kernel memory.\nI:N - The primitive only reads a mapping value, and virtual UDF partitions are forcibly read-only; no kernel-memory write primitive results.\nA:H - A sufficiently large attacker-selected index can fault in kernel context and cause an oops or panic, enabling repeatable system-wide denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:25.005Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ad2d09a8d66fa8dc6f9b70d660b5fb4478ea934"
},
{
"url": "https://git.kernel.org/stable/c/883962731420ec271ed8c1cd76524f4b17faa982"
},
{
"url": "https://git.kernel.org/stable/c/2900e02a0dd4fc30ac9840e7ce4ca0b041ab0d63"
},
{
"url": "https://git.kernel.org/stable/c/bb0d384c1f42a5b7ace0bd88fee80b9bb1d49acb"
},
{
"url": "https://git.kernel.org/stable/c/55287a3555ff0515b3aff181d2c08c0462a41709"
},
{
"url": "https://git.kernel.org/stable/c/e610fb113cdfa8bf4247c9bf4f2337b81ad4ddad"
},
{
"url": "https://git.kernel.org/stable/c/74580fdf022909e184223cacc364feb826982d96"
},
{
"url": "https://git.kernel.org/stable/c/d8202786b3d75125c84ebc4de6d946f92fde0ee8"
}
],
"title": "udf: validate VAT header length against the VAT inode size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64323",
"datePublished": "2026-07-25T08:49:51.097Z",
"dateReserved": "2026-07-19T15:36:31.780Z",
"dateUpdated": "2026-10-19T20:38:24.010Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64380 (GCVE-0-2026-64380)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: harden POSIX SID length parsing
posix_info_sid_size() reads sid[1] to obtain the subauthority count,
but its existing boundary check still accepts buffers with only one
remaining byte. Require two bytes before reading sid[1] so all client
paths that reuse the helper reject truncated POSIX SIDs safely.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 349e13ad30b45998bb9937cfe0b32be6f951976d Version: 349e13ad30b45998bb9937cfe0b32be6f951976d Version: 349e13ad30b45998bb9937cfe0b32be6f951976d Version: 349e13ad30b45998bb9937cfe0b32be6f951976d Version: 349e13ad30b45998bb9937cfe0b32be6f951976d Version: 349e13ad30b45998bb9937cfe0b32be6f951976d Version: 349e13ad30b45998bb9937cfe0b32be6f951976d Version: 349e13ad30b45998bb9937cfe0b32be6f951976d |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:39:47.266663Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:25.851Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "171605aed68380c2fa75dff9b3a1ed427c50065b",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "4213c1208978483021d7d125c131de3985d38f61",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "96e889bc1e759c83f25093e8c2f3da31b4973f30",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "0de5b8e76847f5de26f364a82c6602c4881c30da",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "427eb7eb46425fec845a43e861f3d6e2899cae59",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "86c5d470f5d42e61123b2f4b4f0b91f4eee5b980",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "46a84715a015cb48e1b9c219dc88c03d8a541ea4",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
},
{
"lessThan": "7ad2bcf2441430bb2e918fb3ef9a90d775a6e422",
"status": "affected",
"version": "349e13ad30b45998bb9937cfe0b32be6f951976d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: harden POSIX SID length parsing\n\nposix_info_sid_size() reads sid[1] to obtain the subauthority count,\nbut its existing boundary check still accepts buffers with only one\nremaining byte. Require two bytes before reading sid[1] so all client\npaths that reuse the helper reject truncated POSIX SIDs safely."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious SMB server can deliver the truncated POSIX SID through SMB3.1.1 query-info or query-directory responses over TCP.\nAC:L - The server directly controls the response length and can deterministically leave exactly one SID byte remaining; no race or uncontrollable condition is required.\nPR:N - The malicious server needs no privileges on the vulnerable client, and guest-capable or attacker-controlled shares can supply the response after connection establishment.\nUI:N - On an already mounted POSIX-enabled share, routine automated stat, readdir, or metadata operations can trigger parsing without human interaction.\nS:U - The out-of-bounds access occurs within the client kernel and does not cross a virtualization, IOMMU, or other separate security authority boundary.\nC:L - The primitive reads exactly one byte beyond the response boundary, limiting any confidentiality effect to adjacent memory rather than providing an arbitrary-read primitive.\nI:N - The out-of-bounds byte only influences validation, which always rejects because a legal SID requires at least 12 bytes; no attacker-influenced copy or memory write follows.\nA:H - The server can place the truncated SID at the receive allocation boundary, where the out-of-bounds access can trigger a sanitizer fault or kernel oops and can be repeated to crash the client."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:31.740Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/171605aed68380c2fa75dff9b3a1ed427c50065b"
},
{
"url": "https://git.kernel.org/stable/c/4213c1208978483021d7d125c131de3985d38f61"
},
{
"url": "https://git.kernel.org/stable/c/96e889bc1e759c83f25093e8c2f3da31b4973f30"
},
{
"url": "https://git.kernel.org/stable/c/0de5b8e76847f5de26f364a82c6602c4881c30da"
},
{
"url": "https://git.kernel.org/stable/c/427eb7eb46425fec845a43e861f3d6e2899cae59"
},
{
"url": "https://git.kernel.org/stable/c/86c5d470f5d42e61123b2f4b4f0b91f4eee5b980"
},
{
"url": "https://git.kernel.org/stable/c/46a84715a015cb48e1b9c219dc88c03d8a541ea4"
},
{
"url": "https://git.kernel.org/stable/c/7ad2bcf2441430bb2e918fb3ef9a90d775a6e422"
}
],
"title": "smb: client: harden POSIX SID length parsing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64380",
"datePublished": "2026-07-25T08:50:30.476Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-10-19T20:38:25.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64103 (GCVE-0-2026-64103)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-07-19 15:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: isci: Fix use-after-free in device removal path
The ISCI completion tasklet is initialized in isci_host_alloc()
(drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy
interrupt handlers (drivers/scsi/isci/host.c:223,613).
isci_host_deinit() stops the controller and waits for stop completion,
but it never kills completion_tasklet before teardown continues. A
top-of-function tasklet_kill() is not sufficient here: interrupts are
only disabled when isci_host_stop_complete() runs, so until
wait_for_stop() returns the IRQ handlers can still requeue the
tasklet. The tasklet callback also re-enables interrupts after draining
completions, so killing the tasklet before the source is quiesced leaves
the same race open.
Once wait_for_stop() returns, no further IRQ-driven scheduling can
occur. Kill completion_tasklet there so teardown cannot race a queued
tasklet running on a dead ihost. On remove or unload, the stale callback
can otherwise dereference ihost and touch ihost->smu_registers after the
host lifetime ends.
A UML + KASAN analogue reproduced the failure class both with no
tasklet_kill() and with tasklet_kill() placed before source quiesce, and
stayed clean once the kill happened after quiescing the scheduling
source.
This mirrors commit f6ab594672d4 ("scsi: aic94xx: fix use-after-free in
device removal path"), but ISCI needs the kill after wait_for_stop().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6f231dda68080759f1aed3769896e94c73099f0f Version: 6f231dda68080759f1aed3769896e94c73099f0f Version: 6f231dda68080759f1aed3769896e94c73099f0f Version: 6f231dda68080759f1aed3769896e94c73099f0f Version: 6f231dda68080759f1aed3769896e94c73099f0f Version: 6f231dda68080759f1aed3769896e94c73099f0f Version: 6f231dda68080759f1aed3769896e94c73099f0f Version: 6f231dda68080759f1aed3769896e94c73099f0f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/isci/host.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1412995e10c74644b47f242aea6e4f3d4180e806",
"status": "affected",
"version": "6f231dda68080759f1aed3769896e94c73099f0f",
"versionType": "git"
},
{
"lessThan": "a83d3e4daba40d49324cec1c51ed261e1ea48cf1",
"status": "affected",
"version": "6f231dda68080759f1aed3769896e94c73099f0f",
"versionType": "git"
},
{
"lessThan": "ab2266601a875982f2d2033f41e070a6d5e615e2",
"status": "affected",
"version": "6f231dda68080759f1aed3769896e94c73099f0f",
"versionType": "git"
},
{
"lessThan": "309c6058622d080fe8c2fab87c30da82d834d989",
"status": "affected",
"version": "6f231dda68080759f1aed3769896e94c73099f0f",
"versionType": "git"
},
{
"lessThan": "cb9e72c50e6c81a5903f27e0b397ce8525d7539b",
"status": "affected",
"version": "6f231dda68080759f1aed3769896e94c73099f0f",
"versionType": "git"
},
{
"lessThan": "b9ff8631006233ba246828ac70409d2cb2da38d3",
"status": "affected",
"version": "6f231dda68080759f1aed3769896e94c73099f0f",
"versionType": "git"
},
{
"lessThan": "6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c",
"status": "affected",
"version": "6f231dda68080759f1aed3769896e94c73099f0f",
"versionType": "git"
},
{
"lessThan": "b52a8d52c3125ec9a93106ed816582368de34426",
"status": "affected",
"version": "6f231dda68080759f1aed3769896e94c73099f0f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/isci/host.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: isci: Fix use-after-free in device removal path\n\nThe ISCI completion tasklet is initialized in isci_host_alloc()\n(drivers/scsi/isci/init.c:496) and scheduled from both MSI-X and legacy\ninterrupt handlers (drivers/scsi/isci/host.c:223,613).\n\nisci_host_deinit() stops the controller and waits for stop completion,\nbut it never kills completion_tasklet before teardown continues. A\ntop-of-function tasklet_kill() is not sufficient here: interrupts are\nonly disabled when isci_host_stop_complete() runs, so until\nwait_for_stop() returns the IRQ handlers can still requeue the\ntasklet. The tasklet callback also re-enables interrupts after draining\ncompletions, so killing the tasklet before the source is quiesced leaves\nthe same race open.\n\nOnce wait_for_stop() returns, no further IRQ-driven scheduling can\noccur. Kill completion_tasklet there so teardown cannot race a queued\ntasklet running on a dead ihost. On remove or unload, the stale callback\ncan otherwise dereference ihost and touch ihost-\u003esmu_registers after the\nhost lifetime ends.\n\nA UML + KASAN analogue reproduced the failure class both with no\ntasklet_kill() and with tasklet_kill() placed before source quiesce, and\nstayed clean once the kill happened after quiescing the scheduling\nsource.\n\nThis mirrors commit f6ab594672d4 (\"scsi: aic94xx: fix use-after-free in\ndevice removal path\"), but ISCI needs the kill after wait_for_stop()."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T15:40:07.372Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1412995e10c74644b47f242aea6e4f3d4180e806"
},
{
"url": "https://git.kernel.org/stable/c/a83d3e4daba40d49324cec1c51ed261e1ea48cf1"
},
{
"url": "https://git.kernel.org/stable/c/ab2266601a875982f2d2033f41e070a6d5e615e2"
},
{
"url": "https://git.kernel.org/stable/c/309c6058622d080fe8c2fab87c30da82d834d989"
},
{
"url": "https://git.kernel.org/stable/c/cb9e72c50e6c81a5903f27e0b397ce8525d7539b"
},
{
"url": "https://git.kernel.org/stable/c/b9ff8631006233ba246828ac70409d2cb2da38d3"
},
{
"url": "https://git.kernel.org/stable/c/6d40f2f103bb30f52f3dbadbe2c3fdf274a9763c"
},
{
"url": "https://git.kernel.org/stable/c/b52a8d52c3125ec9a93106ed816582368de34426"
}
],
"title": "scsi: isci: Fix use-after-free in device removal path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64103",
"datePublished": "2026-07-19T15:40:07.372Z",
"dateReserved": "2026-07-19T07:54:57.034Z",
"dateUpdated": "2026-07-19T15:40:07.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74394 (GCVE-0-2026-74394)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: fix integer overflow in immediate data length check
imm_buf->len is a user-controlled uint32_t received from the network.
Adding it to imm_data_offset without overflow checking allows a
malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
around to a small value, bypassing the bounds check, and subsequently
passing a ~4GB length to sg_init_one().
Use check_add_overflow() to detect wrapping before the comparison.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 Version: 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 Version: 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 Version: 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 Version: 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 Version: 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 Version: 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 Version: 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74394",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:55:19.237271Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:40.869Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srpt/ib_srpt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c82c860f8c8e4f4f454c9f14d0ad0c0466965f7d",
"status": "affected",
"version": "5dabcd0456d7ee17c2c7a17d7c2305444d2b9639",
"versionType": "git"
},
{
"lessThan": "3efa5301137140a3ca3677a9098c0a93a0acfd49",
"status": "affected",
"version": "5dabcd0456d7ee17c2c7a17d7c2305444d2b9639",
"versionType": "git"
},
{
"lessThan": "067b9556eeb007f28b7c2033b4dcde5b6d88418f",
"status": "affected",
"version": "5dabcd0456d7ee17c2c7a17d7c2305444d2b9639",
"versionType": "git"
},
{
"lessThan": "dcf7a986f377cce0749ed53f1d64195fbd5fdf91",
"status": "affected",
"version": "5dabcd0456d7ee17c2c7a17d7c2305444d2b9639",
"versionType": "git"
},
{
"lessThan": "07dec3f6dcb6c6cc891162d252b800eb0e6d5e8e",
"status": "affected",
"version": "5dabcd0456d7ee17c2c7a17d7c2305444d2b9639",
"versionType": "git"
},
{
"lessThan": "65572fbd86033ae2370125593d59b8be34253aaf",
"status": "affected",
"version": "5dabcd0456d7ee17c2c7a17d7c2305444d2b9639",
"versionType": "git"
},
{
"lessThan": "72497172a4799119a0282a5eb5e2b8ddcc821921",
"status": "affected",
"version": "5dabcd0456d7ee17c2c7a17d7c2305444d2b9639",
"versionType": "git"
},
{
"lessThan": "eb4ecdf631fe00e8020bf461503cb9b7017ed796",
"status": "affected",
"version": "5dabcd0456d7ee17c2c7a17d7c2305444d2b9639",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srpt/ib_srpt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: fix integer overflow in immediate data length check\n\nimm_buf-\u003elen is a user-controlled uint32_t received from the network.\nAdding it to imm_data_offset without overflow checking allows a\nmalicious initiator to send len=0xFFFFFFFF, causing req_size to wrap\naround to a small value, bypassing the bounds check, and subsequently\npassing a ~4GB length to sg_init_one().\n\nUse check_add_overflow() to detect wrapping before the comparison."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - SRPT is an in-kernel SCSI RDMA target reached by remote initiators over InfiniBand/RoCE via RDMA/IB CM; malicious SRP_CMD IUs are delivered through `srpt_recv_done()` without any local syscall or physical access.\nAC:L - Once connected on an immediate-data SRPT target (use_srq=0), a malicious initiator deterministically sets `imm_buf-\u003elen=0xFFFFFFFF` to wrap `req_size` and bypass checks; no race or attacker-uncontrollable condition is required.\nPR:N - SRPT enables LIO demo mode (`srpt_check_true`), so any remote initiator that completes SRP login on an enabled target gets a dynamic ACL without target-local credentials, root, or CAP_NET_ADMIN on the victim host.\nUI:N - Exploitation requires only attacker-initiated RDMA connection, SRP login, and crafted SRP_CMD traffic; no administrator or other user must mount storage or perform any action on the target.\nS:U - The integer overflow corrupts kernel heap memory and SCSI-target processing within the host kernel\u0027s own security authority; it does not cross VM, IOMMU, or container sandbox boundaries.\nC:H - Passing a ~4GB length to `sg_init_one()` on a small receive buffer creates a massive out-of-bounds scatterlist; subsequent target-core DMA/map operations can read far beyond the buffer, enabling arbitrary kernel memory disclosure.\nI:H - The bogus scatterlist gives the block/SCSI target path an attacker-controlled ~4GB kernel memory write/read primitive over adjacent heap objects, exploitable for control-flow hijacking and privilege escalation.\nA:H - Out-of-bounds access from a ~4GB scatterlist on a kilobyte-scale receive buffer readily triggers kernel oops, KASAN faults, or panic, denying availability even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:46:39.840Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c82c860f8c8e4f4f454c9f14d0ad0c0466965f7d"
},
{
"url": "https://git.kernel.org/stable/c/3efa5301137140a3ca3677a9098c0a93a0acfd49"
},
{
"url": "https://git.kernel.org/stable/c/067b9556eeb007f28b7c2033b4dcde5b6d88418f"
},
{
"url": "https://git.kernel.org/stable/c/dcf7a986f377cce0749ed53f1d64195fbd5fdf91"
},
{
"url": "https://git.kernel.org/stable/c/07dec3f6dcb6c6cc891162d252b800eb0e6d5e8e"
},
{
"url": "https://git.kernel.org/stable/c/65572fbd86033ae2370125593d59b8be34253aaf"
},
{
"url": "https://git.kernel.org/stable/c/72497172a4799119a0282a5eb5e2b8ddcc821921"
},
{
"url": "https://git.kernel.org/stable/c/eb4ecdf631fe00e8020bf461503cb9b7017ed796"
}
],
"title": "RDMA/srpt: fix integer overflow in immediate data length check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74394",
"datePublished": "2026-08-15T05:59:07.144Z",
"dateReserved": "2026-08-15T05:44:03.891Z",
"dateUpdated": "2026-10-16T19:05:40.869Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68153 (GCVE-0-2026-68153)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: remove debugfs files before client teardown
ceph_destroy_client() tears down the monitor client before removing
the per-client debugfs files. A concurrent read of the monmap debugfs
file can enter monmap_show() after ceph_monc_stop() has freed
monc->monmap, triggering a use-after-free.
Remove the debugfs files before stopping the OSD and monitor clients.
debugfs_remove() drains active handlers and prevents new accesses, so
the debugfs callbacks can no longer race the rest of client teardown.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 76aa844d5b2fb8c839180d3f5874e333b297e5fd Version: 76aa844d5b2fb8c839180d3f5874e333b297e5fd Version: 76aa844d5b2fb8c839180d3f5874e333b297e5fd Version: 76aa844d5b2fb8c839180d3f5874e333b297e5fd Version: 76aa844d5b2fb8c839180d3f5874e333b297e5fd Version: 76aa844d5b2fb8c839180d3f5874e333b297e5fd Version: 76aa844d5b2fb8c839180d3f5874e333b297e5fd Version: 76aa844d5b2fb8c839180d3f5874e333b297e5fd |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68153",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:44:57.260747Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:54.326Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/ceph_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ac78549d186090ee7125d28c3a8c376573b36194",
"status": "affected",
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"versionType": "git"
},
{
"lessThan": "463a264e9094384112a5c8b46f0a9ddaf8566904",
"status": "affected",
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"versionType": "git"
},
{
"lessThan": "fe46b7e06f14f6f94766832df309b249cb689d27",
"status": "affected",
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"versionType": "git"
},
{
"lessThan": "fc1010e7e0204ece6cc0f9af4f473e9553535eab",
"status": "affected",
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"versionType": "git"
},
{
"lessThan": "d3dc8889d39a676bf840132bd5c5c48cb0daba23",
"status": "affected",
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"versionType": "git"
},
{
"lessThan": "8f5a3abc54ba24dbceb14cc3a719908c4f688091",
"status": "affected",
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"versionType": "git"
},
{
"lessThan": "b9fedda2f628e030384228de0dafc574b7fb0c2f",
"status": "affected",
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"versionType": "git"
},
{
"lessThan": "e4c804726c4afce3ba648b982d564f6af2cfa328",
"status": "affected",
"version": "76aa844d5b2fb8c839180d3f5874e333b297e5fd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/ceph_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: remove debugfs files before client teardown\n\nceph_destroy_client() tears down the monitor client before removing\nthe per-client debugfs files. A concurrent read of the monmap debugfs\nfile can enter monmap_show() after ceph_monc_stop() has freed\nmonc-\u003emonmap, triggering a use-after-free.\n\nRemove the debugfs files before stopping the OSD and monitor clients.\ndebugfs_remove() drains active handlers and prevents new accesses, so\nthe debugfs callbacks can no longer race the rest of client teardown."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local access to debugfs via read() on /sys/kernel/debug/ceph/client*/monmap concurrent with local ceph client teardown via umount or rbd unmap; the bug is not reachable through Ceph network protocol handlers.\nAC:L - The attacker controls both sides of the race by concurrently reading the monmap debugfs file while triggering ceph_destroy_client() via umount/rbd teardown, and can retry until the window between ceph_monc_stop() and debugfs removal is hit.\nPR:L - An unprivileged local user can use user-namespace capabilities (CAP_DAC_READ_SEARCH) to read root-owned debugfs files and race reads against libceph client teardown during automated volume detach or service restarts on Ceph storage nodes.\nUI:N - No victim user interaction is required; a local attacker can independently issue debugfs reads and trigger or time against client teardown without requiring another user to click, open files, or mount filesystems.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security domain and does not cross VM, container, or IOMMU boundaries; impact is standard kernel privilege escalation or crash.\nC:H - The use-after-free on monc-\u003emonmap permits reading freed heap memory containing monitor addresses and entity metadata, and UAF primitives are routinely leveraged for arbitrary kernel memory disclosure.\nI:H - Heap use-after-free on the variable-length ceph_monmap structure enables memory corruption that can be groomed into arbitrary kernel write primitives and local privilege escalation via control-flow hijacking.\nA:H - Concurrent access to freed monmap memory during debugfs iteration can cause kernel oops, BUG, or panic, and UAF corruption reliably threatens system availability even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:30:18.048Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ac78549d186090ee7125d28c3a8c376573b36194"
},
{
"url": "https://git.kernel.org/stable/c/463a264e9094384112a5c8b46f0a9ddaf8566904"
},
{
"url": "https://git.kernel.org/stable/c/fe46b7e06f14f6f94766832df309b249cb689d27"
},
{
"url": "https://git.kernel.org/stable/c/fc1010e7e0204ece6cc0f9af4f473e9553535eab"
},
{
"url": "https://git.kernel.org/stable/c/d3dc8889d39a676bf840132bd5c5c48cb0daba23"
},
{
"url": "https://git.kernel.org/stable/c/8f5a3abc54ba24dbceb14cc3a719908c4f688091"
},
{
"url": "https://git.kernel.org/stable/c/b9fedda2f628e030384228de0dafc574b7fb0c2f"
},
{
"url": "https://git.kernel.org/stable/c/e4c804726c4afce3ba648b982d564f6af2cfa328"
}
],
"title": "libceph: remove debugfs files before client teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68153",
"datePublished": "2026-08-10T11:59:19.302Z",
"dateReserved": "2026-07-30T09:28:09.371Z",
"dateUpdated": "2026-10-19T20:58:54.326Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72069 (GCVE-0-2026-72069)
Vulnerability from cvelistv5
Published
2026-08-15 05:52
Modified
2026-10-19 21:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
rt_spin_unlock() releases the RCU protection before unlocking the
lock. That opens the door for the following UAF scenario:
T1 T2
spin_lock(&p->lock); rcu_read_lock();
invalidate(p); p = rcu_dereference(ptr);
rcu_assign_pointer(ptr, NULL); if (!p) return;
spin_unlock(&p->lock); spin_lock(&p->lock)
lock(&lock->lock);
rcu_read_lock();
kfree_rcu(p); rcu_read_unlock();
....
spin_unlock(&p->lock)
rcu_read_unlock(); // Ends grace period
rcu_do_batch()
kfree(p);
UAF -> rt_mutex_cmpxchg_release(&lock->lock...)
Regular spinlocks keep preemption disabled accross the unlock operation,
which provides full RCU protection, but the RT substitution fails to
resemble that. Same applies for the rwlock substitution.
Move the rcu_read_unlock() invocation past the unlock operations to match
the non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but
that's harmless as the caller needs to hold RCU read lock across the lock
operation. The migrate_enable() call stays before the unlock operation
because there is no per CPU operation in the unlock path which would
require migration to be kept disabled.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 Version: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 Version: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 Version: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 Version: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 Version: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 Version: 0f383b6dc96e976dfbf2721b0bf10bd96103b341 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72069",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:51:20.973593Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:26.463Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/locking/spinlock_rt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af28d801cd2db4cc7378554499bd4a5d84a5517e",
"status": "affected",
"version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
"versionType": "git"
},
{
"lessThan": "9d1fcd64ab81200e02b7a6db5eb1da8e244e8289",
"status": "affected",
"version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
"versionType": "git"
},
{
"lessThan": "3cfaac77b3c32ac3940df28866de263c3f45d24c",
"status": "affected",
"version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
"versionType": "git"
},
{
"lessThan": "1f0d56d3f1e88f20f6e46109402f8c15d59bac37",
"status": "affected",
"version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
"versionType": "git"
},
{
"lessThan": "633cadbc0b8323f5cc140a285d2432089dbb534e",
"status": "affected",
"version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
"versionType": "git"
},
{
"lessThan": "83f9fb561c1c3917e19f95523dd933c7d30291aa",
"status": "affected",
"version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
"versionType": "git"
},
{
"lessThan": "89038cc87d80c77e7aa6f42a64b2573b74af339f",
"status": "affected",
"version": "0f383b6dc96e976dfbf2721b0bf10bd96103b341",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/locking/spinlock_rt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/rt: Fix the incorrect RCU protection in rt_spin_unlock()\n\nrt_spin_unlock() releases the RCU protection before unlocking the\nlock. That opens the door for the following UAF scenario:\n\n T1\t\t\t\t\tT2\n spin_lock(\u0026p-\u003elock);\t\trcu_read_lock();\n invalidate(p);\t\t\tp = rcu_dereference(ptr);\n rcu_assign_pointer(ptr, NULL);\tif (!p) return;\n spin_unlock(\u0026p-\u003elock);\t\tspin_lock(\u0026p-\u003elock)\n \t\t\t\t lock(\u0026lock-\u003elock);\n\t\t\t\t rcu_read_lock();\n kfree_rcu(p);\t\t\trcu_read_unlock();\n\t\t\t\t....\n\t\t\t\tspin_unlock(\u0026p-\u003elock)\n\t\t\t\t rcu_read_unlock(); // Ends grace period\n rcu_do_batch()\n kfree(p);\n\t\t\t UAF -\u003e\t rt_mutex_cmpxchg_release(\u0026lock-\u003elock...)\n\nRegular spinlocks keep preemption disabled accross the unlock operation,\nwhich provides full RCU protection, but the RT substitution fails to\nresemble that. Same applies for the rwlock substitution.\n\nMove the rcu_read_unlock() invocation past the unlock operations to match\nthe non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but\nthat\u0027s harmless as the caller needs to hold RCU read lock across the lock\noperation. The migrate_enable() call stays before the unlock operation\nbecause there is no per CPU operation in the unlock path which would\nrequire migration to be kept disabled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On CONFIG_PREEMPT_RT, every spin_unlock() is substituted by rt_spin_unlock(); network subsystems such as netfilter xt_hashlimit process inbound packets through hashlimit_mt_common(), spin_lock/unlock on RCU-protected dsthash_ent objects concurrently freed via call_rcu by GC\u2014the exact embedded-spinlock UAF pattern from the fix.\nAC:L - The bug is a cross-CPU race where rt_spin_unlock() calls rcu_read_unlock() before releasing the rtmutex, ending the RCU grace period while still dereferencing the lock; syzbot triggered this reliably on PREEMPT_RT via concurrent unlinkat and dentry teardown, and attackers control both sides with parallel syscalls or packet/GC load.\nPR:N - Remote attackers need no account, capability, or authentication to send packets that hit deployed hashlimit rules on internet-facing PREEMPT_RT gateways; the proven syzbot unlinkat path needs only directory write permission (PR:L), but PR:N reflects the highest-severity unauthenticated network packet scenario.\nUI:N - No victim interaction is required; the attacker drives the race through their own concurrent filesystem syscalls (syzbot: unlinkat racing __fput/dentry_kill) or sustained inbound traffic overlapping netfilter GC, without needing another user to open files or mount filesystems.\nS:U - The UAF corrupts kernel slab memory containing embedded spinlock/rtmutex fields and enables privilege escalation within the same kernel security authority; it does not inherently cross VM/guest, container sandbox, or IOMMU hardware isolation boundaries.\nC:H - Syzbot reported KASAN slab-use-after-free Read in rt_mutex_slowunlock during spin_unlock on a freed dentry in shrink_dcache_tree; the systemic UAF lets attackers read freed objects (dentry, dsthash_ent, etc.) after premature RCU grace-period completion, enabling kernel pointer and memory disclosure.\nI:H - UAF on embedded rtmutex fields inside freed slab objects (dentry-\u003ed_lock per syzbot) permits heap grooming and reallocation of attacker-controlled data, providing standard kernel heap corruption primitives for arbitrary write and control-flow hijack beyond the immediate crash.\nA:H - Syzbot hit KASAN slab-use-after-free causing kernel fault in shrink_dcache_tree via rt_spin_unlock on PREEMPT_RT; the bug can oops/panic any RT kernel whenever spin_unlock races RCU-deferred free of the containing object, enabling repeatable denial of service via concurrent VFS or netfilter operations."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:41.836Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af28d801cd2db4cc7378554499bd4a5d84a5517e"
},
{
"url": "https://git.kernel.org/stable/c/9d1fcd64ab81200e02b7a6db5eb1da8e244e8289"
},
{
"url": "https://git.kernel.org/stable/c/3cfaac77b3c32ac3940df28866de263c3f45d24c"
},
{
"url": "https://git.kernel.org/stable/c/1f0d56d3f1e88f20f6e46109402f8c15d59bac37"
},
{
"url": "https://git.kernel.org/stable/c/633cadbc0b8323f5cc140a285d2432089dbb534e"
},
{
"url": "https://git.kernel.org/stable/c/83f9fb561c1c3917e19f95523dd933c7d30291aa"
},
{
"url": "https://git.kernel.org/stable/c/89038cc87d80c77e7aa6f42a64b2573b74af339f"
}
],
"title": "locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72069",
"datePublished": "2026-08-15T05:52:21.752Z",
"dateReserved": "2026-08-09T03:40:39.903Z",
"dateUpdated": "2026-10-19T21:19:26.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72421 (GCVE-0-2026-72421)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: fib: Don't ignore error route in local/main tables.
When CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added,
fib_lookup() performs route lookup directly on two tables.
Since the first lookup does not properly bail out, the result
of an error route in the merged local/main table could be
overwritten by another route in the default table:
# unshare -n
# ip link set lo up
# ip route add 192.168.0.0/24 dev lo table 253
# ip route add unreachable 192.168.0.0/24
# ip route get 192.168.0.1
192.168.0.1 dev lo table default uid 0
cache <local>
Once a random rule is added, the error route is respected:
# ip rule add table 0
# ip rule del table 0
# ip route get 192.168.0.1
RTNETLINK answers: No route to host
Let's fix the inconsistent behaviour.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f4530fa574df4d833506c53697ed1daa0d390bf4 Version: f4530fa574df4d833506c53697ed1daa0d390bf4 Version: f4530fa574df4d833506c53697ed1daa0d390bf4 Version: f4530fa574df4d833506c53697ed1daa0d390bf4 Version: f4530fa574df4d833506c53697ed1daa0d390bf4 Version: f4530fa574df4d833506c53697ed1daa0d390bf4 Version: f4530fa574df4d833506c53697ed1daa0d390bf4 Version: f4530fa574df4d833506c53697ed1daa0d390bf4 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72421",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:49:34.990573Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:23.102Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/ip_fib.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a29e95fbc51e8a1b932773fd0e259b2080881443",
"status": "affected",
"version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
"versionType": "git"
},
{
"lessThan": "5ae18d87a45698e8244d0fcba64c658c35a7dd3d",
"status": "affected",
"version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
"versionType": "git"
},
{
"lessThan": "9127589aabdee588278e8d0d0bd3709a760a92c8",
"status": "affected",
"version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
"versionType": "git"
},
{
"lessThan": "49eaf1403201357762d745a35882fb734107d763",
"status": "affected",
"version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
"versionType": "git"
},
{
"lessThan": "fd25996f57a95d56bc568c89b4921edcf334b7d8",
"status": "affected",
"version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
"versionType": "git"
},
{
"lessThan": "828fad4fd418bcdb9f5d66fec0d184c52a85ec31",
"status": "affected",
"version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
"versionType": "git"
},
{
"lessThan": "a668fa160247d7bbe921548cb845f607b8b9305f",
"status": "affected",
"version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
"versionType": "git"
},
{
"lessThan": "b72f0db64205d9ce462038ba995d5d31eff32dc1",
"status": "affected",
"version": "f4530fa574df4d833506c53697ed1daa0d390bf4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/ip_fib.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: Don\u0027t ignore error route in local/main tables.\n\nWhen CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added,\nfib_lookup() performs route lookup directly on two tables.\n\nSince the first lookup does not properly bail out, the result\nof an error route in the merged local/main table could be\noverwritten by another route in the default table:\n\n # unshare -n\n # ip link set lo up\n # ip route add 192.168.0.0/24 dev lo table 253\n # ip route add unreachable 192.168.0.0/24\n # ip route get 192.168.0.1\n 192.168.0.1 dev lo table default uid 0\n cache \u003clocal\u003e\n\nOnce a random rule is added, the error route is respected:\n\n # ip rule add table 0\n # ip rule del table 0\n # ip route get 192.168.0.1\n RTNETLINK answers: No route to host\n\nLet\u0027s fix the inconsistent behaviour."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - fib_lookup() is on the IPv4 receive and transmit datapaths (ip_route_input_rcu, ip_route_output_key, forwarding) reached by remote packets on internet-facing routers, gateways, cloud hosts, and container nodes without any local syscall.\nAC:L - Once main/local holds an error route and default has an overlapping prefix (reproduced in the fix commit with basic ip-route commands), any matching packet or socket lookup deterministically hits the bypass; no race or attacker-independent memory layout is required.\nPR:N - Overlapping table layout is a deployment/CAP_NET_ADMIN prerequisite, but exploitation only requires sending traffic or using sockets; the remote attacker needs no credentials or privileges on the victim once the vulnerable routing state exists.\nUI:N - Route resolution runs automatically in the kernel networking stack during normal packet forwarding and connection setup; no victim mount, click, or file open is needed beyond ordinary network use.\nS:C - Bypassing unreachable/prohibit/blackhole routes can defeat network-namespace/pod egress blackholes and segmentation boundaries on multi-tenant hosts and routers, allowing access outside the intended isolated security scope.\nC:H - Ignored error routes let traffic reach destinations deliberately isolated (internal networks, metadata endpoints, sinkholed ranges), exposing data that routing policy was designed to keep inaccessible.\nI:H - Packets that should be dropped or rejected are instead forwarded via the default-table route, enabling injection of traffic into networks marked unreachable, prohibited, or blackhole.\nA:N - The defect is incorrect route selection only; it does not corrupt memory, panic the kernel, deadlock, or inherently exhaust resources, so availability impact is none."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:44:01.658Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a29e95fbc51e8a1b932773fd0e259b2080881443"
},
{
"url": "https://git.kernel.org/stable/c/5ae18d87a45698e8244d0fcba64c658c35a7dd3d"
},
{
"url": "https://git.kernel.org/stable/c/9127589aabdee588278e8d0d0bd3709a760a92c8"
},
{
"url": "https://git.kernel.org/stable/c/49eaf1403201357762d745a35882fb734107d763"
},
{
"url": "https://git.kernel.org/stable/c/fd25996f57a95d56bc568c89b4921edcf334b7d8"
},
{
"url": "https://git.kernel.org/stable/c/828fad4fd418bcdb9f5d66fec0d184c52a85ec31"
},
{
"url": "https://git.kernel.org/stable/c/a668fa160247d7bbe921548cb845f607b8b9305f"
},
{
"url": "https://git.kernel.org/stable/c/b72f0db64205d9ce462038ba995d5d31eff32dc1"
}
],
"title": "ipv4: fib: Don\u0027t ignore error route in local/main tables.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72421",
"datePublished": "2026-08-15T05:56:40.466Z",
"dateReserved": "2026-08-09T03:40:39.927Z",
"dateUpdated": "2026-10-16T18:55:23.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74261 (GCVE-0-2026-74261)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: avoid stale FIFO cells during resize
snd_seq_fifo_resize() still needs to publish the replacement pool
before it waits for FIFO users. A blocking snd_seq_read() holds
f->use_lock while it sleeps, so concurrent senders must be able to
queue to the new pool and wake that reader instead of failing against a
closing old pool.
However, snd_seq_fifo_event_in() duplicates an event before it takes
f->lock, and snd_seq_read() can dequeue a cell and later call
snd_seq_fifo_cell_putback() if copy_to_user() or
snd_seq_expand_var_event() fails. If resize swaps f->pool and detaches
oldhead in between, either path can relink an old-pool cell after the
snapshot. That stale cell sits outside the drained oldhead list, keeps
oldpool->counter elevated, and can leave snd_seq_pool_delete() waiting
for the retired pool to drain.
Keep the existing swap-before-wait ordering in snd_seq_fifo_resize(),
but reject stale cells before any FIFO relink. Revalidate event-in cells
under f->lock and retry them against the published replacement pool, and
free stale putback cells instead of linking them back into the FIFO.
The buggy scenario involves two paths, with each column showing the
order within that path:
resize path: relink path:
1. Allocate newpool. 1. Take f->use_lock.
2. Swap f->pool to newpool and 2. Duplicate or dequeue an old-pool
detach oldhead. cell before oldpool closes.
3. Mark oldpool closing and 3. Reach a later relink point after
wait for FIFO users. resize published newpool.
4. Free oldhead and delete 4. Relink the old-pool cell after
oldpool. resize detached oldhead.
5. Drop f->use_lock.
The reproducer reports a resize ioctl blocked in the expected pool
teardown path:
signal: resize iteration=98 target_pool=4 exceeded 250ms
(elapsed=251ms)
diagnostic: resize_tid=651 wchan=snd_seq_pool_done
diagnostic: resize_tid=651 stack=
snd_seq_pool_done+0x5b/0x140
snd_seq_pool_delete+0x7a/0x90
snd_seq_fifo_resize+0x193/0x1e0
snd_seq_ioctl_set_client_pool+0x214/0x260
snd_seq_ioctl+0x119/0x540
__x64_sys_ioctl+0xd1/0x120
do_syscall_64+0xbb/0x2f0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
A second run with larger pools hit the same target path:
signal: resize iteration=32 target_pool=64 exceeded 250ms
(elapsed=251ms)
diagnostic: resize_tid=663 wchan=snd_seq_pool_done
diagnostic: resize_tid=663 stack=
snd_seq_pool_done+0x5b/0x140
snd_seq_pool_delete+0x7a/0x90
snd_seq_fifo_resize+0x193/0x1e0
snd_seq_ioctl_set_client_pool+0x214/0x260
snd_seq_ioctl+0x119/0x540
__x64_sys_ioctl+0xd1/0x120
do_syscall_64+0xbb/0x2f0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2d7d54002e396c180db0c800c1046f0a3c471597 Version: 2d7d54002e396c180db0c800c1046f0a3c471597 Version: 2d7d54002e396c180db0c800c1046f0a3c471597 Version: 2d7d54002e396c180db0c800c1046f0a3c471597 Version: 2d7d54002e396c180db0c800c1046f0a3c471597 Version: df7a2d0af9f7ab73cf22a7b62bbc0bad93a02110 Version: 28e0ebdd57cd3287ac821068364b74c70af3861c Version: d4b8e8a32d74052fe292618ae19f794944ddc673 Version: e91325f27c4d98d1088e9e86b3ab475f752eeb80 Version: 9ebfed203c0d93449a074c5c2fd5bb3e58518f0d Version: 3492352e1f34673708fa7409b4b1d97545aa2f1c Version: a90d7447e4a154ad26e3b9e09a0878680be49339 Version: 74a2c1ff88a4e0960623d17f7db56ac5a60bb0cf Version: c36ef6467420f8982e6d4d6f93d0634a85a5ee45 Version: 3.2.91 ≤ Version: 3.10.107 ≤ Version: 3.12.73 ≤ Version: 3.16.46 ≤ Version: 3.18.50 ≤ Version: 4.1.40 ≤ Version: 4.4.60 ≤ Version: 4.9.21 ≤ Version: 4.10.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/seq/seq_fifo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae429220c7f9747579bc4682c574585230e971cc",
"status": "affected",
"version": "2d7d54002e396c180db0c800c1046f0a3c471597",
"versionType": "git"
},
{
"lessThan": "dcf784abee6df2f5c47e36a1d9e400065993bc04",
"status": "affected",
"version": "2d7d54002e396c180db0c800c1046f0a3c471597",
"versionType": "git"
},
{
"lessThan": "98a965cb1e767b54b6bbd831b6cea26f521a8f51",
"status": "affected",
"version": "2d7d54002e396c180db0c800c1046f0a3c471597",
"versionType": "git"
},
{
"lessThan": "1c4c35fb68d520241f7d9f1c356b5e2370fd8364",
"status": "affected",
"version": "2d7d54002e396c180db0c800c1046f0a3c471597",
"versionType": "git"
},
{
"lessThan": "e546128291f8d688dcb931827e2efd2aa6c0734d",
"status": "affected",
"version": "2d7d54002e396c180db0c800c1046f0a3c471597",
"versionType": "git"
},
{
"status": "affected",
"version": "df7a2d0af9f7ab73cf22a7b62bbc0bad93a02110",
"versionType": "git"
},
{
"status": "affected",
"version": "28e0ebdd57cd3287ac821068364b74c70af3861c",
"versionType": "git"
},
{
"status": "affected",
"version": "d4b8e8a32d74052fe292618ae19f794944ddc673",
"versionType": "git"
},
{
"status": "affected",
"version": "e91325f27c4d98d1088e9e86b3ab475f752eeb80",
"versionType": "git"
},
{
"status": "affected",
"version": "9ebfed203c0d93449a074c5c2fd5bb3e58518f0d",
"versionType": "git"
},
{
"status": "affected",
"version": "3492352e1f34673708fa7409b4b1d97545aa2f1c",
"versionType": "git"
},
{
"status": "affected",
"version": "a90d7447e4a154ad26e3b9e09a0878680be49339",
"versionType": "git"
},
{
"status": "affected",
"version": "74a2c1ff88a4e0960623d17f7db56ac5a60bb0cf",
"versionType": "git"
},
{
"status": "affected",
"version": "c36ef6467420f8982e6d4d6f93d0634a85a5ee45",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.91",
"versionType": "semver"
},
{
"lessThan": "3.11",
"status": "affected",
"version": "3.10.107",
"versionType": "semver"
},
{
"lessThan": "3.13",
"status": "affected",
"version": "3.12.73",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.46",
"versionType": "semver"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.50",
"versionType": "semver"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.40",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.60",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.21",
"versionType": "semver"
},
{
"lessThan": "4.11",
"status": "affected",
"version": "4.10.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/seq/seq_fifo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.107",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.12.73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.10.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: avoid stale FIFO cells during resize\n\nsnd_seq_fifo_resize() still needs to publish the replacement pool\nbefore it waits for FIFO users. A blocking snd_seq_read() holds\nf-\u003euse_lock while it sleeps, so concurrent senders must be able to\nqueue to the new pool and wake that reader instead of failing against a\nclosing old pool.\n\nHowever, snd_seq_fifo_event_in() duplicates an event before it takes\nf-\u003elock, and snd_seq_read() can dequeue a cell and later call\nsnd_seq_fifo_cell_putback() if copy_to_user() or\nsnd_seq_expand_var_event() fails. If resize swaps f-\u003epool and detaches\noldhead in between, either path can relink an old-pool cell after the\nsnapshot. That stale cell sits outside the drained oldhead list, keeps\noldpool-\u003ecounter elevated, and can leave snd_seq_pool_delete() waiting\nfor the retired pool to drain.\n\nKeep the existing swap-before-wait ordering in snd_seq_fifo_resize(),\nbut reject stale cells before any FIFO relink. Revalidate event-in cells\nunder f-\u003elock and retry them against the published replacement pool, and\nfree stale putback cells instead of linking them back into the FIFO.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nresize path: relink path:\n1. Allocate newpool. 1. Take f-\u003euse_lock.\n2. Swap f-\u003epool to newpool and 2. Duplicate or dequeue an old-pool\n detach oldhead. cell before oldpool closes.\n3. Mark oldpool closing and 3. Reach a later relink point after\n wait for FIFO users. resize published newpool.\n4. Free oldhead and delete 4. Relink the old-pool cell after\n oldpool. resize detached oldhead.\n 5. Drop f-\u003euse_lock.\n\nThe reproducer reports a resize ioctl blocked in the expected pool\nteardown path:\n\nsignal: resize iteration=98 target_pool=4 exceeded 250ms\n (elapsed=251ms)\ndiagnostic: resize_tid=651 wchan=snd_seq_pool_done\ndiagnostic: resize_tid=651 stack=\n snd_seq_pool_done+0x5b/0x140\n snd_seq_pool_delete+0x7a/0x90\n snd_seq_fifo_resize+0x193/0x1e0\n snd_seq_ioctl_set_client_pool+0x214/0x260\n snd_seq_ioctl+0x119/0x540\n __x64_sys_ioctl+0xd1/0x120\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nA second run with larger pools hit the same target path:\n\nsignal: resize iteration=32 target_pool=64 exceeded 250ms\n (elapsed=251ms)\ndiagnostic: resize_tid=663 wchan=snd_seq_pool_done\ndiagnostic: resize_tid=663 stack=\n snd_seq_pool_done+0x5b/0x140\n snd_seq_pool_delete+0x7a/0x90\n snd_seq_fifo_resize+0x193/0x1e0\n snd_seq_ioctl_set_client_pool+0x214/0x260\n snd_seq_ioctl+0x119/0x540\n __x64_sys_ioctl+0xd1/0x120\n do_syscall_64+0xbb/0x2f0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:10.790Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae429220c7f9747579bc4682c574585230e971cc"
},
{
"url": "https://git.kernel.org/stable/c/dcf784abee6df2f5c47e36a1d9e400065993bc04"
},
{
"url": "https://git.kernel.org/stable/c/98a965cb1e767b54b6bbd831b6cea26f521a8f51"
},
{
"url": "https://git.kernel.org/stable/c/1c4c35fb68d520241f7d9f1c356b5e2370fd8364"
},
{
"url": "https://git.kernel.org/stable/c/e546128291f8d688dcb931827e2efd2aa6c0734d"
}
],
"title": "ALSA: seq: avoid stale FIFO cells during resize",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74261",
"datePublished": "2026-08-15T05:57:38.311Z",
"dateReserved": "2026-08-15T05:44:03.877Z",
"dateUpdated": "2026-10-21T12:45:10.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74388 (GCVE-0-2026-74388)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data
The OSS sequencer processes the input MIDI bytes into a sequencer
event to be dispatched later (in snd_seq_oss_midi_putc() called from
snd_seq_oss_process_event()). When it's a SysEx data, the event
record contains data.ext.ptr pointer to the original SysEx bytes, and
the referred data is copied into the pool afterwards at dispatching.
The problem is that, if the sequencer port gets closed concurrently
before the dispatch, the OSS sequencer core also releases the
resources (in snd_seq_oss_midi_check_exit_port()), while the pending
event may hold a stale pointer, eventually leading to a UAF at a later
dispatch.
Fortunately, there is already a refcounting mechanism (snd_use_lock_t)
for the OSS MIDI device access, and for addressing the issue above, we
just need to extend the refcount until the event gets dispatched.
This patch extends snd_seq_oss_process_event() to give back the
refcount object, which is in turn released after calling the sequencer
dispatcher with the given event in the caller side.
According to the original report, KASAN report as below:
KASAN slab-use-after-free in snd_seq_event_dup+0x40c/0x470
RIP: 0033:0x7f2cb66a6340
Read of size 6
Call trace:
dump_stack_lvl+0x73/0xb0 (?:?)
print_report+0xd1/0x650 (?:?)
srso_alias_return_thunk+0x5/0xfbef5 (?:?)
__virt_addr_valid+0x1a7/0x340 (?:?)
kasan_complete_mode_report_info+0x64/0x200 (?:?)
kasan_report+0xf7/0x130 (?:?)
snd_seq_event_dup+0x40c/0x470 (?:?)
kasan_check_range+0x10c/0x1c0 (?:?)
__asan_memcpy+0x27/0x70 (?:?)
snd_seq_event_dup+0x9/0x470 (?:?)
snd_seq_client_enqueue_event+0x139/0x240 (?:?)
_raw_spin_unlock_irqrestore+0x4b/0x60 (?:?)
snd_seq_kernel_client_enqueue+0x102/0x120 (?:?)
snd_seq_oss_write+0x416/0x4e0 (?:?)
apparmor_file_permission+0x20/0x30 (?:?)
odev_write+0x3b/0x60 (?:?)
vfs_write+0x1ce/0x850 (?:?)
lock_release+0xc8/0x2a0 (?:?)
__kasan_check_write+0x18/0x20 (?:?)
__mutex_unlock_slowpath+0x129/0x510 (?:?)
ksys_write+0xe1/0x180 (?:?)
mutex_unlock+0x16/0x20 (?:?)
odev_ioctl+0x65/0xc0 (?:?)
__x64_sys_write+0x46/0x60 (?:?)
x64_sys_call+0x7d/0x20d0 (?:?)
do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74388",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:55:11.498813Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:40.548Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/seq/oss/seq_oss_event.c",
"sound/core/seq/oss/seq_oss_event.h",
"sound/core/seq/oss/seq_oss_ioctl.c",
"sound/core/seq/oss/seq_oss_midi.c",
"sound/core/seq/oss/seq_oss_midi.h",
"sound/core/seq/oss/seq_oss_rw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bc963e193b314f1441082e8b1ffe15eb255d0a44",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e96824274239ae4cd2f7b712644441cdc72c81a3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6dc781778b595be94c31395b2cb167f65145d91f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7aad70cabd8f34cf11a9593fcd3f2ac3f5496943",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7c349b4f2a603202fb8c363bd2774a22ac2fddf3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/seq/oss/seq_oss_event.c",
"sound/core/seq/oss/seq_oss_event.h",
"sound/core/seq/oss/seq_oss_ioctl.c",
"sound/core/seq/oss/seq_oss_midi.c",
"sound/core/seq/oss/seq_oss_midi.h",
"sound/core/seq/oss/seq_oss_rw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: oss: Fix UAF at handling events with embedded SysEx data\n\nThe OSS sequencer processes the input MIDI bytes into a sequencer\nevent to be dispatched later (in snd_seq_oss_midi_putc() called from\nsnd_seq_oss_process_event()). When it\u0027s a SysEx data, the event\nrecord contains data.ext.ptr pointer to the original SysEx bytes, and\nthe referred data is copied into the pool afterwards at dispatching.\nThe problem is that, if the sequencer port gets closed concurrently\nbefore the dispatch, the OSS sequencer core also releases the\nresources (in snd_seq_oss_midi_check_exit_port()), while the pending\nevent may hold a stale pointer, eventually leading to a UAF at a later\ndispatch.\n\nFortunately, there is already a refcounting mechanism (snd_use_lock_t)\nfor the OSS MIDI device access, and for addressing the issue above, we\njust need to extend the refcount until the event gets dispatched.\n\nThis patch extends snd_seq_oss_process_event() to give back the\nrefcount object, which is in turn released after calling the sequencer\ndispatcher with the given event in the caller side.\n\nAccording to the original report, KASAN report as below:\n\nKASAN slab-use-after-free in snd_seq_event_dup+0x40c/0x470\nRIP: 0033:0x7f2cb66a6340\nRead of size 6\nCall trace:\n dump_stack_lvl+0x73/0xb0 (?:?)\n print_report+0xd1/0x650 (?:?)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n __virt_addr_valid+0x1a7/0x340 (?:?)\n kasan_complete_mode_report_info+0x64/0x200 (?:?)\n kasan_report+0xf7/0x130 (?:?)\n snd_seq_event_dup+0x40c/0x470 (?:?)\n kasan_check_range+0x10c/0x1c0 (?:?)\n __asan_memcpy+0x27/0x70 (?:?)\n snd_seq_event_dup+0x9/0x470 (?:?)\n snd_seq_client_enqueue_event+0x139/0x240 (?:?)\n _raw_spin_unlock_irqrestore+0x4b/0x60 (?:?)\n snd_seq_kernel_client_enqueue+0x102/0x120 (?:?)\n snd_seq_oss_write+0x416/0x4e0 (?:?)\n apparmor_file_permission+0x20/0x30 (?:?)\n odev_write+0x3b/0x60 (?:?)\n vfs_write+0x1ce/0x850 (?:?)\n lock_release+0xc8/0x2a0 (?:?)\n __kasan_check_write+0x18/0x20 (?:?)\n __mutex_unlock_slowpath+0x129/0x510 (?:?)\n ksys_write+0xe1/0x180 (?:?)\n mutex_unlock+0x16/0x20 (?:?)\n odev_ioctl+0x65/0xc0 (?:?)\n __x64_sys_write+0x46/0x60 (?:?)\n x64_sys_call+0x7d/0x20d0 (?:?)\n do_syscall_64+0xc1/0x360 (arch/x86/entry/syscall_64.c:87)\n entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached only via local OSS sequencer character devices (/dev/sequencer, /dev/music) through write(2) or SNDCTL_SEQ_OUTOFBAND ioctl into snd_seq_oss_write(); there is no network, Bluetooth, or physical-device input path to this OSS sequencer code.\nAC:L - The attacker controls both sides of the race: one thread streams SysEx MIDI bytes (SEQ_MIDIPUTC) while another concurrently deletes the backing ALSA sequencer port via /dev/snd/seq or triggers PORT_EXIT teardown, and the window is freely repeatable.\nPR:L - Exploitation requires only a local unprivileged account with access to OSS sequencer and ALSA sequencer device nodes, routinely granted via the audio group or seat ACLs on desktop, studio, and kiosk systems; no capability or init-namespace root is checked on this path.\nUI:N - The attacker\u0027s own process(es) perform the SysEx write and concurrent port-close/delete sequence; no separate victim action such as opening files, mounting filesystems, or plugging in hardware is required beyond the attacker\u0027s own device access.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority, enabling local privilege escalation or denial of service, but does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - This is a slab use-after-free where snd_seq_event_dup() memcpy-reads from a freed MIDI coder buffer (KASAN: read of size 6); UAF on kernel heap objects enables controlled reuse and arbitrary kernel memory disclosure via heap grooming.\nI:H - Freed seq_oss_midi/coder objects can be reallocated and corrupted through continued SysEx traffic, providing standard kernel heap overwrite primitives that can be leveraged for arbitrary write and local privilege escalation.\nA:H - The UAF is observed as a KASAN slab-use-after-free during event enqueue and reliably causes kernel oops or panic on the vulnerable path; even without full exploitation, triggering the bug causes high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:36.081Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bc963e193b314f1441082e8b1ffe15eb255d0a44"
},
{
"url": "https://git.kernel.org/stable/c/e96824274239ae4cd2f7b712644441cdc72c81a3"
},
{
"url": "https://git.kernel.org/stable/c/6dc781778b595be94c31395b2cb167f65145d91f"
},
{
"url": "https://git.kernel.org/stable/c/7aad70cabd8f34cf11a9593fcd3f2ac3f5496943"
},
{
"url": "https://git.kernel.org/stable/c/7c349b4f2a603202fb8c363bd2774a22ac2fddf3"
}
],
"title": "ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74388",
"datePublished": "2026-08-15T05:59:03.147Z",
"dateReserved": "2026-08-15T05:44:03.891Z",
"dateUpdated": "2026-10-21T12:45:36.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74695 (GCVE-0-2026-74695)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-10-21 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
Incoming skbs passing through netfilter flowtable offload hooks (or XFRM
offload path) might already carry a ref-counted dst_entry assigned during
earlier RX or routing steps.
Calling skb_dst_set_noref() when skb already holds a ref-counted dst
overwrites skb->_skb_refdst, leaking the previous dst_entry reference
count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in
skb_dst_check_unset():
WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170
WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234
WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864
Drop any existing dst_entry reference with skb_dst_drop(skb) before
setting the non-referenced flowtable destination.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 Version: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 Version: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 Version: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 Version: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 Version: b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27 Version: 209dedf806d31095968f54323dbe62525b077b33 Version: 4.16.15 ≤ Version: 4.17.1 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74695",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:14:42.839344Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:09.664Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_ip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4db3b48a966ed479b99cc8319ea9e46d4f7c703b",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "274f544a32c08638ee887f2e27e3235b6b1237d4",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "12afa450a6a6c0cce2c42b7545a9958f62d8a00c",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "538e67e8c7889cf5f93951f5309d1bcb41f86036",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "8aecf0bbcc72605592134c917c222207d8f63ab0",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"status": "affected",
"version": "b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27",
"versionType": "git"
},
{
"status": "affected",
"version": "209dedf806d31095968f54323dbe62525b077b33",
"versionType": "git"
},
{
"lessThan": "4.17",
"status": "affected",
"version": "4.16.15",
"versionType": "semver"
},
{
"lessThan": "4.18",
"status": "affected",
"version": "4.17.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_ip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.16.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()\n\nIncoming skbs passing through netfilter flowtable offload hooks (or XFRM\noffload path) might already carry a ref-counted dst_entry assigned during\nearlier RX or routing steps.\n\nCalling skb_dst_set_noref() when skb already holds a ref-counted dst\noverwrites skb-\u003e_skb_refdst, leaking the previous dst_entry reference\ncount and triggering a DEBUG_NET_WARN_ON_ONCE assertion in\nskb_dst_check_unset():\n\n WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170\n WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234\n WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864\n\nDrop any existing dst_entry reference with skb_dst_drop(skb) before\nsetting the non-referenced flowtable destination."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug fires in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS when remotely sourced IPv4/IPv6 packets matching an offloaded flow are received on nftables flowtable-bound interfaces, not via netlink configuration APIs.\nAC:L - Once a flowtable ingress hook and offloaded TCP/UDP flow exist, an attacker can reliably send matching traffic that reaches FLOW_OFFLOAD_XMIT_NEIGH or the XFRM offload path with a ref-counted skb dst; syzbot reproduced this without uncontrollable races.\nPR:N - Exploitation requires only sending network traffic through an already deployed nftables flow-offload path on an ingress device; no local account, authentication, or CAP_NET_ADMIN on the victim is needed to trigger the leak.\nUI:N - No victim interaction is required beyond normal network delivery; packets are processed automatically in softirq on the netdev ingress netfilter hook without opening files or mounting filesystems.\nS:U - Impact is confined to kernel refcount imbalance and availability degradation on the affected host; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:N - The flaw leaks a dst_entry reference by overwriting skb-\u003e_skb_refdst without releasing the prior dst; it does not expose kernel memory or provide an arbitrary read primitive.\nI:N - No unauthorized data modification occurs; the skb is forwarded using the intended flowtable destination while the previous dst reference is orphaned, not corrupted into a controllable write primitive.\nA:H - Each matching packet leaks a dst_entry refcount on the flowtable fast path, enabling sustained unauthenticated remote memory exhaustion on high-volume routers; CONFIG_DEBUG_NET builds also emit WARN_ON_ONCE during the overwrite."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:46:10.628Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4db3b48a966ed479b99cc8319ea9e46d4f7c703b"
},
{
"url": "https://git.kernel.org/stable/c/274f544a32c08638ee887f2e27e3235b6b1237d4"
},
{
"url": "https://git.kernel.org/stable/c/12afa450a6a6c0cce2c42b7545a9958f62d8a00c"
},
{
"url": "https://git.kernel.org/stable/c/538e67e8c7889cf5f93951f5309d1bcb41f86036"
},
{
"url": "https://git.kernel.org/stable/c/8aecf0bbcc72605592134c917c222207d8f63ab0"
}
],
"title": "netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74695",
"datePublished": "2026-08-22T15:32:57.756Z",
"dateReserved": "2026-08-15T05:44:03.926Z",
"dateUpdated": "2026-10-21T12:46:10.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64010 (GCVE-0-2026-64010)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-08-05 12:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
A race condition exists in the NFC LLCP connection state machine where
the connection acceptance packet (CC) can be processed concurrently with
socket release. This can lead to a use-after-free of the socket object.
When nfc_llcp_recv_cc() moves the socket from the connecting_sockets
list to the sockets list, it does so without holding the socket lock.
If llcp_sock_release() is executing concurrently, it might have already
unlinked the socket and dropped its references, which can result in
nfc_llcp_recv_cc() linking a freed socket into the live list.
Fix this by holding lock_sock() during the state transition and list
movement in nfc_llcp_recv_cc(). After acquiring the lock, check if
the socket is still hashed to ensure it hasn't already been unlinked
and marked for destruction by the release path. This aligns the locking
pattern with recv_hdlc() and recv_disc().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a69f32af86e389dd232b1bb2269e202c1bfcc60f Version: a69f32af86e389dd232b1bb2269e202c1bfcc60f Version: a69f32af86e389dd232b1bb2269e202c1bfcc60f Version: a69f32af86e389dd232b1bb2269e202c1bfcc60f Version: a69f32af86e389dd232b1bb2269e202c1bfcc60f Version: a69f32af86e389dd232b1bb2269e202c1bfcc60f Version: a69f32af86e389dd232b1bb2269e202c1bfcc60f Version: a69f32af86e389dd232b1bb2269e202c1bfcc60f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/nfc/llcp_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dce85215a6c7b0fd753f577a4c487f647119884c",
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"versionType": "git"
},
{
"lessThan": "bd08bb7443c501d2f2a71d529e4afcf11c9b07d2",
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"versionType": "git"
},
{
"lessThan": "0b45c31746e1523d5d482fda8fcf54a35ac417f1",
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"versionType": "git"
},
{
"lessThan": "ee2d1a8a1833c5e56e9a1745e64b0b4edda732c2",
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"versionType": "git"
},
{
"lessThan": "ad8a27d63cac96bac441edd002209ebd996e12fb",
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"versionType": "git"
},
{
"lessThan": "650bdd8fdfab64a09ee474150313dbc48c374795",
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"versionType": "git"
},
{
"lessThan": "b2a60f7f846faaf5c2cdad4ea6d3a33e5f863183",
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"versionType": "git"
},
{
"lessThan": "b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77",
"status": "affected",
"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/nfc/llcp_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()\n\nA race condition exists in the NFC LLCP connection state machine where\nthe connection acceptance packet (CC) can be processed concurrently with\nsocket release. This can lead to a use-after-free of the socket object.\n\nWhen nfc_llcp_recv_cc() moves the socket from the connecting_sockets\nlist to the sockets list, it does so without holding the socket lock.\nIf llcp_sock_release() is executing concurrently, it might have already\nunlinked the socket and dropped its references, which can result in\nnfc_llcp_recv_cc() linking a freed socket into the live list.\n\nFix this by holding lock_sock() during the state transition and list\nmovement in nfc_llcp_recv_cc(). After acquiring the lock, check if\nthe socket is still hashed to ensure it hasn\u0027t already been unlinked\nand marked for destruction by the release path. This aligns the locking\npattern with recv_hdlc() and recv_disc()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The corrupting input is an NFC LLCP Connection Complete (CC) PDU delivered over the NFC radio from a nearby peer; per kernel CNA guidance, NFC/Bluetooth-class wireless reachability maps to Adjacent rather than Local or Network.\nAC:L - The attacker can control both sides of the race by concurrently calling connect()/close() on an LLCP socket while timing CC transmission from an adjacent NFC device, making exploitation depend only on attacker-controlled timing rather than victim state.\nPR:N - An adjacent attacker needs no privileges on the victim system\u2014the kernel processes inbound NFC frames in kernel context; SOCK_STREAM LLCP sockets require no CAP_NET_RAW, so no elevated credentials are needed on either attack path.\nUI:N - Exploitation can be fully automated by a local or adjacent attacker scripting concurrent connect/close and CC injection without requiring any deliberate victim action beyond the device having NFC active and an LLCP session in progress.\nS:U - Impact is confined to kernel memory corruption and local privilege escalation within the same kernel security domain; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - The use-after-free operates on a freed socket structure still referenced in kernel linked lists, enabling reads of stale heap contents and kernel pointer disclosure as part of UAF exploitation.\nI:H - The UAF re-links a freed socket into the live list and writes connection TLVs into freed memory via nfc_llcp_parse_connection_tlv(), providing a heap corruption primitive suitable for arbitrary write and code execution.\nA:H - Use-after-free of a socket object in the NFC receive path reliably causes kernel oops/panic or hang, and the freed-but-linked socket corrupts subsequent list walks causing system crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:10.194Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dce85215a6c7b0fd753f577a4c487f647119884c"
},
{
"url": "https://git.kernel.org/stable/c/bd08bb7443c501d2f2a71d529e4afcf11c9b07d2"
},
{
"url": "https://git.kernel.org/stable/c/0b45c31746e1523d5d482fda8fcf54a35ac417f1"
},
{
"url": "https://git.kernel.org/stable/c/ee2d1a8a1833c5e56e9a1745e64b0b4edda732c2"
},
{
"url": "https://git.kernel.org/stable/c/ad8a27d63cac96bac441edd002209ebd996e12fb"
},
{
"url": "https://git.kernel.org/stable/c/650bdd8fdfab64a09ee474150313dbc48c374795"
},
{
"url": "https://git.kernel.org/stable/c/b2a60f7f846faaf5c2cdad4ea6d3a33e5f863183"
},
{
"url": "https://git.kernel.org/stable/c/b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77"
}
],
"title": "nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64010",
"datePublished": "2026-07-19T14:56:25.162Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-08-05T12:38:10.194Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74279 (GCVE-0-2026-74279)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
The sg_cleanup error path used list[i] instead of list[j] when unmapping
DMA buffers, leaking successfully mapped entries and repeatedly unmapping
the failed one.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c694b233295b99c33dd5ac28aede9f171f5a6862 Version: c694b233295b99c33dd5ac28aede9f171f5a6862 Version: c694b233295b99c33dd5ac28aede9f171f5a6862 Version: c694b233295b99c33dd5ac28aede9f171f5a6862 Version: c694b233295b99c33dd5ac28aede9f171f5a6862 Version: c694b233295b99c33dd5ac28aede9f171f5a6862 Version: c694b233295b99c33dd5ac28aede9f171f5a6862 Version: c694b233295b99c33dd5ac28aede9f171f5a6862 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74279",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:51:59.460893Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:29.607Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/cavium/cpt/cptvf_reqmanager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "23c6174e48f66fc10b998b0acdb406cb0caf5c80",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "23d3a7e896a1fe2d7a6bcb42f093948b79f8a198",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "28141f95ae93b18f9bfde953cb787fcb151fb9da",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "8afd1007ef79898a6e010eaade97097e49405fce",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "3b8a1e1f4e4071a62b20374028744e8cc8310d48",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "fb4d57b83356d4bd411b45ede3024e0ff42c9b5e",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "d319b83b97b3585550d9ae592dfa78c755b6129e",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
},
{
"lessThan": "9dbf173bd32d5f81b005008b682bfb50aa093455",
"status": "affected",
"version": "c694b233295b99c33dd5ac28aede9f171f5a6862",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/cavium/cpt/cptvf_reqmanager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: cavium/cpt - fix DMA cleanup using wrong loop index\n\nThe sg_cleanup error path used list[i] instead of list[j] when unmapping\nDMA buffers, leaking successfully mapped entries and repeatedly unmapping\nthe failed one."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On Cavium Thunder appliances the CPT VF skcipher driver is selected for in-kernel crypto on network-facing workloads (IPsec/xfrm ESP decrypt, NFS/RPC GSS-Kerberos), so remote peers can drive setup_sgio_components() by sending traffic that triggers hardware-accelerated AES/DES operations.\nAC:L - An attacker can reliably force the error path by fragmenting crypto buffers to raise incnt/outcnt and flooding concurrent encrypt/decrypt requests to exhaust IOMMU IOVAs, causing dma_map_single() to fail mid-loop; no uncontrollable victim state or race is required.\nPR:N - Exploitation requires no root or capabilities on the victim host; remote network peers sending IPsec or authenticated RPC traffic, or any local process using the kernel crypto API via AF_ALG sockets, can trigger the faulty DMA cleanup without admin privileges.\nUI:N - Exploitation is fully attacker-driven through automated network traffic or programmatic crypto requests and does not require any victim user action such as opening files or mounting filesystems.\nS:C - Leaked DMA mappings let the CPT PCI function continue bus-mastering kernel pages after software teardown, bypassing intended kernel DMA lifecycle and IOMMU-enforced device isolation boundaries when stale mappings target freed or repurposed memory.\nC:H - Unmapping failures leave active DMA translations while dma_addr metadata is cleared, allowing the CPT hardware to read kernel memory from freed or reallocated pages, providing a memory-corruption primitive that can disclose sensitive data.\nI:H - Stale bidirectional DMA mappings combined with bogus unmaps on DMA_MAPPING_ERROR can corrupt IOMMU state and let the accelerator write into kernel pages no longer owned by the request, enabling control of kernel memory contents.\nA:H - Repeated dma_unmap_single() on DMA_MAPPING_ERROR triggers WARN_ON in iommu_dma_unmap_phys, and accumulating leaked IOMMU mappings can exhaust DMA resources or panic the kernel during subsequent crypto operations."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:45:20.085Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/23c6174e48f66fc10b998b0acdb406cb0caf5c80"
},
{
"url": "https://git.kernel.org/stable/c/23d3a7e896a1fe2d7a6bcb42f093948b79f8a198"
},
{
"url": "https://git.kernel.org/stable/c/28141f95ae93b18f9bfde953cb787fcb151fb9da"
},
{
"url": "https://git.kernel.org/stable/c/8afd1007ef79898a6e010eaade97097e49405fce"
},
{
"url": "https://git.kernel.org/stable/c/3b8a1e1f4e4071a62b20374028744e8cc8310d48"
},
{
"url": "https://git.kernel.org/stable/c/fb4d57b83356d4bd411b45ede3024e0ff42c9b5e"
},
{
"url": "https://git.kernel.org/stable/c/d319b83b97b3585550d9ae592dfa78c755b6129e"
},
{
"url": "https://git.kernel.org/stable/c/9dbf173bd32d5f81b005008b682bfb50aa093455"
}
],
"title": "crypto: cavium/cpt - fix DMA cleanup using wrong loop index",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74279",
"datePublished": "2026-08-15T05:57:50.131Z",
"dateReserved": "2026-08-15T05:44:03.880Z",
"dateUpdated": "2026-10-16T18:55:29.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68320 (GCVE-0-2026-68320)
Vulnerability from cvelistv5
Published
2026-08-10 12:02
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the
capacity limit for ep->auth_chunk_list, allowing it to hold up to
20 chunk entries (param_hdr.length up to 24). However, the copy
destination asoc->c.auth_chunks in struct sctp_cookie is only
SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16
chunks are added, sctp_association_init() memcpy overflows the
destination by up to 4 bytes.
Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching
the destination capacity.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1f485649f52929d9937b346a920a522a7363e202 Version: 1f485649f52929d9937b346a920a522a7363e202 Version: 1f485649f52929d9937b346a920a522a7363e202 Version: 1f485649f52929d9937b346a920a522a7363e202 Version: 1f485649f52929d9937b346a920a522a7363e202 Version: 1f485649f52929d9937b346a920a522a7363e202 Version: 1f485649f52929d9937b346a920a522a7363e202 Version: 1f485649f52929d9937b346a920a522a7363e202 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68320",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:47:04.682572Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:04.674Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d22a7da2e264f407c729f33a0a346ff76108bc6",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "6837c1c19a259518974cbc5a52017646e3906564",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "54bb4c03fa17cdcb157c26c33e60a78cf32960f5",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "5a365f1e423444c5da7eb689a8661633dad43e48",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "886e28e14ab655012779016d251fef53d103aa12",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "11092d79eb2b7c0068382f72fc2416d1786bb2e0",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "b6ea3dda09eb4d5caf7bbc00f857688cf9e98255",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
},
{
"lessThan": "ff04b26794a16a8a879eb4fd2c02c2d6b03850e9",
"status": "affected",
"version": "1f485649f52929d9937b346a920a522a7363e202",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid\n\nsctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the\ncapacity limit for ep-\u003eauth_chunk_list, allowing it to hold up to\n20 chunk entries (param_hdr.length up to 24). However, the copy\ndestination asoc-\u003ec.auth_chunks in struct sctp_cookie is only\nSCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16\nchunks are added, sctp_association_init() memcpy overflows the\ndestination by up to 4 bytes.\n\nFix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching\nthe destination capacity."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The overflow condition can only be created locally: an attacker must call setsockopt(SCTP_AUTH_SUPPORTED) and then setsockopt(SCTP_AUTH_CHUNK) more than 16 times on an SCTP socket they own. A remote peer can trigger the memcpy by connecting to such a socket, but cannot itself populate the oversized chunk list.\nAC:L - The sequence is fully deterministic and entirely under attacker control \u2014 enable AUTH, add 17-20 distinct chunk IDs, then create an association via connect() or accept(); no race, timing window, or memory-layout condition is involved.\nPR:L - Creating an IPPROTO_SCTP socket and issuing SCTP_AUTH_SUPPORTED/SCTP_AUTH_CHUNK setsockopts requires no capability; sctp_setsockopt_auth_supported() enables AUTH per-endpoint regardless of the net.sctp.auth_enable sysctl, so any unprivileged local user reaches the bug.\nUI:N - The attacker performs every step from their own process \u2014 socket setup, setsockopt calls, and association establishment \u2014 with no action required from any other user or administrator.\nS:U - The corruption and the over-read are confined to the kernel\u0027s own SCTP association object; no other security authority or privilege domain is crossed.\nC:L - sctp_make_init()/sctp_make_init_ack() copy ntohs(auth_chunks-\u003elength) bytes from the 20-byte field, emitting up to 4 bytes past it (the adjacent raw_addr_list_len) inside the CHUNKS parameter of INIT/INIT-ACK sent to the remote peer \u2014 a real but small, strictly bounded out-of-bounds read.\nI:H - sctp_association_init() writes up to 4 bytes of fully attacker-chosen data (the chunk-ID values) past the end of asoc-\u003ec.auth_chunks into the adjacent kernel struct field, an out-of-bounds write of controlled content into kernel memory.\nA:H - On CONFIG_FORTIFY_SOURCE kernels the memcpy is flagged as a field-spanning write and emits a WARN, which is fatal on the widely used panic_on_warn configurations, and the out-of-bounds write itself corrupts SCTP association state; the trigger is cheap and repeatable by any local user."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:33:10.661Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d22a7da2e264f407c729f33a0a346ff76108bc6"
},
{
"url": "https://git.kernel.org/stable/c/6837c1c19a259518974cbc5a52017646e3906564"
},
{
"url": "https://git.kernel.org/stable/c/54bb4c03fa17cdcb157c26c33e60a78cf32960f5"
},
{
"url": "https://git.kernel.org/stable/c/5a365f1e423444c5da7eb689a8661633dad43e48"
},
{
"url": "https://git.kernel.org/stable/c/886e28e14ab655012779016d251fef53d103aa12"
},
{
"url": "https://git.kernel.org/stable/c/11092d79eb2b7c0068382f72fc2416d1786bb2e0"
},
{
"url": "https://git.kernel.org/stable/c/b6ea3dda09eb4d5caf7bbc00f857688cf9e98255"
},
{
"url": "https://git.kernel.org/stable/c/ff04b26794a16a8a879eb4fd2c02c2d6b03850e9"
}
],
"title": "sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68320",
"datePublished": "2026-08-10T12:02:55.144Z",
"dateReserved": "2026-07-30T09:28:09.382Z",
"dateUpdated": "2026-10-19T21:09:04.674Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63992 (GCVE-0-2026-63992)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-19 20:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
In some cases, iptunnel_pmtud_check_icmp() can be called while
skb transport header is not set.
This triggers an out-of-bound access, because
(typeof(skb->transport_header))~0U is 65535.
Access the icmp header based on IPv4 network header,
after making sure icmp->type is present in skb linear part.
Note that iptunnel_pmtud_check_icmpv6()) is fine.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f Version: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63992",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:34:46.388136Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:18:01.188Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_tunnel_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5a92cb45e34749865d03daf8d3500f77b5f6644c",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "c7b7ec3e69e673c0d6b57f74d21da50c485c598e",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "7f4f7efe7f30edd29c4988de01728bf2398217e4",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "e917d0c69f01af2bb4fbea2b66d560a53b3ac7ec",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "a096b6e34f602950af9a2b0856cd93a5f4c276d7",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "43368636c663cff6e59dde93cf4b8e43ac28eb93",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "cb549df9ce4ee15c9d5b19ddab12cf2128e4313c",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "509323077ef79a26ba0c60bb556e45c12c398b2d",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_tunnel_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntunnels: do not assume transport header in iptunnel_pmtud_check_icmp()\n\nIn some cases, iptunnel_pmtud_check_icmp() can be called while\nskb transport header is not set.\n\nThis triggers an out-of-bound access, because\n(typeof(skb-\u003etransport_header))~0U is 65535.\n\nAccess the icmp header based on IPv4 network header,\nafter making sure icmp-\u003etype is present in skb linear part.\n\nNote that iptunnel_pmtud_check_icmpv6()) is fine."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code runs on the VXLAN/GENEVE transmit path when processing remotely received UDP-encapsulated tunnel traffic (or L2 frames forwarded through a bridge port), which is reachable by sending crafted packets over the network to the victim VTEP.\nAC:L - The attacker fully controls the inner IPv4 header fields (DF bit, length, addresses) and can reliably craft oversized packets that exceed the tunnel-adjusted PMTU on bridge-port tunnel devices without depending on race timing or uncontrollable system state.\nPR:N - Exploitation requires only the ability to send network packets to a host with VXLAN/GENEVE bridged; no local account, authentication, or capabilities on the victim are needed.\nUI:N - No victim user action is required; the kernel processes attacker-supplied packets automatically through the tunnel receive, bridge forward, and re-encapsulation path.\nS:U - The out-of-bounds read and resulting kernel oops occur within the kernel network stack on the same host; there is no crossing of a VM, container, or IOMMU security boundary beyond standard kernel memory safety failure.\nC:H - Reading through `icmp_hdr(skb)` when `transport_header` is unset causes an out-of-bounds read at `skb-\u003ehead + 65535`, potentially disclosing adjacent kernel memory beyond the skb buffer before any bounds checking occurs.\nI:N - The flaw is an out-of-bounds read of the ICMP type field; it does not directly modify or write kernel memory, though it may cause a kernel fault.\nA:H - The invalid pointer dereference at offset 65535 can trigger a kernel oops or panic when accessing unmapped memory, causing denial of service on the affected host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:55.661Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5a92cb45e34749865d03daf8d3500f77b5f6644c"
},
{
"url": "https://git.kernel.org/stable/c/c7b7ec3e69e673c0d6b57f74d21da50c485c598e"
},
{
"url": "https://git.kernel.org/stable/c/7f4f7efe7f30edd29c4988de01728bf2398217e4"
},
{
"url": "https://git.kernel.org/stable/c/e917d0c69f01af2bb4fbea2b66d560a53b3ac7ec"
},
{
"url": "https://git.kernel.org/stable/c/a096b6e34f602950af9a2b0856cd93a5f4c276d7"
},
{
"url": "https://git.kernel.org/stable/c/43368636c663cff6e59dde93cf4b8e43ac28eb93"
},
{
"url": "https://git.kernel.org/stable/c/cb549df9ce4ee15c9d5b19ddab12cf2128e4313c"
},
{
"url": "https://git.kernel.org/stable/c/509323077ef79a26ba0c60bb556e45c12c398b2d"
}
],
"title": "tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63992",
"datePublished": "2026-07-19T14:56:12.528Z",
"dateReserved": "2026-07-19T07:54:57.025Z",
"dateUpdated": "2026-10-19T20:18:01.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74550 (GCVE-0-2026-74550)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: do not send ICMP/NDISC Redirects when peer allocation fails
When inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry
under memory pressure or tree size caps, redirect handlers previously fell
back to sending un-rate-limited ICMP/NDISC Redirect messages.
In IPv4, ip_rt_send_redirect() called icmp_send() directly when peer == NULL.
In IPv6, ip6_forward() and ndisc_send_redirect() passed a NULL peer into
inet_peer_xrlim_allow(), which returned true when peer == NULL.
Because ICMP/NDISC Redirects are not part of the default global rate limit
mask (sysctl_icmp_ratemask), sending redirects when peer == NULL creates
an un-rate-limited ICMP packet storm.
Fix this by failing closed in ip_rt_send_redirect(), ip6_forward(), and
ndisc_send_redirect() when peer is NULL.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 92d8682926342d2b6aa5b2ecc02221e00e1573a0 Version: 92d8682926342d2b6aa5b2ecc02221e00e1573a0 Version: 92d8682926342d2b6aa5b2ecc02221e00e1573a0 Version: 92d8682926342d2b6aa5b2ecc02221e00e1573a0 Version: 92d8682926342d2b6aa5b2ecc02221e00e1573a0 Version: 92d8682926342d2b6aa5b2ecc02221e00e1573a0 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74550",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:55.162783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:55.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/route.c",
"net/ipv6/ip6_output.c",
"net/ipv6/ndisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c0adf8b4247bcc5a145a25c1929006eb392580bb",
"status": "affected",
"version": "92d8682926342d2b6aa5b2ecc02221e00e1573a0",
"versionType": "git"
},
{
"lessThan": "f5ecaa7ea7686fa7ecdb6affc9d3a9a42e4524b1",
"status": "affected",
"version": "92d8682926342d2b6aa5b2ecc02221e00e1573a0",
"versionType": "git"
},
{
"lessThan": "21666f7af49a90ef44d474916b8ef4402dfd74f5",
"status": "affected",
"version": "92d8682926342d2b6aa5b2ecc02221e00e1573a0",
"versionType": "git"
},
{
"lessThan": "5ec5f00fc606a6df8434948c4552b3cb1176595d",
"status": "affected",
"version": "92d8682926342d2b6aa5b2ecc02221e00e1573a0",
"versionType": "git"
},
{
"lessThan": "828f6670d110ff2bf44c743037b38badc315704c",
"status": "affected",
"version": "92d8682926342d2b6aa5b2ecc02221e00e1573a0",
"versionType": "git"
},
{
"lessThan": "dbc3791e3b2472e1ccc08947e0f83b443470ff4f",
"status": "affected",
"version": "92d8682926342d2b6aa5b2ecc02221e00e1573a0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/route.c",
"net/ipv6/ip6_output.c",
"net/ipv6/ndisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.39"
},
{
"lessThan": "2.6.39",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.39",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not send ICMP/NDISC Redirects when peer allocation fails\n\nWhen inet_getpeer_v4() or inet_getpeer_v6() fails to allocate a peer entry\nunder memory pressure or tree size caps, redirect handlers previously fell\nback to sending un-rate-limited ICMP/NDISC Redirect messages.\n\nIn IPv4, ip_rt_send_redirect() called icmp_send() directly when peer == NULL.\nIn IPv6, ip6_forward() and ndisc_send_redirect() passed a NULL peer into\ninet_peer_xrlim_allow(), which returned true when peer == NULL.\n\nBecause ICMP/NDISC Redirects are not part of the default global rate limit\nmask (sysctl_icmp_ratemask), sending redirects when peer == NULL creates\nan un-rate-limited ICMP packet storm.\n\nFix this by failing closed in ip_rt_send_redirect(), ip6_forward(), and\nndisc_send_redirect() when peer is NULL."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is in IPv4/IPv6 packet forwarding paths (ip_forward/ip6_forward) reached when a remote host sends IP traffic processed by a forwarding router; this is standard net stack input handling, not a local-only API.\nAC:L - An attacker can reliably trigger redirect-eligible forwarded packets, flood unique source/destination addresses to stress inet_peer allocation, and induce memory pressure so peer allocation fails, controlling the conditions needed for the un-rate-limited redirect storm.\nPR:N - Exploitation requires only the ability to send IP packets to a forwarding host; no local account, capabilities, or authentication on the victim is needed.\nUI:N - No victim user action is required; the redirect storm is triggered entirely by attacker-sent network packets processed during kernel forwarding.\nS:U - Impact is confined to the kernel/network stack of the targeted forwarding system and its network availability; it does not cross VM, container, or IOMMU security boundaries.\nC:N - The bug bypasses redirect rate limiting to generate ICMP/NDISC storms; it does not involve memory corruption, out-of-bounds access, or unintended disclosure of sensitive kernel memory.\nI:N - The vulnerability causes excessive transmission of otherwise-valid redirect messages; it does not grant arbitrary data modification, code execution, or attacker-controlled corruption of kernel or application state.\nA:H - When peer allocation fails, ICMP/NDISC Redirects are sent without any rate limit (excluded from sysctl_icmp_ratemask), enabling a sustained packet storm that can exhaust CPU, memory, and bandwidth and deny service to the router and adjacent networks."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:38:44.870Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c0adf8b4247bcc5a145a25c1929006eb392580bb"
},
{
"url": "https://git.kernel.org/stable/c/f5ecaa7ea7686fa7ecdb6affc9d3a9a42e4524b1"
},
{
"url": "https://git.kernel.org/stable/c/21666f7af49a90ef44d474916b8ef4402dfd74f5"
},
{
"url": "https://git.kernel.org/stable/c/5ec5f00fc606a6df8434948c4552b3cb1176595d"
},
{
"url": "https://git.kernel.org/stable/c/828f6670d110ff2bf44c743037b38badc315704c"
},
{
"url": "https://git.kernel.org/stable/c/dbc3791e3b2472e1ccc08947e0f83b443470ff4f"
}
],
"title": "net: do not send ICMP/NDISC Redirects when peer allocation fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74550",
"datePublished": "2026-08-15T12:27:57.615Z",
"dateReserved": "2026-08-15T05:44:03.915Z",
"dateUpdated": "2026-10-16T19:05:55.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64312 (GCVE-0-2026-64312)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: pcrypt - restore callback for non-parallel fallback
pcrypt installs pcrypt_aead_done() on the child AEAD request before
trying to submit it through padata. If padata_do_parallel() returns
-EBUSY, pcrypt falls back to calling the child AEAD directly.
That fallback must not keep the padata completion callback. Otherwise
an asynchronous completion runs pcrypt_aead_done() even though the
request was never enrolled in padata.
Restore the original request callback and callback data before calling
the child AEAD directly. This keeps the fallback path aligned with a
direct AEAD request while leaving the parallel path unchanged.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a92ccd3618e42333ac6f150ecdac14dca298bc7a Version: 96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca Version: 92834692a539b5b7f409e467a14667d64713b732 Version: 5edae7a9a35606017ee6e05911c290acee9fee5a Version: 7ddab756f2de5b7b43c122ebebdf37f400fb2b6f Version: 662f2f13e66d3883b9238b0b96b17886179e60e2 Version: 662f2f13e66d3883b9238b0b96b17886179e60e2 Version: 662f2f13e66d3883b9238b0b96b17886179e60e2 Version: dd8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6 Version: fca8aed12218f96b38e374ff264d78ea1fbd23cc Version: a8e0074ffb38c9a5964a221bb998034d016c93a2 Version: 5.10.231 ≤ Version: 5.15.174 ≤ Version: 6.1.120 ≤ Version: 6.6.64 ≤ Version: 6.12.2 ≤ Version: 4.19.325 ≤ Version: 5.4.287 ≤ Version: 6.11.11 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64312",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:38:50.962318Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-662",
"description": "CWE-662 Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:23.127Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/pcrypt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81ce16d938db9b88cdc231522c0358395ae8c6b5",
"status": "affected",
"version": "a92ccd3618e42333ac6f150ecdac14dca298bc7a",
"versionType": "git"
},
{
"lessThan": "3920c5f6edc341729d20d0507e466c6d3b11f372",
"status": "affected",
"version": "96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca",
"versionType": "git"
},
{
"lessThan": "ae93c5b3e2a2968b56d772ca1d06615927b7cc36",
"status": "affected",
"version": "92834692a539b5b7f409e467a14667d64713b732",
"versionType": "git"
},
{
"lessThan": "82789a44415e3e31168229421b138278dfb16412",
"status": "affected",
"version": "5edae7a9a35606017ee6e05911c290acee9fee5a",
"versionType": "git"
},
{
"lessThan": "4711ca06bd169a2cbc9cc59a6de2ed512c41a880",
"status": "affected",
"version": "7ddab756f2de5b7b43c122ebebdf37f400fb2b6f",
"versionType": "git"
},
{
"lessThan": "c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf",
"status": "affected",
"version": "662f2f13e66d3883b9238b0b96b17886179e60e2",
"versionType": "git"
},
{
"lessThan": "83fa1397d5853de1e27dd52ec44b068ff358ca18",
"status": "affected",
"version": "662f2f13e66d3883b9238b0b96b17886179e60e2",
"versionType": "git"
},
{
"lessThan": "ed459fe319376e876de433d12b6c6772e612ca36",
"status": "affected",
"version": "662f2f13e66d3883b9238b0b96b17886179e60e2",
"versionType": "git"
},
{
"status": "affected",
"version": "dd8bf8eb5beba1e7c3b11a9a5a58ccbf345a69e6",
"versionType": "git"
},
{
"status": "affected",
"version": "fca8aed12218f96b38e374ff264d78ea1fbd23cc",
"versionType": "git"
},
{
"status": "affected",
"version": "a8e0074ffb38c9a5964a221bb998034d016c93a2",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThan": "6.12.96",
"status": "affected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.325",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/pcrypt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.231",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.174",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.12.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.325",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.287",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - restore callback for non-parallel fallback\n\npcrypt installs pcrypt_aead_done() on the child AEAD request before\ntrying to submit it through padata. If padata_do_parallel() returns\n-EBUSY, pcrypt falls back to calling the child AEAD directly.\n\nThat fallback must not keep the padata completion callback. Otherwise\nan asynchronous completion runs pcrypt_aead_done() even though the\nrequest was never enrolled in padata.\n\nRestore the original request callback and callback data before calling\nthe child AEAD directly. This keeps the fallback path aligned with a\ndirect AEAD request while leaving the parallel path unchanged."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - pcrypt is designed for network-facing IPsec use, and an inbound ESP packet can traverse xfrm_input(), esp_input(), crypto_aead_decrypt(), and pcrypt_aead_decrypt().\nAC:L - In load-responsive CPU-hotplug deployments, an attacker can flood qualifying ESP requests across repeated PADATA_RESET windows without precise timing or an uncontrollable memory-layout condition.\nPR:N - The ESP SPI is transmitted in clear, and the faulty path is reached before the child AEAD validates the integrity tag, so an unauthenticated on-path attacker needs no target-system privileges.\nUI:N - Packet delivery and asynchronous completion require no victim action.\nS:U - The failure affects the same kernel security authority processing the request and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The rejected request retains a zero padata-\u003epd pointer, producing a NULL dereference without an out-of-bounds read or information disclosure.\nI:N - The callback writes only the completion status into its valid request context before dereferencing NULL; it provides no attacker-directed corruption or write primitive.\nA:H - padata_do_serial() dereferences the uninitialized padata-\u003epd pointer, causing a kernel oops or panic that can terminate the system and can be retriggered."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:12.187Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5"
},
{
"url": "https://git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372"
},
{
"url": "https://git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36"
},
{
"url": "https://git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412"
},
{
"url": "https://git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880"
},
{
"url": "https://git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf"
},
{
"url": "https://git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18"
},
{
"url": "https://git.kernel.org/stable/c/ed459fe319376e876de433d12b6c6772e612ca36"
}
],
"title": "crypto: pcrypt - restore callback for non-parallel fallback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64312",
"datePublished": "2026-07-25T08:49:43.940Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-10-19T20:38:23.127Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80603 (GCVE-0-2026-80603)
Vulnerability from cvelistv5
Published
2026-08-28 06:48
Modified
2026-10-16 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
parse_dcc() treats data_end as an inclusive end pointer, but its only
caller passes data_limit = ib_ptr + datalen, which points one past the
last valid byte.
The newline search loop iterates while tmp <= data_end, so when no
newline is present, *tmp is read at tmp == data_end, one byte beyond
the region filled by skb_header_pointer().
irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is
capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte
is uninitialized or stale; if it contains an ASCII digit, simple_strtoul
will consume it and produce a wrong DCC IP or port in the conntrack
expectation. The extra allocation byte is also a fragile guard: if the
cap or allocation size changes, this becomes a real out-of-bounds read.
Change the loop and its post-loop check to use strict less-than,
consistent with the caller's exclusive-end convention. Update the
function comment accordingly.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:18:30.666759Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:30.043Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_irc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "abb8c32b88ea3f46beb68c34fe9a3ac8ed664e7e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "437e0a3854b3a44ec15afa9ab88ec215adf3a2fd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "910c33e4a8c046c3cc1fa5a465a4d41a1bb398f1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2b70f61f569bb29acb380e6f616a1bbdee15668f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2393f0bd7a467ad475598f3a5b9de27ca36e3037",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "aff589556ed772cb1c0c2d7b4d91ec45c0c39416",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "eeef3b81f449560653662df2dde6f6fe247c5365",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_irc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read\n\nparse_dcc() treats data_end as an inclusive end pointer, but its only\ncaller passes data_limit = ib_ptr + datalen, which points one past the\nlast valid byte.\n\nThe newline search loop iterates while tmp \u003c= data_end, so when no\nnewline is present, *tmp is read at tmp == data_end, one byte beyond\nthe region filled by skb_header_pointer().\n\nirc_buffer is kmalloc\u0027d as MAX_SEARCH_SIZE + 1 bytes and datalen is\ncapped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte\nis uninitialized or stale; if it contains an ASCII digit, simple_strtoul\nwill consume it and produce a wrong DCC IP or port in the conntrack\nexpectation. The extra allocation byte is also a fragile guard: if the\ncap or allocation size changes, this becomes a real out-of-bounds read.\n\nChange the loop and its post-loop check to use strict less-than,\nconsistent with the caller\u0027s exclusive-end convention. Update the\nfunction comment accordingly."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached from attacker-controlled TCP payloads on IPv4 flows processed by nf_confirm() (POST_ROUTING/LOCAL_IN) when the IRC conntrack helper is attached, e.g. on an IRC-exposed host or NAT/firewall handling IRC/DCC through netfilter.\nAC:L - Once the IRC helper is active on a tracked flow, exploitation is deterministic: the attacker completes a TCP handshake, sends a crafted client-to-server PRIVMSG/CTCP DCC without a newline at the copy boundary, and can plant the stale byte via the shared global irc_buffer.\nPR:N - No local account or kernel capabilities are required; a remote peer only needs to send network traffic on a connection where the administrator has enabled the IRC helper. Helper configuration is deployment state, not attacker privilege.\nUI:N - No victim-side clicks, mounts, or other interactive actions are needed beyond normal network reachability; the attacker supplies the malicious IRC/DCC payload directly over the established TCP session.\nS:U - Impact is confined to the kernel/netfilter security domain of the affected host (conntrack parsing and expectations). It does not cross VM, IOMMU, or other separate security-authority boundaries.\nC:H - parse_dcc() performs a one-byte out-of-bounds read past skb_header_pointer()\u0027s copied region into stale kmalloc data in the shared irc_buffer, exposing uninitialized or prior-session bytes that can influence subsequent parsing.\nI:H - If the overread byte is an ASCII digit, simple_strtoul() misparses the DCC address/port and can install incorrect nf_conntrack expectations, altering NAT/firewall pinholes rather than only reading memory.\nA:N - The overread is bounded by the deliberately oversized kmalloc guard (MAX_SEARCH_SIZE+1) and the fix commit states the stray access does not fault; this issue does not directly cause kernel oops, panic, or hang."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T06:21:14.540Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/abb8c32b88ea3f46beb68c34fe9a3ac8ed664e7e"
},
{
"url": "https://git.kernel.org/stable/c/437e0a3854b3a44ec15afa9ab88ec215adf3a2fd"
},
{
"url": "https://git.kernel.org/stable/c/910c33e4a8c046c3cc1fa5a465a4d41a1bb398f1"
},
{
"url": "https://git.kernel.org/stable/c/2b70f61f569bb29acb380e6f616a1bbdee15668f"
},
{
"url": "https://git.kernel.org/stable/c/2393f0bd7a467ad475598f3a5b9de27ca36e3037"
},
{
"url": "https://git.kernel.org/stable/c/aff589556ed772cb1c0c2d7b4d91ec45c0c39416"
},
{
"url": "https://git.kernel.org/stable/c/eeef3b81f449560653662df2dde6f6fe247c5365"
},
{
"url": "https://git.kernel.org/stable/c/ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a"
}
],
"title": "netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80603",
"datePublished": "2026-08-28T06:48:29.158Z",
"dateReserved": "2026-08-26T14:34:25.772Z",
"dateUpdated": "2026-10-16T19:26:30.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63920 (GCVE-0-2026-63920)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-19 20:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: validate extension header length before copying to cmsg
ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}
cmsgs (and their IPV6_2292* legacy counterparts) by trusting the
on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.
The length was validated only at parse time (ipv6_parse_hopopts(),
etc.). An nftables payload-write expression can rewrite hdrlen after
parsing and before the skb reaches recvmsg; the write itself is
in-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040
bytes from an 8-byte header. nftables is reachable from an
unprivileged user namespace, so this is an unprivileged
slab-out-of-bounds read:
BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540
put_cmsg+0x3ac/0x540
udpv6_recvmsg+0xca0/0x1250
sock_recvmsg+0xdf/0x190
____sys_recvmsg+0x1b1/0x620
Add ipv6_get_exthdr_len() which validates that at least two bytes
are accessible before reading the hdrlen field, then checks the
computed length against skb_tail_pointer(skb), returning 0 on
failure. Extension headers are kept in the linear skb area by
pskb_may_pull() during input, so skb_tail_pointer() is the correct
bound.
Use ipv6_get_exthdr_len() at all non-AH call sites: the five
standalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR)
and the three standard cases in the extension-header walk loop
(DSTOPTS, ROUTING, default). AH retains an inline bounds check
because its length formula differs ((ptr[1]+2)<<2).
The walk loop also gets a pre-read bounds check at the top to
validate ptr before any case accesses ptr[0] or ptr[1].
When the walk loop detects a corrupted header, return from the
function instead of continuing to process later socket options.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63920",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:33:23.448048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:56.265Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/datagram.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81394827dfb72772c50d0ae3bdfa094428a5d76d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "931b4a1f13408c2507719890f78f7227c34a0282",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "08464413e628803bd10cb1df68d0138665f2f885",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a29768d56eb3798c052ad3281b05596e695a17af",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0d330eff318c0f44d4fb0ad2c2aef38f87f24c90",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a35daeabb433686234b010ebf7b53778dbd6c9b8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "eb18a1b1644e4cad978df2131e2bb9a2e6886992",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "dd433671fef381fdaf7b530c631e6b782d66e224",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/datagram.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: validate extension header length before copying to cmsg\n\nip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}\ncmsgs (and their IPV6_2292* legacy counterparts) by trusting the\non-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.\nThe length was validated only at parse time (ipv6_parse_hopopts(),\netc.). An nftables payload-write expression can rewrite hdrlen after\nparsing and before the skb reaches recvmsg; the write itself is\nin-bounds but put_cmsg() then reads up to ((hdrlen+1) \u003c\u003c 3) = 2040\nbytes from an 8-byte header. nftables is reachable from an\nunprivileged user namespace, so this is an unprivileged\nslab-out-of-bounds read:\n\n BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540\n put_cmsg+0x3ac/0x540\n udpv6_recvmsg+0xca0/0x1250\n sock_recvmsg+0xdf/0x190\n ____sys_recvmsg+0x1b1/0x620\n\nAdd ipv6_get_exthdr_len() which validates that at least two bytes\nare accessible before reading the hdrlen field, then checks the\ncomputed length against skb_tail_pointer(skb), returning 0 on\nfailure. Extension headers are kept in the linear skb area by\npskb_may_pull() during input, so skb_tail_pointer() is the correct\nbound.\n\nUse ipv6_get_exthdr_len() at all non-AH call sites: the five\nstandalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR)\nand the three standard cases in the extension-header walk loop\n(DSTOPTS, ROUTING, default). AH retains an inline bounds check\nbecause its length formula differs ((ptr[1]+2)\u003c\u003c2).\n\nThe walk loop also gets a pre-read bounds check at the top to\nvalidate ptr before any case accesses ptr[0] or ptr[1].\n\nWhen the walk loop detects a corrupted header, return from the\nfunction instead of continuing to process later socket options."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscalls (nftables netlink to install a payload-set rule, setsockopt for IPV6_RECV* options, and recvmsg). Although the trigger packet is received over IPv6, the mandatory nftables corruption step is classified as Local per kernel guidance.\nAC:L - The attacker fully controls the nftables payload-set rule, the on-wire extension header, socket receive options, and the recvmsg call, making the slab out-of-bounds read reliably reproducible without races or external conditions.\nPR:L - An unprivileged local user can create a user+network namespace, obtain CAP_NET_ADMIN there, configure nftables, open a UDPv6/raw socket with extension-header cmsg options, and trigger the bug without real root in the initial namespace.\nUI:N - No victim interaction is required; the attacker can send the crafted IPv6 datagram and call recvmsg on their own socket to trigger the out-of-bounds read.\nS:U - Impact is confined to kernel memory disclosure and potential kernel instability within the same kernel security domain; it does not cross a VM/host or IOMMU boundary.\nC:H - put_cmsg() can copy up to 2040 bytes past the actual extension header into userspace ancillary data, leaking adjacent slab/kernel memory (confirmed by KASAN slab-out-of-bounds in put_cmsg).\nI:N - The bug is an out-of-bounds read that copies kernel data to userspace; it does not modify kernel memory, corrupt control structures, or provide a write primitive.\nA:H - The out-of-bounds slab read can provoke a KASAN fault/kernel oops during put_cmsg(), and repeated triggering can deny availability of the affected system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:14.814Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81394827dfb72772c50d0ae3bdfa094428a5d76d"
},
{
"url": "https://git.kernel.org/stable/c/931b4a1f13408c2507719890f78f7227c34a0282"
},
{
"url": "https://git.kernel.org/stable/c/08464413e628803bd10cb1df68d0138665f2f885"
},
{
"url": "https://git.kernel.org/stable/c/a29768d56eb3798c052ad3281b05596e695a17af"
},
{
"url": "https://git.kernel.org/stable/c/0d330eff318c0f44d4fb0ad2c2aef38f87f24c90"
},
{
"url": "https://git.kernel.org/stable/c/a35daeabb433686234b010ebf7b53778dbd6c9b8"
},
{
"url": "https://git.kernel.org/stable/c/eb18a1b1644e4cad978df2131e2bb9a2e6886992"
},
{
"url": "https://git.kernel.org/stable/c/dd433671fef381fdaf7b530c631e6b782d66e224"
}
],
"title": "ipv6: validate extension header length before copying to cmsg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63920",
"datePublished": "2026-07-19T14:55:22.813Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-10-19T20:17:56.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64190 (GCVE-0-2026-64190)
Vulnerability from cvelistv5
Published
2026-07-20 16:27
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: team: fix NULL pointer dereference in team_xmit during mode change
__team_change_mode() clears team->ops with memset() before restoring
safe dummy handlers via team_adjust_ops(). A concurrent team_xmit()
running under RCU on another CPU can read team->ops.transmit during
this window and call a NULL function pointer, crashing the kernel.
The race requires a mode change (CAP_NET_ADMIN) concurrent with
transmit on the team device.
BUG: kernel NULL pointer dereference, address: 0000000000000000
Oops: 0010 [#1] SMP KASAN NOPTI
RIP: 0010:0x0
Call Trace:
team_xmit (drivers/net/team/team_core.c:1853)
dev_hard_start_xmit (net/core/dev.c:3904)
__dev_queue_xmit (net/core/dev.c:4871)
packet_sendmsg (net/packet/af_packet.c:3109)
__sys_sendto (net/socket.c:2265)
The original code assumed that no ports means no traffic, so mode
changes could freely memset()/memcpy() the ops. AF_PACKET with
forced carrier breaks that assumption.
Prevent the race instead of making it safe: replace memset()/memcpy()
with per-field updates that never touch transmit or receive. Those
two handlers are managed solely by team_adjust_ops(), which already
installs dummies when tx_en_port_count == 0 (always true during mode
change since no ports are present). WRITE_ONCE/READ_ONCE prevent
store/load tearing on the handler pointers.
synchronize_net() before exit_op() drains in-flight readers that may
still reference old mode state from before port removal switched the
handlers to dummies.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9486377e5e971988a3add171c398eb654a866fab",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "cde5c7f0286c4203d0abc7248201542aa8bf33bb",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "03e9405c518c4d61f28079492f252d6d4e2bac5c",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
},
{
"lessThan": "25fe708bbc59289d3d1ea4b126fbc1b460a072a5",
"status": "affected",
"version": "3d249d4ca7d0ed6629a135ea1ea21c72286c0d80",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: team: fix NULL pointer dereference in team_xmit during mode change\n\n__team_change_mode() clears team-\u003eops with memset() before restoring\nsafe dummy handlers via team_adjust_ops(). A concurrent team_xmit()\nrunning under RCU on another CPU can read team-\u003eops.transmit during\nthis window and call a NULL function pointer, crashing the kernel.\n\nThe race requires a mode change (CAP_NET_ADMIN) concurrent with\ntransmit on the team device.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n Oops: 0010 [#1] SMP KASAN NOPTI\n RIP: 0010:0x0\n Call Trace:\n team_xmit (drivers/net/team/team_core.c:1853)\n dev_hard_start_xmit (net/core/dev.c:3904)\n __dev_queue_xmit (net/core/dev.c:4871)\n packet_sendmsg (net/packet/af_packet.c:3109)\n __sys_sendto (net/socket.c:2265)\n\nThe original code assumed that no ports means no traffic, so mode\nchanges could freely memset()/memcpy() the ops. AF_PACKET with\nforced carrier breaks that assumption.\n\nPrevent the race instead of making it safe: replace memset()/memcpy()\nwith per-field updates that never touch transmit or receive. Those\ntwo handlers are managed solely by team_adjust_ops(), which already\ninstalls dummies when tx_en_port_count == 0 (always true during mode\nchange since no ports are present). WRITE_ONCE/READ_ONCE prevent\nstore/load tearing on the handler pointers.\n\nsynchronize_net() before exit_op() drains in-flight readers that may\nstill reference old mode state from before port removal switched the\nhandlers to dummies."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:10.158Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9486377e5e971988a3add171c398eb654a866fab"
},
{
"url": "https://git.kernel.org/stable/c/cde5c7f0286c4203d0abc7248201542aa8bf33bb"
},
{
"url": "https://git.kernel.org/stable/c/03e9405c518c4d61f28079492f252d6d4e2bac5c"
},
{
"url": "https://git.kernel.org/stable/c/25fe708bbc59289d3d1ea4b126fbc1b460a072a5"
}
],
"title": "net: team: fix NULL pointer dereference in team_xmit during mode change",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64190",
"datePublished": "2026-07-20T16:27:48.314Z",
"dateReserved": "2026-07-19T07:54:57.040Z",
"dateUpdated": "2026-10-21T12:43:10.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72389 (GCVE-0-2026-72389)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bridge: stp: Fix a potential use-after-free when deleting a bridge
The three STP timers are not supposed to be armed while the bridge is
administratively down. They are synchronously deactivated when the
bridge is put administratively down and the various call sites check for
'IFF_UP' before arming them.
This check is missing from br_topology_change_detection() and it is
possible to engineer a situation in which the topology change timer is
armed while the bridge is administratively down, resulting in a
use-after-free [1] when the bridge is deleted.
Fix by adding the missing check and for good measures synchronously
shutdown the three timers when the bridge is deleted.
[1]
ODEBUG: free active (active state 0) object: ffff88811662b9b0 object type: timer_list hint: br_topology_change_timer_expired (net/bridge/br_stp_timer.c:120)
WARNING: lib/debugobjects.c:629 at debug_print_object+0x1bc/0x450, CPU#9: ip/359
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72389",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:48:22.802710Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:21.113Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_if.c",
"net/bridge/br_stp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c86579b0a2d201792bcb59316629f4ba4758cfc8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "297a747f59bff6573196d7236178144d66524e68",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4c40eec06eeac37c58e47a6058eb32901218d5d4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "39283907a25e5caf0f2bd2947f6e56644b01e2b7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b4b3458ef88df4798632619f018791d4344bcd92",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "40cbfa3a28e0919469d1b086629bb3ce38a83593",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2a00517db8de4be7df3d483b215c5544fb30a191",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_if.c",
"net/bridge/br_stp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: stp: Fix a potential use-after-free when deleting a bridge\n\nThe three STP timers are not supposed to be armed while the bridge is\nadministratively down. They are synchronously deactivated when the\nbridge is put administratively down and the various call sites check for\n\u0027IFF_UP\u0027 before arming them.\n\nThis check is missing from br_topology_change_detection() and it is\npossible to engineer a situation in which the topology change timer is\narmed while the bridge is administratively down, resulting in a\nuse-after-free [1] when the bridge is deleted.\n\nFix by adding the missing check and for good measures synchronously\nshutdown the three timers when the bridge is deleted.\n\n[1]\nODEBUG: free active (active state 0) object: ffff88811662b9b0 object type: timer_list hint: br_topology_change_timer_expired (net/bridge/br_stp_timer.c:120)\nWARNING: lib/debugobjects.c:629 at debug_print_object+0x1bc/0x450, CPU#9: ip/359"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation is via local RTNETLINK/ioctl to create a down bridge, enable kernel STP, enslave ports, and delete the bridge; remote STP BPDU handling is blocked when IFF_UP is clear, so the arming path that leaves timers active on a down bridge is local.\nAC:L - The public PoC uses a reliable, attacker-controlled netlink sequence (down bridge + kernel STP + port state progression + dellink) without winning races; per-port forward-delay timers deterministically reach br_topology_change_detection and arm topology_change_timer before deletion.\nPR:L - All reachable paths (RTM_NEWLINK/DELLINK, IFLA_BR_STP_STATE, enslaving ports) require CAP_NET_ADMIN, which unprivileged users can obtain in user/network namespaces (unshare -Urn, Kubernetes NET_ADMIN, LXC/libvirt network namespaces).\nUI:N - Triggering requires only programmatic bridge configuration by the attacker; no victim must click, mount, or open anything beyond the attacker\u0027s own netlink operations.\nS:U - Impact is kernel memory corruption and privilege escalation within the same kernel/host security domain; it does not cross a VM, container-to-host, or IOMMU boundary by itself.\nC:H - Use-after-free of the net_device/net_bridge kmalloc object lets an attacker reclaim freed slab memory and obtain arbitrary kernel read/disclosure primitives from corrupted timer and bridge structures.\nI:H - Disclosed analysis and PoC show the dangling timer callback can hijack control flow by reclaiming the freed object with attacker-controlled data, replacing the timer function pointer for arbitrary kernel code execution.\nA:H - Deleting the bridge with active STP timers queued causes the per-CPU timer wheel to invoke callbacks on freed memory, producing kernel BUG/oops/panics and denial of service even if full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:43:35.297Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c86579b0a2d201792bcb59316629f4ba4758cfc8"
},
{
"url": "https://git.kernel.org/stable/c/297a747f59bff6573196d7236178144d66524e68"
},
{
"url": "https://git.kernel.org/stable/c/4c40eec06eeac37c58e47a6058eb32901218d5d4"
},
{
"url": "https://git.kernel.org/stable/c/39283907a25e5caf0f2bd2947f6e56644b01e2b7"
},
{
"url": "https://git.kernel.org/stable/c/b4b3458ef88df4798632619f018791d4344bcd92"
},
{
"url": "https://git.kernel.org/stable/c/40cbfa3a28e0919469d1b086629bb3ce38a83593"
},
{
"url": "https://git.kernel.org/stable/c/2a00517db8de4be7df3d483b215c5544fb30a191"
}
],
"title": "bridge: stp: Fix a potential use-after-free when deleting a bridge",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72389",
"datePublished": "2026-08-15T05:56:18.553Z",
"dateReserved": "2026-08-09T03:40:39.923Z",
"dateUpdated": "2026-10-16T18:55:21.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74616 (GCVE-0-2026-74616)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-10-16 19:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xdp: reject clones that overrun skb_shared_info tailroom
xdpf_clone() clones broadcast copies into a single page and sets
frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that
page like a normal XDP frame and expects the usual skb_shared_info
tailroom at the end of the buffer.
The current check only rejects frames whose linear xdp_frame header,
headroom, and packet data exceed PAGE_SIZE. A source frame backed by a
larger allocation can still satisfy that check while extending into the
clone's required shared-info area. When such a clone is converted back
into an skb, build_skb_around() places skb_shared_info over live packet
bytes and later writes can corrupt XDP return metadata.
Reject clones unless their linear area fits inside
SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already
enforced by the XDP-to-skb conversion path.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74616",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:02:32.968446Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:06:02.219Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/xdp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "58408982fa39f9758124cec169f42854d6f98f35",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "685edea27ac68d08fe4dbd3de74b858d2ad8e830",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "ba13763d667e008e185fedf592d53846a5b457d1",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "ef4b7c7046d29a67090de15af0da0d1ae8d1b192",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "fab820f1691a9e26d9031f18aae1e9ce09078f92",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "e48e8edbef2eb824201495daa5234560f632b23c",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/xdp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxdp: reject clones that overrun skb_shared_info tailroom\n\nxdpf_clone() clones broadcast copies into a single page and sets\nframe_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that\npage like a normal XDP frame and expects the usual skb_shared_info\ntailroom at the end of the buffer.\n\nThe current check only rejects frames whose linear xdp_frame header,\nheadroom, and packet data exceed PAGE_SIZE. A source frame backed by a\nlarger allocation can still satisfy that check while extending into the\nclone\u0027s required shared-info area. When such a clone is converted back\ninto an skb, build_skb_around() places skb_shared_info over live packet\nbytes and later writes can corrupt XDP return metadata.\n\nReject clones unless their linear area fits inside\nSKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already\nenforced by the XDP-to-skb conversion path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Remote packets on an XDP ingress netdev whose program calls bpf_xdp_redirect_map() with BPF_F_BROADCAST reach xdpf_clone() through dev_map_enqueue_multi(); edge L4 load balancers and container fan-out to veth peers are common deployments where cloned frames later hit __xdp_build_skb_from_frame() without any local attacker access.\nAC:L - Once broadcast devmap redirect is deployed, an attacker can reliably craft linear frames whose headroom plus payload fall in the SKB_WITH_OVERHEAD(PAGE_SIZE)..PAGE_SIZE window; no race, timing luck, or uncontrollable memory layout is required and the condition can be retried with each packet.\nPR:N - Loading/attaching the XDP program and populating the devmap requires CAP_BPF and CAP_NET_ADMIN on the host, but an unauthenticated remote sender on the already-configured datapath needs no privileges on the victim system, matching the CNA pattern used for the related devmap broadcast clone issue CVE-2026-64355.\nUI:N - Exploitation is driven entirely by network traffic processed in NAPI/softirq after XDP redirect; no victim mount, file open, or other interactive action is required beyond packets reaching the configured interface.\nS:U - The flaw corrupts skb_shared_info placement and metadata within the host kernel address space during skb construction; it does not inherently cross VM, hypervisor, or IOMMU security boundaries.\nC:H - build_skb_around() places skb_shared_info over live packet bytes and memset initializes it there; subsequent skb/shinfo access can read kernel metadata and adjacent buffer contents beyond intended bounds, constituting exploitable out-of-bounds memory disclosure.\nI:H - Overlapping skb_shared_info tailroom lets kernel writes corrupt packet data and lets attacker-influenced bytes corrupt shinfo fields used by later stack, GRO, and transmit paths, giving an out-of-bounds write primitive over frame metadata.\nA:H - Tailroom overlap during __xdp_build_skb_from_frame() can fault or corrupt state during skb construction and downstream processing, producing kernel oops/panic; an attacker can trigger this repeatedly with crafted packets on the broadcast redirect path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:43.432Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/58408982fa39f9758124cec169f42854d6f98f35"
},
{
"url": "https://git.kernel.org/stable/c/685edea27ac68d08fe4dbd3de74b858d2ad8e830"
},
{
"url": "https://git.kernel.org/stable/c/ba13763d667e008e185fedf592d53846a5b457d1"
},
{
"url": "https://git.kernel.org/stable/c/ef4b7c7046d29a67090de15af0da0d1ae8d1b192"
},
{
"url": "https://git.kernel.org/stable/c/fab820f1691a9e26d9031f18aae1e9ce09078f92"
},
{
"url": "https://git.kernel.org/stable/c/f463b6f4957c9c3fd1c75f8d3e5af4879fa609c0"
},
{
"url": "https://git.kernel.org/stable/c/e48e8edbef2eb824201495daa5234560f632b23c"
}
],
"title": "xdp: reject clones that overrun skb_shared_info tailroom",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74616",
"datePublished": "2026-08-22T15:32:01.313Z",
"dateReserved": "2026-08-15T05:44:03.920Z",
"dateUpdated": "2026-10-16T19:06:02.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53260 (GCVE-0-2026-53260)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-19 19:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
syzbot reported a weird reqsk->rsk_refcnt underflow in
__inet_csk_reqsk_queue_drop().
The captured reqsk_put() in __inet_csk_reqsk_queue_drop()
is called only when it successfully removes reqsk from ehash.
Moreover, reqsk_timer_handler() calls another reqsk_put()
after that.
This indicates that the reqsk was missing both refcnts for
ehash and the timer itself.
Since all the syzbot reports had PREEMPT_RT enabled, the only
possible scenario is that reqsk_queue_hash_req() is preempted
after mod_timer() and before refcount_set(), and then the timer
triggered after 1s aborts the reqsk due to its listener's close().
Let's wrap mod_timer() and refcount_set() with
preempt_disable_nested() and preempt_enable_nested().
Note that inet_ehash_insert() holds the normal spin_lock()
(mutex in PREEMPT_RT), so it must be called outside of
preempt_disable_nested(), but this is fine.
The lookup path just ignores 0 sk_refcnt entries in ehash
and tries to create another reqsk, but this will fail at
inet_ehash_insert().
[0]:
refcount_t: underflow; use-after-free.
WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16
Modules linked in:
CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28
Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f
RSP: 0000:ffffc90000157948 EFLAGS: 00010246
RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00
RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005
R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568
R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0
Call Trace:
<TASK>
__refcount_sub_and_test include/linux/refcount.h:400 [inline]
__refcount_dec_and_test include/linux/refcount.h:432 [inline]
refcount_dec_and_test include/linux/refcount.h:450 [inline]
reqsk_put include/net/request_sock.h:136 [inline]
__inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007
reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137
call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2374 [inline]
__run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386
run_timer_base kernel/time/timer.c:2395 [inline]
run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
run_ktimerd+0x69/0x100 kernel/softirq.c:1151
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53260",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:27:55.242762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:57:32.259Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_connection_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "889fc99967007e2493833515a645cb2d800f6742",
"status": "affected",
"version": "d2d6422f8bd17c6bb205133e290625a564194496",
"versionType": "git"
},
{
"lessThan": "de5a46f3b2c8d3cd20afa158bd3a725e3e3d6fd3",
"status": "affected",
"version": "d2d6422f8bd17c6bb205133e290625a564194496",
"versionType": "git"
},
{
"lessThan": "b183215ff714efb747d9d5a429322ba6404b5401",
"status": "affected",
"version": "d2d6422f8bd17c6bb205133e290625a564194496",
"versionType": "git"
},
{
"lessThan": "e10902df24488ca722303133acfc82490f7d59ad",
"status": "affected",
"version": "d2d6422f8bd17c6bb205133e290625a564194496",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_connection_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().\n\nsyzbot reported a weird reqsk-\u003ersk_refcnt underflow in\n__inet_csk_reqsk_queue_drop().\n\nThe captured reqsk_put() in __inet_csk_reqsk_queue_drop()\nis called only when it successfully removes reqsk from ehash.\n\nMoreover, reqsk_timer_handler() calls another reqsk_put()\nafter that.\n\nThis indicates that the reqsk was missing both refcnts for\nehash and the timer itself.\n\nSince all the syzbot reports had PREEMPT_RT enabled, the only\npossible scenario is that reqsk_queue_hash_req() is preempted\nafter mod_timer() and before refcount_set(), and then the timer\ntriggered after 1s aborts the reqsk due to its listener\u0027s close().\n\nLet\u0027s wrap mod_timer() and refcount_set() with\npreempt_disable_nested() and preempt_enable_nested().\n\nNote that inet_ehash_insert() holds the normal spin_lock()\n(mutex in PREEMPT_RT), so it must be called outside of\npreempt_disable_nested(), but this is fine.\n\nThe lookup path just ignores 0 sk_refcnt entries in ehash\nand tries to create another reqsk, but this will fail at\ninet_ehash_insert().\n\n[0]:\nrefcount_t: underflow; use-after-free.\nWARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16\nModules linked in:\nCPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}\nTainted: [L]=SOFTLOCKUP\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026\nRIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28\nCode: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a \u003c67\u003e 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f\nRSP: 0000:ffffc90000157948 EFLAGS: 00010246\nRAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000\nRDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00\nRBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005\nR10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568\nR13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n __refcount_sub_and_test include/linux/refcount.h:400 [inline]\n __refcount_dec_and_test include/linux/refcount.h:432 [inline]\n refcount_dec_and_test include/linux/refcount.h:450 [inline]\n reqsk_put include/net/request_sock.h:136 [inline]\n __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007\n reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137\n call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748\n expire_timers kernel/time/timer.c:1799 [inline]\n __run_timers kernel/time/timer.c:2374 [inline]\n __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386\n run_timer_base kernel/time/timer.c:2395 [inline]\n run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403\n handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622\n __do_softirq kernel/softirq.c:656 [inline]\n run_ktimerd+0x69/0x100 kernel/softirq.c:1151\n smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160\n kthread+0x388/0x470 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable TCP request-socket path is reached by unauthenticated IPv4 or IPv6 SYN packets delivered to a listening socket over the network. This occurs before any application-level authentication.\nAC:L - Although the bug is a PREEMPT_RT timing race, an attacker can repeatedly create request sockets and timer/drop races by driving TCP connection attempts; under the required higher-severity rule this is treated as attacker-controllable rather than an uncontrollable environmental condition.\nPR:N - No credentials, capabilities, or prior authentication are required to send SYN packets to an exposed TCP listener and reach `tcp_conn_request()` and `reqsk_queue_hash_req()`. The path is in the generic TCP receive stack.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform an interactive action. Network traffic alone can exercise the vulnerable path on an affected listening service.\nS:U - The impact is within the kernel/network stack security authority on the same host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The failure is explicitly reported as a refcount underflow/use-after-free in a kernel heap object. Per the required guidance, UAF-class lifetime corruption is scored as high confidentiality impact because it can potentially be shaped into memory disclosure.\nI:H - The corrupted request-socket lifetime can leave stale kernel objects reachable through ehash/timer paths. Per the required guidance, UAF-class kernel memory corruption is scored as high integrity impact because it may be exploitable for write or control-flow manipulation.\nA:H - The observed failure triggers a kernel refcount warning with use-after-free semantics in timer context and can destabilize networking or the kernel. Kernel warnings/oopses, hangs, or UAF-triggered crashes are high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:39.011Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/889fc99967007e2493833515a645cb2d800f6742"
},
{
"url": "https://git.kernel.org/stable/c/de5a46f3b2c8d3cd20afa158bd3a725e3e3d6fd3"
},
{
"url": "https://git.kernel.org/stable/c/b183215ff714efb747d9d5a429322ba6404b5401"
},
{
"url": "https://git.kernel.org/stable/c/e10902df24488ca722303133acfc82490f7d59ad"
}
],
"title": "tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53260",
"datePublished": "2026-06-25T08:39:49.229Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-10-19T19:57:32.259Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43363 (GCVE-0-2026-43363)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-11 22:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/apic: Disable x2apic on resume if the kernel expects so
When resuming from s2ram, firmware may re-enable x2apic mode, which may have
been disabled by the kernel during boot either because it doesn't support IRQ
remapping or for other reasons. This causes the kernel to continue using the
xapic interface, while the hardware is in x2apic mode, which causes hangs.
This happens on defconfig + bare metal + s2ram.
Fix this in lapic_resume() by disabling x2apic if the kernel expects it to be
disabled, i.e. when x2apic_mode = 0.
The ACPI v6.6 spec, Section 16.3 [1] says firmware restores either the
pre-sleep configuration or initial boot configuration for each CPU, including
MSR state:
When executing from the power-on reset vector as a result of waking from an
S2 or S3 sleep state, the platform firmware performs only the hardware
initialization required to restore the system to either the state the
platform was in prior to the initial operating system boot, or to the
pre-sleep configuration state. In multiprocessor systems, non-boot
processors should be placed in the same state as prior to the initial
operating system boot.
(further ahead)
If this is an S2 or S3 wake, then the platform runtime firmware restores
minimum context of the system before jumping to the waking vector. This
includes:
CPU configuration. Platform runtime firmware restores the pre-sleep
configuration or initial boot configuration of each CPU (MSR, MTRR,
firmware update, SMBase, and so on). Interrupts must be disabled (for
IA-32 processors, disabled by CLI instruction).
(and other things)
So at least as per the spec, re-enablement of x2apic by the firmware is
allowed if "x2apic on" is a part of the initial boot configuration.
[1] https://uefi.org/specs/ACPI/6.6/16_Waking_and_Sleeping.html#initialization
[ bp: Massage. ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6e1cb38a2aef7680975e71f23de187859ee8b158 Version: 6e1cb38a2aef7680975e71f23de187859ee8b158 Version: 6e1cb38a2aef7680975e71f23de187859ee8b158 Version: 6e1cb38a2aef7680975e71f23de187859ee8b158 Version: 6e1cb38a2aef7680975e71f23de187859ee8b158 Version: 6e1cb38a2aef7680975e71f23de187859ee8b158 Version: 6e1cb38a2aef7680975e71f23de187859ee8b158 Version: 6e1cb38a2aef7680975e71f23de187859ee8b158 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/apic/apic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6ad6f2e31b524cbb66b2f370bad0cf17d327e6c",
"status": "affected",
"version": "6e1cb38a2aef7680975e71f23de187859ee8b158",
"versionType": "git"
},
{
"lessThan": "3dd0812a7c764cd8f3b0182441ac22da0a7f3b09",
"status": "affected",
"version": "6e1cb38a2aef7680975e71f23de187859ee8b158",
"versionType": "git"
},
{
"lessThan": "965289b120cc68cca886c75219c68b8c15751d73",
"status": "affected",
"version": "6e1cb38a2aef7680975e71f23de187859ee8b158",
"versionType": "git"
},
{
"lessThan": "f591938072115bf08730b8530c67fab189cc6308",
"status": "affected",
"version": "6e1cb38a2aef7680975e71f23de187859ee8b158",
"versionType": "git"
},
{
"lessThan": "1a85f84214f9d790216547ac6086bf8033cd9e5a",
"status": "affected",
"version": "6e1cb38a2aef7680975e71f23de187859ee8b158",
"versionType": "git"
},
{
"lessThan": "11712c4eb384098db4cb08792e223c818b908c1a",
"status": "affected",
"version": "6e1cb38a2aef7680975e71f23de187859ee8b158",
"versionType": "git"
},
{
"lessThan": "1d8440c1e7c49715f937416ac90cf260f1f1712c",
"status": "affected",
"version": "6e1cb38a2aef7680975e71f23de187859ee8b158",
"versionType": "git"
},
{
"lessThan": "8cc7dd77a1466f0ec58c03478b2e735a5b289b96",
"status": "affected",
"version": "6e1cb38a2aef7680975e71f23de187859ee8b158",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/apic/apic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.28"
},
{
"lessThan": "2.6.28",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/apic: Disable x2apic on resume if the kernel expects so\n\nWhen resuming from s2ram, firmware may re-enable x2apic mode, which may have\nbeen disabled by the kernel during boot either because it doesn\u0027t support IRQ\nremapping or for other reasons. This causes the kernel to continue using the\nxapic interface, while the hardware is in x2apic mode, which causes hangs.\nThis happens on defconfig + bare metal + s2ram.\n\nFix this in lapic_resume() by disabling x2apic if the kernel expects it to be\ndisabled, i.e. when x2apic_mode = 0.\n\nThe ACPI v6.6 spec, Section 16.3 [1] says firmware restores either the\npre-sleep configuration or initial boot configuration for each CPU, including\nMSR state:\n\n When executing from the power-on reset vector as a result of waking from an\n S2 or S3 sleep state, the platform firmware performs only the hardware\n initialization required to restore the system to either the state the\n platform was in prior to the initial operating system boot, or to the\n pre-sleep configuration state. In multiprocessor systems, non-boot\n processors should be placed in the same state as prior to the initial\n operating system boot.\n\n (further ahead)\n\n If this is an S2 or S3 wake, then the platform runtime firmware restores\n minimum context of the system before jumping to the waking vector. This\n includes:\n\n\tCPU configuration. Platform runtime firmware restores the pre-sleep\n\tconfiguration or initial boot configuration of each CPU (MSR, MTRR,\n\tfirmware update, SMBase, and so on). Interrupts must be disabled (for\n\tIA-32 processors, disabled by CLI instruction).\n\n\t(and other things)\n\nSo at least as per the spec, re-enablement of x2apic by the firmware is\nallowed if \"x2apic on\" is a part of the initial boot configuration.\n\n [1] https://uefi.org/specs/ACPI/6.6/16_Waking_and_Sleeping.html#initialization\n\n [ bp: Massage. ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:23:08.290Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6ad6f2e31b524cbb66b2f370bad0cf17d327e6c"
},
{
"url": "https://git.kernel.org/stable/c/3dd0812a7c764cd8f3b0182441ac22da0a7f3b09"
},
{
"url": "https://git.kernel.org/stable/c/965289b120cc68cca886c75219c68b8c15751d73"
},
{
"url": "https://git.kernel.org/stable/c/f591938072115bf08730b8530c67fab189cc6308"
},
{
"url": "https://git.kernel.org/stable/c/1a85f84214f9d790216547ac6086bf8033cd9e5a"
},
{
"url": "https://git.kernel.org/stable/c/11712c4eb384098db4cb08792e223c818b908c1a"
},
{
"url": "https://git.kernel.org/stable/c/1d8440c1e7c49715f937416ac90cf260f1f1712c"
},
{
"url": "https://git.kernel.org/stable/c/8cc7dd77a1466f0ec58c03478b2e735a5b289b96"
}
],
"title": "x86/apic: Disable x2apic on resume if the kernel expects so",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43363",
"datePublished": "2026-05-08T14:21:16.986Z",
"dateReserved": "2026-05-01T14:12:56.005Z",
"dateUpdated": "2026-05-11T22:23:08.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64118 (GCVE-0-2026-64118)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
qed: fix double free in qed_cxt_tables_alloc()
If one of the later PF or VF CID bitmap allocations fails,
qed_cid_map_alloc() jumps to cid_map_fail and frees the previously
allocated CID bitmaps before returning an error. qed_cxt_tables_alloc()
then calls qed_cxt_mngr_free(), which invokes qed_cid_map_free()
again.
Fix this by setting each CID bitmap pointer to NULL after bitmap_free()
to avoid double free.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1-rc3.
Runtime reproduction was not attempted because exercising the failing
allocation path requires device-specific setup.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fe56b9e6a8d957d6a20729d626027f800c17a2da Version: fe56b9e6a8d957d6a20729d626027f800c17a2da Version: fe56b9e6a8d957d6a20729d626027f800c17a2da Version: fe56b9e6a8d957d6a20729d626027f800c17a2da Version: fe56b9e6a8d957d6a20729d626027f800c17a2da Version: fe56b9e6a8d957d6a20729d626027f800c17a2da Version: fe56b9e6a8d957d6a20729d626027f800c17a2da Version: fe56b9e6a8d957d6a20729d626027f800c17a2da |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64118",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:36:40.630775Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:13.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qlogic/qed/qed_cxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9fe030719bd083b766602692ee96c8c985798e3c",
"status": "affected",
"version": "fe56b9e6a8d957d6a20729d626027f800c17a2da",
"versionType": "git"
},
{
"lessThan": "06fa8e69019fd3c41a7b0ea8c5f509c3a33dc227",
"status": "affected",
"version": "fe56b9e6a8d957d6a20729d626027f800c17a2da",
"versionType": "git"
},
{
"lessThan": "8cf5e4d2ca6b101d163c7423a426fb0aec34f7bb",
"status": "affected",
"version": "fe56b9e6a8d957d6a20729d626027f800c17a2da",
"versionType": "git"
},
{
"lessThan": "3904b993cc17ec5d7c5d3b57dbd0b775dafb9684",
"status": "affected",
"version": "fe56b9e6a8d957d6a20729d626027f800c17a2da",
"versionType": "git"
},
{
"lessThan": "bdf678a273cadbccc347f331ae2e93ff4d14834c",
"status": "affected",
"version": "fe56b9e6a8d957d6a20729d626027f800c17a2da",
"versionType": "git"
},
{
"lessThan": "0e47fc1c9181ae029e0e35a865cbf2adcbae626c",
"status": "affected",
"version": "fe56b9e6a8d957d6a20729d626027f800c17a2da",
"versionType": "git"
},
{
"lessThan": "a04c207f0801abdd23a169b5f902a9845059a65a",
"status": "affected",
"version": "fe56b9e6a8d957d6a20729d626027f800c17a2da",
"versionType": "git"
},
{
"lessThan": "2bccfb8476ca5f3548afbd623dc7a6980d4e77de",
"status": "affected",
"version": "fe56b9e6a8d957d6a20729d626027f800c17a2da",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qlogic/qed/qed_cxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqed: fix double free in qed_cxt_tables_alloc()\n\nIf one of the later PF or VF CID bitmap allocations fails,\nqed_cid_map_alloc() jumps to cid_map_fail and frees the previously\nallocated CID bitmaps before returning an error. qed_cxt_tables_alloc()\nthen calls qed_cxt_mngr_free(), which invokes qed_cid_map_free()\nagain.\n\nFix this by setting each CID bitmap pointer to NULL after bitmap_free()\nto avoid double free.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1-rc3.\n\nRuntime reproduction was not attempted because exercising the failing\nallocation path requires device-specific setup."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code runs only during PF driver resource initialization (probe or firmware-initiated recovery), reached via local kernel driver bring-up paths rather than network packet processing or remote protocol handlers.\nAC:L - An attacker who can influence system memory pressure (e.g., via local memory exhaustion) can reliably force `bitmap_zalloc()` failures during the multi-step CID bitmap allocation loop, and can also time this with firmware recovery reprobes that re-enter `qed_resc_alloc()`.\nPR:N - No local account or capability is strictly required if a remote attacker can induce firmware process-kill recovery on an internet-facing QED host, causing automatic re-execution of `qed_resc_alloc()` where post-incident memory pressure can trigger the failing allocation path.\nUI:N - Exploitation does not require any victim user action such as opening files or mounting filesystems; driver recovery and re-allocation occur automatically in kernel context once the error/recovery conditions are met.\nS:U - Impact is confined to kernel heap corruption and potential privilege escalation within the same kernel security boundary, not a cross-authority escape such as VM breakout or IOMMU bypass.\nC:H - A double-free of kmalloc-allocated CID bitmap objects corrupts the kernel slab allocator state, which is classically leverageable for arbitrary kernel memory disclosure through heap manipulation primitives.\nI:H - Slab double-free is a standard heap corruption primitive that can be developed into arbitrary kernel writes and control-flow hijacking, not merely a bounded or cosmetic modification.\nA:H - Double-free during driver initialization can cause immediate kernel oops/panic from allocator corruption, and repeated recovery attempts on production QED hardware can produce sustained denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:27.598Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9fe030719bd083b766602692ee96c8c985798e3c"
},
{
"url": "https://git.kernel.org/stable/c/06fa8e69019fd3c41a7b0ea8c5f509c3a33dc227"
},
{
"url": "https://git.kernel.org/stable/c/8cf5e4d2ca6b101d163c7423a426fb0aec34f7bb"
},
{
"url": "https://git.kernel.org/stable/c/3904b993cc17ec5d7c5d3b57dbd0b775dafb9684"
},
{
"url": "https://git.kernel.org/stable/c/bdf678a273cadbccc347f331ae2e93ff4d14834c"
},
{
"url": "https://git.kernel.org/stable/c/0e47fc1c9181ae029e0e35a865cbf2adcbae626c"
},
{
"url": "https://git.kernel.org/stable/c/a04c207f0801abdd23a169b5f902a9845059a65a"
},
{
"url": "https://git.kernel.org/stable/c/2bccfb8476ca5f3548afbd623dc7a6980d4e77de"
}
],
"title": "qed: fix double free in qed_cxt_tables_alloc()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64118",
"datePublished": "2026-07-19T15:40:17.643Z",
"dateReserved": "2026-07-19T07:54:57.035Z",
"dateUpdated": "2026-10-19T20:28:13.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72450 (GCVE-0-2026-72450)
Vulnerability from cvelistv5
Published
2026-08-15 05:56
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: validate selector family and prefixlen during match
syzbot reported a shift-out-of-bounds in xfrm_selector_match()
due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched
against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).
Fix this by:
- Rejecting mismatched families in xfrm_selector_match.
- Returning false in addr4_match if prefixlen > 32.
- Returning false in addr_match if prefixlen > 128 (prevents overflow).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8df5cd51fd70c33aa1776e5cbcd82b0a86649d73 Version: 2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71 Version: bce1afaa212ec380bf971614f70909a27882b862 Version: 7d9868180bd1e4cf37e7c5067362658971162366 Version: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 Version: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 Version: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 Version: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 Version: f31398570acf0f0804c644006f7bfa9067106b0a Version: 401ad99a5ae7180dd9449eac104cb755f442e7f3 Version: e68dd80ba498265d2266b12dc3459164f4ff0c4a Version: 5.10.229 ≤ Version: 5.15.170 ≤ Version: 6.1.115 ≤ Version: 6.6.59 ≤ Version: 4.19.323 ≤ Version: 5.4.285 ≤ Version: 6.11.6 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:50:15.343640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:24.828Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/xfrm.h",
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "87a5bbccc7ff4edb3f42fea387124237d2ba91ee",
"status": "affected",
"version": "8df5cd51fd70c33aa1776e5cbcd82b0a86649d73",
"versionType": "git"
},
{
"lessThan": "bd7f202cf77556cff59f68dc30e4cdf40cb6e33b",
"status": "affected",
"version": "2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71",
"versionType": "git"
},
{
"lessThan": "a3968ad4195d72c8fddcc6c0ef39da95ac98711a",
"status": "affected",
"version": "bce1afaa212ec380bf971614f70909a27882b862",
"versionType": "git"
},
{
"lessThan": "efa9e3b9f3dea2e1ea4c7edf4edc863faef85986",
"status": "affected",
"version": "7d9868180bd1e4cf37e7c5067362658971162366",
"versionType": "git"
},
{
"lessThan": "78783fefdc8f36879b1a17efa0d3195ea5f2dc5f",
"status": "affected",
"version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
"versionType": "git"
},
{
"lessThan": "6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe",
"status": "affected",
"version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
"versionType": "git"
},
{
"lessThan": "5a03a2ee17e8259dde631ed84fd8322db06cb2ae",
"status": "affected",
"version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
"versionType": "git"
},
{
"lessThan": "40f0b1047918539f0b0f795ac65e35336b4c2c78",
"status": "affected",
"version": "3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563",
"versionType": "git"
},
{
"status": "affected",
"version": "f31398570acf0f0804c644006f7bfa9067106b0a",
"versionType": "git"
},
{
"status": "affected",
"version": "401ad99a5ae7180dd9449eac104cb755f442e7f3",
"versionType": "git"
},
{
"status": "affected",
"version": "e68dd80ba498265d2266b12dc3459164f4ff0c4a",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.229",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.170",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.115",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.59",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.323",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.285",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/xfrm.h",
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.229",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.170",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.323",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: validate selector family and prefixlen during match\n\nsyzbot reported a shift-out-of-bounds in xfrm_selector_match()\ndue to AF_UNSPEC selector with large prefixlen (e.g. 128) matched\nagainst IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).\n\nFix this by:\n\n- Rejecting mismatched families in xfrm_selector_match.\n- Returning false in addr4_match if prefixlen \u003e 32.\n- Returning false in addr_match if prefixlen \u003e 128 (prevents overflow)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is armed via NETLINK_XFRM (XFRM_MSG_NEWSA with XFRM_STATE_AF_UNSPEC) in xfrm_user_rcv_msg(), and per kernel CNA guidance xfrm/netlink configuration is Local even though xfrm_selector_match() is later hit from IPv4/IPv6 packet processing in __xfrm_policy_check() and xfrm_state_look_at().\nAC:L - The attacker fully controls the malformed SA selector (AF_UNSPEC with prefixlen up to 255) and can deterministically trigger matching by sending or receiving IPv4/IPv6 traffic through xfrm; no race, victim state, or memory layout outside attacker control is required.\nPR:L - xfrm_user_rcv_msg() requires netlink_net_capable(CAP_NET_ADMIN), evaluated against the socket net namespace user_ns via ns_capable(); an unprivileged local user obtains CAP_NET_ADMIN with unshare -Urn and can install the poisoned SA and matching policy in that namespace.\nUI:N - The attacker performs the entire sequence\u2014installing the XFRM SA/policy over netlink and generating matching traffic\u2014with no action required from any other user, administrator, or victim.\nS:U - The shift-out-of-bounds and out-of-bounds memcmp reads occur entirely within kernel xfrm selector matching on the same host; no VM escape, IOMMU bypass, or cross-security-authority boundary is crossed.\nC:H - addr4_match() performs an undefined left-shift when prefixlen\u003e32 on IPv4 flows, and addr_match() can memcmp() up to (prefixlen\u003e\u003e5)\u003c\u003c2 bytes past 16-byte selector/flow addresses when prefixlen\u003e128 on IPv6, leaking adjacent kernel memory per CNA OOB-read guidance.\nI:H - C11 undefined-behavior shifts in hot-path packet classification and unchecked prefix comparisons can corrupt mask/offset arithmetic and selector-match control flow, giving attacker-influenced kernel behavior exploitable for integrity compromise per CNA memory-unsafe-operation guidance.\nA:H - syzbot reproduced UBSAN shift-out-of-bounds in xfrm_selector_match(), and undefined shifts plus out-of-bounds reads in the xfrm input/policy-check path can provoke kernel oops/panic (especially with panic_on_warn/KASAN), satisfying CNA guidance that kernel crashes are High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:44:19.730Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/87a5bbccc7ff4edb3f42fea387124237d2ba91ee"
},
{
"url": "https://git.kernel.org/stable/c/bd7f202cf77556cff59f68dc30e4cdf40cb6e33b"
},
{
"url": "https://git.kernel.org/stable/c/a3968ad4195d72c8fddcc6c0ef39da95ac98711a"
},
{
"url": "https://git.kernel.org/stable/c/efa9e3b9f3dea2e1ea4c7edf4edc863faef85986"
},
{
"url": "https://git.kernel.org/stable/c/78783fefdc8f36879b1a17efa0d3195ea5f2dc5f"
},
{
"url": "https://git.kernel.org/stable/c/6d99379c58f7f1c6ab2cc7aba01a4f52d71adcfe"
},
{
"url": "https://git.kernel.org/stable/c/5a03a2ee17e8259dde631ed84fd8322db06cb2ae"
},
{
"url": "https://git.kernel.org/stable/c/40f0b1047918539f0b0f795ac65e35336b4c2c78"
}
],
"title": "xfrm: validate selector family and prefixlen during match",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72450",
"datePublished": "2026-08-15T05:56:58.939Z",
"dateReserved": "2026-08-09T03:40:39.931Z",
"dateUpdated": "2026-10-16T18:55:24.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74255 (GCVE-0-2026-74255)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix UAF in tipc_l2_send_msg()
Syzbot reported a slab-use-after-free in ipvlan_hard_header() when
called from tipc_l2_send_msg().
The root cause is that tipc_disable_l2_media() calls synchronize_net()
while b->media_ptr is still valid. This allows concurrent RCU readers
to obtain the device pointer after synchronize_net() has finished.
The pointer is cleared later in bearer_disable(), but without any
subsequent synchronization, allowing the device to be freed while
still in use by readers.
Fix this by clearing b->media_ptr in tipc_disable_l2_media() before
calling synchronize_net().
This is safe to do now because the call order in bearer_disable()
was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic")
to call tipc_node_delete_links() (which needs the pointer) before
disable_media().
https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 282b3a056225b35024246f63feb91d769d714dad Version: 282b3a056225b35024246f63feb91d769d714dad Version: 282b3a056225b35024246f63feb91d769d714dad Version: 282b3a056225b35024246f63feb91d769d714dad Version: 282b3a056225b35024246f63feb91d769d714dad Version: 282b3a056225b35024246f63feb91d769d714dad Version: 282b3a056225b35024246f63feb91d769d714dad Version: 282b3a056225b35024246f63feb91d769d714dad |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74255",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:51:21.997322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:27.929Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/bearer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "609ced2301be1df7e7ed2ef47d1d916674e6ba3b",
"status": "affected",
"version": "282b3a056225b35024246f63feb91d769d714dad",
"versionType": "git"
},
{
"lessThan": "71aafa16d79b107b33837f60b6cbc7d0cb8c5708",
"status": "affected",
"version": "282b3a056225b35024246f63feb91d769d714dad",
"versionType": "git"
},
{
"lessThan": "f4002f1c669cc02e3763f479fc25ff1dfa9e2420",
"status": "affected",
"version": "282b3a056225b35024246f63feb91d769d714dad",
"versionType": "git"
},
{
"lessThan": "50ff092633b06382e5091dd5b093ce943d4ac2f9",
"status": "affected",
"version": "282b3a056225b35024246f63feb91d769d714dad",
"versionType": "git"
},
{
"lessThan": "aef12b5ce793dea6b3a97a58fd0f946000ae8945",
"status": "affected",
"version": "282b3a056225b35024246f63feb91d769d714dad",
"versionType": "git"
},
{
"lessThan": "0d8a12d7143126afdf9fbe2e3d438650dd6603ed",
"status": "affected",
"version": "282b3a056225b35024246f63feb91d769d714dad",
"versionType": "git"
},
{
"lessThan": "35e0297a93c3c34a3924eeef816c03504e3ab5c5",
"status": "affected",
"version": "282b3a056225b35024246f63feb91d769d714dad",
"versionType": "git"
},
{
"lessThan": "f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6",
"status": "affected",
"version": "282b3a056225b35024246f63feb91d769d714dad",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/bearer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix UAF in tipc_l2_send_msg()\n\nSyzbot reported a slab-use-after-free in ipvlan_hard_header() when\ncalled from tipc_l2_send_msg().\n\nThe root cause is that tipc_disable_l2_media() calls synchronize_net()\nwhile b-\u003emedia_ptr is still valid. This allows concurrent RCU readers\nto obtain the device pointer after synchronize_net() has finished.\nThe pointer is cleared later in bearer_disable(), but without any\nsubsequent synchronization, allowing the device to be freed while\nstill in use by readers.\n\nFix this by clearing b-\u003emedia_ptr in tipc_disable_l2_media() before\ncalling synchronize_net().\n\nThis is safe to do now because the call order in bearer_disable()\nwas reversed in 0d051bf93c06 (\"tipc: make bearer packet filtering generic\")\nto call tipc_node_delete_links() (which needs the pointer) before\ndisable_media().\n\nhttps: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - tipc_l2_send_msg is reached from tipc_bearer_xmit during L2 TIPC protocol handling; remote ETH_P_TIPC frames on cluster/datacenter L2 networks drive outbound transmission that races with bearer teardown in tipc_disable_l2_media.\nAC:L - The UAF window is a race where attackers control both sides by flooding TIPC Ethernet traffic while bearer disable runs and by concurrently triggering bearer teardown; syzbot reliably reproduced this without attacker-uncontrollable timing.\nPR:N - An unauthenticated remote attacker only needs to send TIPC L2 frames on a segment with an active bearer; bearer_disable teardown during cluster failover, netdev unregister, or node shutdown creates the required concurrent disable without attacker-local privileges.\nUI:N - No victim user action is required; exploitation is triggered by remote protocol traffic concurrent with automated or administrative bearer/interface teardown events.\nS:U - Impact is kernel slab memory corruption and potential privilege escalation within the same kernel security boundary, not a cross-VM or cross-namespace escape.\nC:H - Slab use-after-free of a net_device structure via ipvlan_hard_header enables reading freed kernel heap memory and can be leveraged for arbitrary kernel memory disclosure.\nI:H - UAF on net_device during dev_hard_header allows heap grooming and control of freed object contents, enabling arbitrary kernel writes and potential code execution.\nA:H - The UAF causes kernel oops/panic (as reported by syzbot in ipvlan_hard_header) and can be triggered repeatedly to deny service on cluster nodes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:45:03.215Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/609ced2301be1df7e7ed2ef47d1d916674e6ba3b"
},
{
"url": "https://git.kernel.org/stable/c/71aafa16d79b107b33837f60b6cbc7d0cb8c5708"
},
{
"url": "https://git.kernel.org/stable/c/f4002f1c669cc02e3763f479fc25ff1dfa9e2420"
},
{
"url": "https://git.kernel.org/stable/c/50ff092633b06382e5091dd5b093ce943d4ac2f9"
},
{
"url": "https://git.kernel.org/stable/c/aef12b5ce793dea6b3a97a58fd0f946000ae8945"
},
{
"url": "https://git.kernel.org/stable/c/0d8a12d7143126afdf9fbe2e3d438650dd6603ed"
},
{
"url": "https://git.kernel.org/stable/c/35e0297a93c3c34a3924eeef816c03504e3ab5c5"
},
{
"url": "https://git.kernel.org/stable/c/f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6"
}
],
"title": "tipc: fix UAF in tipc_l2_send_msg()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74255",
"datePublished": "2026-08-15T05:57:34.293Z",
"dateReserved": "2026-08-15T05:44:03.876Z",
"dateUpdated": "2026-10-16T18:55:27.929Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53220 (GCVE-0-2026-53220)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: revalidate bridge ports
ebt_redirect_tg() dereferences br_port_get_rcu() return without a
NULL check, causing a kernel panic when the bridge port has been
removed between the original hook invocation and an NFQUEUE
reinject.
A mere NULL check isn't sufficient, however. As sashiko review
points out userspace can not only remove the port from the bridge,
it could also place the device in a different virtual device, e.g.
macvlan.
If this happens, we must drop the packet, there is no way for us to
reinject it into the bridge path.
Switch to _upper API, we don't need the bridge port structure.
Also, this fix keeps another bug intact:
Both nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER
too aggressive, which prevents certain logging features when queueing
in bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old
CONFIG_BRIDGE_NETFILTER cruft is off.
Fixes tag is a common ancestor, this was always broken.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebt_dnat.c",
"net/bridge/netfilter/ebt_redirect.c",
"net/netfilter/nfnetlink_log.c",
"net/netfilter/nfnetlink_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "98cc0403f546c52104d654fa24d86e9bcac964d3",
"status": "affected",
"version": "f350a0a87374418635689471606454abc7beaa3a",
"versionType": "git"
},
{
"lessThan": "43330a1e8aace6b5a8de9aba127e9e394ab49b0f",
"status": "affected",
"version": "f350a0a87374418635689471606454abc7beaa3a",
"versionType": "git"
},
{
"lessThan": "4beffcd726e2a731cea4dc18e1fbc55c8d76f1a0",
"status": "affected",
"version": "f350a0a87374418635689471606454abc7beaa3a",
"versionType": "git"
},
{
"lessThan": "d4b1301fd3c9e5e105fd3767c68bc4ba558bb228",
"status": "affected",
"version": "f350a0a87374418635689471606454abc7beaa3a",
"versionType": "git"
},
{
"lessThan": "ccb9fd4b87538ccf19ccff78ee26700526d94867",
"status": "affected",
"version": "f350a0a87374418635689471606454abc7beaa3a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebt_dnat.c",
"net/bridge/netfilter/ebt_redirect.c",
"net/netfilter/nfnetlink_log.c",
"net/netfilter/nfnetlink_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: revalidate bridge ports\n\nebt_redirect_tg() dereferences br_port_get_rcu() return without a\nNULL check, causing a kernel panic when the bridge port has been\nremoved between the original hook invocation and an NFQUEUE\nreinject.\n\nA mere NULL check isn\u0027t sufficient, however. As sashiko review\npoints out userspace can not only remove the port from the bridge,\nit could also place the device in a different virtual device, e.g.\nmacvlan.\n\nIf this happens, we must drop the packet, there is no way for us to\nreinject it into the bridge path.\n\nSwitch to _upper API, we don\u0027t need the bridge port structure.\nAlso, this fix keeps another bug intact:\n\nBoth nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER\ntoo aggressive, which prevents certain logging features when queueing\nin bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old\nCONFIG_BRIDGE_NETFILTER cruft is off.\n\nFixes tag is a common ancestor, this was always broken."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:15.100Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/98cc0403f546c52104d654fa24d86e9bcac964d3"
},
{
"url": "https://git.kernel.org/stable/c/43330a1e8aace6b5a8de9aba127e9e394ab49b0f"
},
{
"url": "https://git.kernel.org/stable/c/4beffcd726e2a731cea4dc18e1fbc55c8d76f1a0"
},
{
"url": "https://git.kernel.org/stable/c/d4b1301fd3c9e5e105fd3767c68bc4ba558bb228"
},
{
"url": "https://git.kernel.org/stable/c/ccb9fd4b87538ccf19ccff78ee26700526d94867"
}
],
"title": "netfilter: revalidate bridge ports",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53220",
"datePublished": "2026-06-25T08:39:22.394Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-10-21T12:42:15.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64341 (GCVE-0-2026-64341)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: iowarrior: fix use-after-free on disconnect race
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/iowarrior.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4e7d3c98fed73d3be84d3e146d8d9be0309e725b",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "3c0a7b29ebb391d5f50b115e86f842b709195b08",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "30ec3025b771511625375fb3fb959aea3b45fb0d",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "71590982700fdeb39a37a500c877228b0140978e",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "c602254ba4c10f60a73cd99d147874f86a3f485c",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/iowarrior.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.21"
},
{
"lessThan": "2.6.21",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.58",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: iowarrior: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it\u0027s unlocked\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:16.721Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4e7d3c98fed73d3be84d3e146d8d9be0309e725b"
},
{
"url": "https://git.kernel.org/stable/c/3c0a7b29ebb391d5f50b115e86f842b709195b08"
},
{
"url": "https://git.kernel.org/stable/c/30ec3025b771511625375fb3fb959aea3b45fb0d"
},
{
"url": "https://git.kernel.org/stable/c/71590982700fdeb39a37a500c877228b0140978e"
},
{
"url": "https://git.kernel.org/stable/c/c602254ba4c10f60a73cd99d147874f86a3f485c"
}
],
"title": "USB: iowarrior: fix use-after-free on disconnect race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64341",
"datePublished": "2026-07-25T08:50:04.512Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-10-21T12:43:16.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80716 (GCVE-0-2026-80716)
Vulnerability from cvelistv5
Published
2026-08-28 06:53
Modified
2026-10-16 19:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: wake linked drain waiters on unlink
snd_pcm_drain() on a linked stream parks an on-stack wait entry on the
drained peer's runtime->sleep, and after schedule_timeout() removes it
only if that peer is still found in the caller's group. If group
membership changes during the wait and the sleep ends by signal or
timeout (so autoremove_wake_function() does not run), finish_wait() is
skipped and snd_pcm_drain() returns with the entry still queued on that
stream's sleep list; a later wake_up() then walks a freed stack frame.
This is reachable by unlinking either the drained or the draining stream.
Unlike the close path (snd_pcm_drop() -> snd_pcm_post_stop()),
snd_pcm_unlink() never wakes the sleep queues. Wake every group member
under the group lock before the membership change, so a linked drainer is
released and drops its entry while the streams are still grouped.
The window was opened when snd_pcm_link_rwsem stopped being held across
the wait and the removal became conditional on group membership (see
Fixes). The later switch to finish_wait() kept that conditional removal,
so the signal/timeout case remained.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f57f3df03a8e6010e321fa0258d3e054713c3cb7 Version: f57f3df03a8e6010e321fa0258d3e054713c3cb7 Version: f57f3df03a8e6010e321fa0258d3e054713c3cb7 Version: f57f3df03a8e6010e321fa0258d3e054713c3cb7 Version: f57f3df03a8e6010e321fa0258d3e054713c3cb7 Version: f57f3df03a8e6010e321fa0258d3e054713c3cb7 Version: f57f3df03a8e6010e321fa0258d3e054713c3cb7 Version: f57f3df03a8e6010e321fa0258d3e054713c3cb7 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80716",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:20:45.758887Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:34.951Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/pcm_native.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c172e4c53321ee6429955295ea133bc3597a3ca9",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "3035bb784cea3f338934f5042dd3f35225a51b2e",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "1c1b7e8e545ce65e40f65b55c432765e058ea98f",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "e8b784a3f4fba3ea9c4d05138ecfa784a069627f",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "e8315330e4ec09c0cac625515400e13d0ee22b81",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "2940cc3cf43c72126b74ee6376314c195382023a",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "db09bc4ab19ce548a078240d2374792523953500",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
},
{
"lessThan": "f495b6c4c8594122918552c9be2b51eb71647cd9",
"status": "affected",
"version": "f57f3df03a8e6010e321fa0258d3e054713c3cb7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/pcm_native.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: wake linked drain waiters on unlink\n\nsnd_pcm_drain() on a linked stream parks an on-stack wait entry on the\ndrained peer\u0027s runtime-\u003esleep, and after schedule_timeout() removes it\nonly if that peer is still found in the caller\u0027s group. If group\nmembership changes during the wait and the sleep ends by signal or\ntimeout (so autoremove_wake_function() does not run), finish_wait() is\nskipped and snd_pcm_drain() returns with the entry still queued on that\nstream\u0027s sleep list; a later wake_up() then walks a freed stack frame.\nThis is reachable by unlinking either the drained or the draining stream.\n\nUnlike the close path (snd_pcm_drop() -\u003e snd_pcm_post_stop()),\nsnd_pcm_unlink() never wakes the sleep queues. Wake every group member\nunder the group lock before the membership change, so a linked drainer is\nreleased and drops its entry while the streams are still grouped.\n\nThe window was opened when snd_pcm_link_rwsem stopped being held across\nthe wait and the removal became conditional on group membership (see\nFixes). The later switch to finish_wait() kept that conditional removal,\nso the signal/timeout case remained."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is triggered only via local ALSA PCM character devices (/dev/snd/pcmC*D*) through open/ioctl syscalls (SNDRV_PCM_IOCTL_LINK, UNLINK, DRAIN); snd_pcm_kernel_ioctl does not expose LINK/UNLINK, and there is no network-facing path to this code.\nAC:L - This is a race, but the attacker controls both sides by opening two PCM fds, linking them, blocking one thread in DRAIN, and concurrently UNLINKing or closing the peer; sending a signal or waiting for timeout forces the path where finish_wait() is skipped.\nPR:L - Exploitation requires only a local process able to open and ioctl ALSA PCM nodes (typical desktop/mobile users via the audio group, session ACLs, or equivalent device permissions); no real root, CAP_SYS_ADMIN, or init-namespace privileges are needed.\nUI:N - The attacker drives the entire sequence programmatically with their own PCM file descriptors and threads; no victim interaction such as opening a file, mounting a filesystem, or plugging in hardware is required.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security authority; this is not a VM escape, IOMMU/DMA boundary bypass, or other cross-scope violation.\nC:H - The orphaned wait_queue_entry_t remains on the sleep list after snd_pcm_drain() returns, and a later wake_up() dereferences a freed on-stack wait entry (use-after-free), which can expose kernel stack/memory contents under attacker-controlled timing.\nI:H - Corrupting the wait-queue list with a stale stack-backed entry gives kernel memory corruption primitives; wake_up() invokes the entry\u0027s function pointer from freed stack memory, enabling plausible control-flow hijack and arbitrary write via further heap/stack grooming.\nA:H - A subsequent wake_up() on the poisoned sleep queue walks a freed stack frame and can oops or panic the kernel; even without full exploitation, the UAF reliably threatens system availability on multimedia desktops, kiosks, and embedded devices with ALSA access."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T06:22:32.041Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c172e4c53321ee6429955295ea133bc3597a3ca9"
},
{
"url": "https://git.kernel.org/stable/c/3035bb784cea3f338934f5042dd3f35225a51b2e"
},
{
"url": "https://git.kernel.org/stable/c/1c1b7e8e545ce65e40f65b55c432765e058ea98f"
},
{
"url": "https://git.kernel.org/stable/c/e8b784a3f4fba3ea9c4d05138ecfa784a069627f"
},
{
"url": "https://git.kernel.org/stable/c/e8315330e4ec09c0cac625515400e13d0ee22b81"
},
{
"url": "https://git.kernel.org/stable/c/2940cc3cf43c72126b74ee6376314c195382023a"
},
{
"url": "https://git.kernel.org/stable/c/db09bc4ab19ce548a078240d2374792523953500"
},
{
"url": "https://git.kernel.org/stable/c/f495b6c4c8594122918552c9be2b51eb71647cd9"
}
],
"title": "ALSA: pcm: wake linked drain waiters on unlink",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80716",
"datePublished": "2026-08-28T06:53:14.286Z",
"dateReserved": "2026-08-26T14:34:25.788Z",
"dateUpdated": "2026-10-16T19:26:34.951Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64412 (GCVE-0-2026-64412)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: module names must be null-terminated
We need to explicitly check the length, else we may pass non-null
terminated string to request_module().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bcf4934288402be3464110109a4dae3bd6fb3e93 Version: bcf4934288402be3464110109a4dae3bd6fb3e93 Version: bcf4934288402be3464110109a4dae3bd6fb3e93 Version: bcf4934288402be3464110109a4dae3bd6fb3e93 Version: bcf4934288402be3464110109a4dae3bd6fb3e93 Version: bcf4934288402be3464110109a4dae3bd6fb3e93 Version: bcf4934288402be3464110109a4dae3bd6fb3e93 Version: bcf4934288402be3464110109a4dae3bd6fb3e93 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:23:43.576Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64412",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:40:22.056673Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:27.704Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebtables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "43dd2332b8a27b3ac5108791680cade654ab0f96",
"status": "affected",
"version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
"versionType": "git"
},
{
"lessThan": "5777c8f1c3610786d8482b8f620f40fccaf1542b",
"status": "affected",
"version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
"versionType": "git"
},
{
"lessThan": "0ddca0f90fa3395111d078ae4399615cf3ea94aa",
"status": "affected",
"version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
"versionType": "git"
},
{
"lessThan": "d2367d99f2455f373996d9ddbe833dbe9f942213",
"status": "affected",
"version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
"versionType": "git"
},
{
"lessThan": "da32e78bbb187ed7b137e0007034185570a3a172",
"status": "affected",
"version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
"versionType": "git"
},
{
"lessThan": "13a5f532e3a4fc75c33060a026def1572c208643",
"status": "affected",
"version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
"versionType": "git"
},
{
"lessThan": "7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8",
"status": "affected",
"version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
"versionType": "git"
},
{
"lessThan": "084d23f818321390509e9738a0b08bbf46df6425",
"status": "affected",
"version": "bcf4934288402be3464110109a4dae3bd6fb3e93",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebtables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: module names must be null-terminated\n\nWe need to explicitly check the length, else we may pass non-null\nterminated string to request_module()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable ebtables replacement path is reached through a local setsockopt syscall, not through received network traffic.\nAC:L - The attacker controls the complete table blob, including offsets, allocation size, and unterminated match name; no race or uncontrollable condition is required.\nPR:L - The path requires CAP_NET_ADMIN in the socket network namespace, which an unprivileged user can obtain by creating user and network namespaces on deployments permitting unprivileged user namespaces.\nUI:N - Exploitation requires no action by another user after the attacker invokes setsockopt with the crafted table.\nS:U - The vulnerability affects the host kernel within the same security authority and does not cross a virtualization or IOMMU boundary.\nC:H - The unbounded %s traversal constitutes an out-of-bounds kernel read that can continue beyond the match-name field and table allocation; under the required higher-severity treatment for unbounded OOB reads, confidentiality impact is High.\nI:N - The vulnerable operation only reads while formatting a module name; there is no demonstrated out-of-bounds write, use-after-free, or control-flow modification primitive.\nA:H - A page-aligned nonzero table blob can make vsnprintf scan into the vmalloc guard page, causing a kernel oops or panic, and the attacker can repeat the trigger."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:11.246Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/43dd2332b8a27b3ac5108791680cade654ab0f96"
},
{
"url": "https://git.kernel.org/stable/c/5777c8f1c3610786d8482b8f620f40fccaf1542b"
},
{
"url": "https://git.kernel.org/stable/c/0ddca0f90fa3395111d078ae4399615cf3ea94aa"
},
{
"url": "https://git.kernel.org/stable/c/d2367d99f2455f373996d9ddbe833dbe9f942213"
},
{
"url": "https://git.kernel.org/stable/c/da32e78bbb187ed7b137e0007034185570a3a172"
},
{
"url": "https://git.kernel.org/stable/c/13a5f532e3a4fc75c33060a026def1572c208643"
},
{
"url": "https://git.kernel.org/stable/c/7b217960e88b5d2d1e8cdcbcaf3bdf6fe199a0c8"
},
{
"url": "https://git.kernel.org/stable/c/084d23f818321390509e9738a0b08bbf46df6425"
}
],
"title": "netfilter: ebtables: module names must be null-terminated",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64412",
"datePublished": "2026-07-25T08:50:52.946Z",
"dateReserved": "2026-07-19T15:36:31.786Z",
"dateUpdated": "2026-10-19T20:38:27.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74496 (GCVE-0-2026-74496)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fou: Fix use-after-free in fou_create()
fou_create() publishes struct fou through sk_user_data before adding the
new FOU port to the per-netns list. If fou_add_to_port_list() fails,
the error path frees fou while it is still reachable through
sk_user_data. A concurrent receive can then dereference the freed
object in fou_from_sock().
This ordering issue was previously noted in the linked discussion.
The failure is reachable when local port 0 is requested. Each socket
binds to a different ephemeral port, but fou_cfg_cmp() compares the
requested port 0 and reports -EALREADY once an entry already exists.
Release the tunnel socket before freeing fou so sk_user_data is cleared
first, and defer reclamation with kfree_rcu() to protect concurrent RCU
readers. This matches the lifetime handling in fou_release().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 23461551c00628c3f3fe9cf837bf53cf8f212b63 Version: 23461551c00628c3f3fe9cf837bf53cf8f212b63 Version: 23461551c00628c3f3fe9cf837bf53cf8f212b63 Version: 23461551c00628c3f3fe9cf837bf53cf8f212b63 Version: 23461551c00628c3f3fe9cf837bf53cf8f212b63 Version: 23461551c00628c3f3fe9cf837bf53cf8f212b63 Version: 23461551c00628c3f3fe9cf837bf53cf8f212b63 Version: 23461551c00628c3f3fe9cf837bf53cf8f212b63 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74496",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:58:18.343359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:50.395Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/fou_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0ee628a58d83e571f36ec9f07624d6845e420c50",
"status": "affected",
"version": "23461551c00628c3f3fe9cf837bf53cf8f212b63",
"versionType": "git"
},
{
"lessThan": "a6fca682cfa2041e31aa72cc397c4a1406eb7468",
"status": "affected",
"version": "23461551c00628c3f3fe9cf837bf53cf8f212b63",
"versionType": "git"
},
{
"lessThan": "b3f9c3e60aa25453774f899d25b5e61dd0bec1d5",
"status": "affected",
"version": "23461551c00628c3f3fe9cf837bf53cf8f212b63",
"versionType": "git"
},
{
"lessThan": "99f4d3120b244f92e5df787152041296a2860cb5",
"status": "affected",
"version": "23461551c00628c3f3fe9cf837bf53cf8f212b63",
"versionType": "git"
},
{
"lessThan": "58835985c035a8333742f829ad7e0889a082f9d3",
"status": "affected",
"version": "23461551c00628c3f3fe9cf837bf53cf8f212b63",
"versionType": "git"
},
{
"lessThan": "9042867d4701728f0c6527215b11471759904d8f",
"status": "affected",
"version": "23461551c00628c3f3fe9cf837bf53cf8f212b63",
"versionType": "git"
},
{
"lessThan": "a28d8903bfe76089ea4bbdbff9976965f9ef8107",
"status": "affected",
"version": "23461551c00628c3f3fe9cf837bf53cf8f212b63",
"versionType": "git"
},
{
"lessThan": "b14361aca6350ff7907b0e9903c7b94dc7d5d4a0",
"status": "affected",
"version": "23461551c00628c3f3fe9cf837bf53cf8f212b63",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/fou_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfou: Fix use-after-free in fou_create()\n\nfou_create() publishes struct fou through sk_user_data before adding the\nnew FOU port to the per-netns list. If fou_add_to_port_list() fails,\nthe error path frees fou while it is still reachable through\nsk_user_data. A concurrent receive can then dereference the freed\nobject in fou_from_sock().\n\nThis ordering issue was previously noted in the linked discussion.\n\nThe failure is reachable when local port 0 is requested. Each socket\nbinds to a different ephemeral port, but fou_cfg_cmp() compares the\nrequested port 0 and reports -EALREADY once an entry already exists.\n\nRelease the tunnel socket before freeing fou so sk_user_data is cleared\nfirst, and defer reclamation with kfree_rcu() to protect concurrent RCU\nreaders. This matches the lifetime handling in fou_release()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is opened only via local FOU_CMD_ADD genetlink into fou_create(); remote UDP can race the dangling sk_user_data read in fou_udp_recv/gue_udp_recv but cannot alone reach the erroneous teardown path.\nAC:L - An attacker with CAP_NET_ADMIN controls both sides: issue a second FOU_CMD_ADD with port 0 to force -EALREADY on fou_add_to_port_list while concurrently sending UDP/GRO traffic to the just-bound ephemeral socket during the kfree window.\nPR:L - FOU_CMD_ADD is gated by GENL_ADMIN_PERM (CAP_NET_ADMIN); the fou genl family is netnsok, so a user with CAP_NET_ADMIN inside unshare -Urn can configure FOU and trigger the failing add path without init-namespace root.\nUI:N - Exploitation is fully programmatic via concurrent netlink FOU_CMD_ADD requests and attacker-controlled UDP packets; no victim mount, file open, or other interactive action is required.\nS:U - Impact is kernel heap corruption and privilege escalation within the same security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Concurrent readers call fou_from_sock() and dereference freed struct fou fields (family, protocol, flags); reclaimed slab contents give attacker-controlled reads and kernel pointer disclosure primitives typical of UAF.\nI:H - Freed struct fou is attacker-reclaimable kmalloc memory; fou_gro_receive indexes inet_offloads[fou-\u003eprotocol] from the dangling pointer, enabling heap grooming for arbitrary writes and control-flow hijack.\nA:H - Use-after-free in UDP receive/GRO softirq reliably causes KASAN violations and, on production kernels, invalid pointer dereferences or panics when accessing the freed fou object during packet processing."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T10:56:03.355Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ee628a58d83e571f36ec9f07624d6845e420c50"
},
{
"url": "https://git.kernel.org/stable/c/a6fca682cfa2041e31aa72cc397c4a1406eb7468"
},
{
"url": "https://git.kernel.org/stable/c/b3f9c3e60aa25453774f899d25b5e61dd0bec1d5"
},
{
"url": "https://git.kernel.org/stable/c/99f4d3120b244f92e5df787152041296a2860cb5"
},
{
"url": "https://git.kernel.org/stable/c/58835985c035a8333742f829ad7e0889a082f9d3"
},
{
"url": "https://git.kernel.org/stable/c/9042867d4701728f0c6527215b11471759904d8f"
},
{
"url": "https://git.kernel.org/stable/c/a28d8903bfe76089ea4bbdbff9976965f9ef8107"
},
{
"url": "https://git.kernel.org/stable/c/b14361aca6350ff7907b0e9903c7b94dc7d5d4a0"
}
],
"title": "fou: Fix use-after-free in fou_create()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74496",
"datePublished": "2026-08-15T12:27:23.854Z",
"dateReserved": "2026-08-15T05:44:03.906Z",
"dateUpdated": "2026-10-16T19:05:50.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72123 (GCVE-0-2026-72123)
Vulnerability from cvelistv5
Published
2026-08-15 05:53
Modified
2026-10-16 18:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
Commit f1b4e32aca08 ("can: bcm: use call_rcu() instead of costly
synchronize_rcu()") replaced synchronize_rcu() in bcm_delete_rx_op()
with call_rcu() and introduced the RX_NO_AUTOTIMER flag.
However, this flag check was omitted for thrtimer in the packet rx
fast-path. During BCM RX operation teardown, a concurrent RCU reader
(bcm_rx_handler) can race and re-arm thrtimer via
bcm_rx_update_and_send() after call_rcu() has been scheduled. Once
the RCU grace period elapses, bcm_op is freed. The subsequently
firing thrtimer then dereferences the deallocated op, causing a UAF.
Adding flag checks to the rx fast-path (bcm_rx_update_and_send) does not
fully close the TOCTOU race and introduces latency for every CAN frame.
Conversely, calling hrtimer_cancel() directly inside the RCU callback
(softirq context) is fatal as hrtimer_cancel() can sleep, triggering
a "scheduling while atomic" panic.
Resolve this by deferring the timer cancellation and memory free to a
dedicated unbound workqueue (bcm_wq). The RCU callback now queues a
work item to bcm_wq, which safely cancels both timers and deallocates
memory in sleepable process context. A dedicated workqueue is used to
prevent system-wide WQ saturation and is cleanly flushed/destroyed
on module unload to avoid rmmod page faults.
Since the deferred work can now outlive the calling context by an
unbounded amount, also take a reference on op->sk when it is assigned
and drop it only once the deferred work has cancelled both timers, so a
socket can no longer be freed out from under a still-armed timer whose
callback (bcm_send_to_user()) dereferences op->sk.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 85cd41070df992d3c0dfd828866fdd243d3b774a Version: f34f2a18e47b73e48f90a757e1f4aaa8c7d665a1 Version: f1b4e32aca0811aa011c76e5d6cf2fa19224b386 Version: f1b4e32aca0811aa011c76e5d6cf2fa19224b386 Version: f1b4e32aca0811aa011c76e5d6cf2fa19224b386 Version: f1b4e32aca0811aa011c76e5d6cf2fa19224b386 Version: f1b4e32aca0811aa011c76e5d6cf2fa19224b386 Version: f1b4e32aca0811aa011c76e5d6cf2fa19224b386 Version: fbac09a3b8890003c0c55294c00709f3ae5501bb Version: 5b48f5711f1c630841ab78dcc061de902f0e37bf Version: edb4baffb9483141a50fb7f7146cfe4a4c0c2db8 Version: 5.10.130 ≤ Version: 5.15.54 ≤ Version: 4.19.252 ≤ Version: 5.4.205 ≤ Version: 5.18.11 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:42:12.952847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:44:57.598Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "de5fce46637de05bef56ec08528127676eb6fc9b",
"status": "affected",
"version": "85cd41070df992d3c0dfd828866fdd243d3b774a",
"versionType": "git"
},
{
"lessThan": "036a8c320ca11bc912e8027adcfad14b326f067e",
"status": "affected",
"version": "f34f2a18e47b73e48f90a757e1f4aaa8c7d665a1",
"versionType": "git"
},
{
"lessThan": "3cf4fd5316f449811d8baf1bc6978ef5a7b743a9",
"status": "affected",
"version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
"versionType": "git"
},
{
"lessThan": "4177762f70646ac48a2af382e45a795cbd295198",
"status": "affected",
"version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
"versionType": "git"
},
{
"lessThan": "6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f",
"status": "affected",
"version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
"versionType": "git"
},
{
"lessThan": "cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5",
"status": "affected",
"version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
"versionType": "git"
},
{
"lessThan": "ce2d4b121fb7545e1ed588e860c8e5fd5ad45224",
"status": "affected",
"version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
"versionType": "git"
},
{
"lessThan": "68973f9db76144825e4f35dfdc80fb8279eb2d57",
"status": "affected",
"version": "f1b4e32aca0811aa011c76e5d6cf2fa19224b386",
"versionType": "git"
},
{
"status": "affected",
"version": "fbac09a3b8890003c0c55294c00709f3ae5501bb",
"versionType": "git"
},
{
"status": "affected",
"version": "5b48f5711f1c630841ab78dcc061de902f0e37bf",
"versionType": "git"
},
{
"status": "affected",
"version": "edb4baffb9483141a50fb7f7146cfe4a4c0c2db8",
"versionType": "git"
},
{
"lessThan": "5.10.265",
"status": "affected",
"version": "5.10.130",
"versionType": "semver"
},
{
"lessThan": "5.15.216",
"status": "affected",
"version": "5.15.54",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.252",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.205",
"versionType": "semver"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/bcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10.130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15.54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.252",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF\n\nCommit f1b4e32aca08 (\"can: bcm: use call_rcu() instead of costly\nsynchronize_rcu()\") replaced synchronize_rcu() in bcm_delete_rx_op()\nwith call_rcu() and introduced the RX_NO_AUTOTIMER flag.\n\nHowever, this flag check was omitted for thrtimer in the packet rx\nfast-path. During BCM RX operation teardown, a concurrent RCU reader\n(bcm_rx_handler) can race and re-arm thrtimer via\nbcm_rx_update_and_send() after call_rcu() has been scheduled. Once\nthe RCU grace period elapses, bcm_op is freed. The subsequently\nfiring thrtimer then dereferences the deallocated op, causing a UAF.\n\nAdding flag checks to the rx fast-path (bcm_rx_update_and_send) does not\nfully close the TOCTOU race and introduces latency for every CAN frame.\nConversely, calling hrtimer_cancel() directly inside the RCU callback\n(softirq context) is fatal as hrtimer_cancel() can sleep, triggering\na \"scheduling while atomic\" panic.\n\nResolve this by deferring the timer cancellation and memory free to a\ndedicated unbound workqueue (bcm_wq). The RCU callback now queues a\nwork item to bcm_wq, which safely cancels both timers and deallocates\nmemory in sleepable process context. A dedicated workqueue is used to\nprevent system-wide WQ saturation and is cleanly flushed/destroyed\non module unload to avoid rmmod page faults.\n\nSince the deferred work can now outlive the calling context by an\nunbounded amount, also take a reference on op-\u003esk when it is assigned\nand drop it only once the deferred work has cancelled both timers, so a\nsocket can no longer be freed out from under a still-armed timer whose\ncallback (bcm_send_to_user()) dereferences op-\u003esk."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local BCM socket syscalls (sendmsg with RX_SETUP/SETTIMER/ival2 throttling and RX_DELETE); CAN frames can be injected locally via loopback without physical bus access.\nAC:L - The attacker controls both sides of the race by concurrently issuing RX_DELETE teardown and delivering matching CAN frames (e.g., via threads or paired BCM/RAW sockets), making the thrtimer re-arm UAF reliably triggerable.\nPR:L - No kernel capability check gates AF_CAN/CAN_BCM socket creation or bcm_sendmsg opcodes; any unprivileged local user with socket access (including via user namespaces with vcan) can reach the vulnerable path.\nUI:N - No victim interaction is required; the attacker self-triggers the race through their own BCM socket operations and locally injected CAN traffic.\nS:U - Impact is confined to kernel memory corruption and local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM or IOMMU bypass.\nC:H - The thrtimer UAF dereferences freed bcm_op fields (locks, frame buffers, op-\u003esk) in bcm_rx_thr_handler/bcm_send_to_user, enabling attacker-controlled heap reuse and arbitrary kernel memory disclosure.\nI:H - UAF on the bcm_op slab object allows heap spraying to corrupt function pointers, timers, and sock structures, providing a standard path to arbitrary kernel writes and local privilege escalation.\nA:H - The freed-op dereference in the hrtimer softirq path causes kernel oops/panic under normal exploitation attempts, and successful memory corruption can crash or hang the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:36:18.988Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/de5fce46637de05bef56ec08528127676eb6fc9b"
},
{
"url": "https://git.kernel.org/stable/c/036a8c320ca11bc912e8027adcfad14b326f067e"
},
{
"url": "https://git.kernel.org/stable/c/3cf4fd5316f449811d8baf1bc6978ef5a7b743a9"
},
{
"url": "https://git.kernel.org/stable/c/4177762f70646ac48a2af382e45a795cbd295198"
},
{
"url": "https://git.kernel.org/stable/c/6fd08e8d826c3aa4cc7021f5f9cdbb7fa7441d3f"
},
{
"url": "https://git.kernel.org/stable/c/cd830e0bc25ee2d38cbfbdbb3cd77c5f53b2b6d5"
},
{
"url": "https://git.kernel.org/stable/c/ce2d4b121fb7545e1ed588e860c8e5fd5ad45224"
},
{
"url": "https://git.kernel.org/stable/c/68973f9db76144825e4f35dfdc80fb8279eb2d57"
}
],
"title": "can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72123",
"datePublished": "2026-08-15T05:53:01.433Z",
"dateReserved": "2026-08-09T03:40:39.907Z",
"dateUpdated": "2026-10-16T18:44:57.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53403 (GCVE-0-2026-53403)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-08-17 04:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var
info->var, a framebuffer's current mode, is expected to have a matching
entry in info->modelist. var_to_display() relies on this and treats a
failed fb_match_mode() as "This should not happen". fb_set_var() keeps it
true by adding the mode to the list on every change, and
do_register_framebuffer() does the same at registration.
store_modes() replaces the modelist from userspace. fb_new_modelist()
validates the new modes but does not check that info->var still has a
match. It relies on fbcon_new_modelist() to re-point consoles, but that
only handles consoles mapped to the framebuffer. With fbcon unbound there
are none, so info->var is left describing a mode that is no longer in the
list.
A later console takeover runs var_to_display(), where fb_match_mode()
returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it
to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode.
Keep the current mode in the list in fb_new_modelist(), the same way
fb_set_var() does.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1458a4d804550b7101e8bb02c1cb941088e4c0c7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8707f02ac9f5f632039b60df2c9f3dc914709f72",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0d8c7f21ad8529d5c181e61f86be35b887ae2e4d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7640b4f68acb54c2c4f6b4a8aee0e9849dacd929",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4f1a7fe8ba845cb7d39580755f78c3b7b9a0b61e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "eea16b6f805c0b1fb2f72f0f771088ea45356956",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "88913059c77e171f44ba829282d42dde0d458811",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7f08fc10fa3d3366dc3af723970bd03d7d6d10e3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var\n\ninfo-\u003evar, a framebuffer\u0027s current mode, is expected to have a matching\nentry in info-\u003emodelist. var_to_display() relies on this and treats a\nfailed fb_match_mode() as \"This should not happen\". fb_set_var() keeps it\ntrue by adding the mode to the list on every change, and\ndo_register_framebuffer() does the same at registration.\n\nstore_modes() replaces the modelist from userspace. fb_new_modelist()\nvalidates the new modes but does not check that info-\u003evar still has a\nmatch. It relies on fbcon_new_modelist() to re-point consoles, but that\nonly handles consoles mapped to the framebuffer. With fbcon unbound there\nare none, so info-\u003evar is left describing a mode that is no longer in the\nlist.\n\nA later console takeover runs var_to_display(), where fb_match_mode()\nreturns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it\nto display_to_var(), and fb_videomode_to_var() dereferences the NULL mode.\n\nKeep the current mode in the list in fb_new_modelist(), the same way\nfb_set_var() does."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:56.753Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1458a4d804550b7101e8bb02c1cb941088e4c0c7"
},
{
"url": "https://git.kernel.org/stable/c/8707f02ac9f5f632039b60df2c9f3dc914709f72"
},
{
"url": "https://git.kernel.org/stable/c/0d8c7f21ad8529d5c181e61f86be35b887ae2e4d"
},
{
"url": "https://git.kernel.org/stable/c/7640b4f68acb54c2c4f6b4a8aee0e9849dacd929"
},
{
"url": "https://git.kernel.org/stable/c/4f1a7fe8ba845cb7d39580755f78c3b7b9a0b61e"
},
{
"url": "https://git.kernel.org/stable/c/eea16b6f805c0b1fb2f72f0f771088ea45356956"
},
{
"url": "https://git.kernel.org/stable/c/88913059c77e171f44ba829282d42dde0d458811"
},
{
"url": "https://git.kernel.org/stable/c/7f08fc10fa3d3366dc3af723970bd03d7d6d10e3"
}
],
"title": "fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53403",
"datePublished": "2026-07-19T12:02:02.382Z",
"dateReserved": "2026-06-09T07:44:35.403Z",
"dateUpdated": "2026-08-17T04:50:56.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74382 (GCVE-0-2026-74382)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-08-17 05:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_bpf: prevent unbounded recursion in offload rollback
Quan Sun reported [1] a stack overflow in cls_bpf_offload_cmd().
Reproducer on netdevsim: add a skip_sw cls_bpf filter, set the
bpf_tc_accept debugfs knob to 0, then `tc filter replace`. The replace
calls tc_setup_cb_replace() which fails. cls_bpf_offload_cmd() then
swaps prog/oldprog and recursively calls itself to roll back. But
bpf_tc_accept=0 makes the rollback fail too, which triggers yet another
rollback frame with the same arguments, and so on until the stack is
exhausted.
bpf_tc_accept is just a convenient knob for the reproducer. Any driver
whose tc_setup_cb_replace() fails twice in a row can hit the same loop,
so this is not a netdevsim-only issue.
Two ways to fix it:
1) Have the rollback call tc_setup_cb_add() on oldprog instead of
re-entering cls_bpf_offload_cmd().
2) Mark the rollback frame with a flag and skip a second-level
rollback from inside it.
Go with (2). It is the smaller change and keeps the original behaviour:
the rollback still goes through tc_setup_cb_replace(), so the driver
gets one real chance to restore its state. If that attempt also fails,
we just return the original error instead of recursing.
[1]: https://lore.kernel.org/bpf/ce5a6005-3c5e-4696-9e05-eba9461dc860@std.uestc.edu.cn/T/#u
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 102740bd9436a3a6ba129af3a48271d794009fa5 Version: 102740bd9436a3a6ba129af3a48271d794009fa5 Version: 102740bd9436a3a6ba129af3a48271d794009fa5 Version: 102740bd9436a3a6ba129af3a48271d794009fa5 Version: 102740bd9436a3a6ba129af3a48271d794009fa5 Version: 102740bd9436a3a6ba129af3a48271d794009fa5 Version: 102740bd9436a3a6ba129af3a48271d794009fa5 Version: 102740bd9436a3a6ba129af3a48271d794009fa5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/cls_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a018f208ab7512380bd4cf670064d48cba00a1b1",
"status": "affected",
"version": "102740bd9436a3a6ba129af3a48271d794009fa5",
"versionType": "git"
},
{
"lessThan": "33373e1f378a501bc51aa73312f74295c84e3101",
"status": "affected",
"version": "102740bd9436a3a6ba129af3a48271d794009fa5",
"versionType": "git"
},
{
"lessThan": "e2d3b7bab3748c811dc5750ce9a8d62bc7f90ed7",
"status": "affected",
"version": "102740bd9436a3a6ba129af3a48271d794009fa5",
"versionType": "git"
},
{
"lessThan": "4a76953c3ed043797e81529b9395e9ca6f4c7609",
"status": "affected",
"version": "102740bd9436a3a6ba129af3a48271d794009fa5",
"versionType": "git"
},
{
"lessThan": "1387f252a242a51bfbb6eace29c8f8db21b457da",
"status": "affected",
"version": "102740bd9436a3a6ba129af3a48271d794009fa5",
"versionType": "git"
},
{
"lessThan": "10753da2d659dd425a6e620f47f86852d604f67f",
"status": "affected",
"version": "102740bd9436a3a6ba129af3a48271d794009fa5",
"versionType": "git"
},
{
"lessThan": "3fa6fb5d771c992ebedbfa7331c6bcc6f33f89b7",
"status": "affected",
"version": "102740bd9436a3a6ba129af3a48271d794009fa5",
"versionType": "git"
},
{
"lessThan": "27db54b90bcc7c37867fe664107fa25ea6a116e4",
"status": "affected",
"version": "102740bd9436a3a6ba129af3a48271d794009fa5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/cls_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_bpf: prevent unbounded recursion in offload rollback\n\nQuan Sun reported [1] a stack overflow in cls_bpf_offload_cmd().\n\nReproducer on netdevsim: add a skip_sw cls_bpf filter, set the\nbpf_tc_accept debugfs knob to 0, then `tc filter replace`. The replace\ncalls tc_setup_cb_replace() which fails. cls_bpf_offload_cmd() then\nswaps prog/oldprog and recursively calls itself to roll back. But\nbpf_tc_accept=0 makes the rollback fail too, which triggers yet another\nrollback frame with the same arguments, and so on until the stack is\nexhausted.\n\nbpf_tc_accept is just a convenient knob for the reproducer. Any driver\nwhose tc_setup_cb_replace() fails twice in a row can hit the same loop,\nso this is not a netdevsim-only issue.\n\nTwo ways to fix it:\n\n 1) Have the rollback call tc_setup_cb_add() on oldprog instead of\n re-entering cls_bpf_offload_cmd().\n 2) Mark the rollback frame with a flag and skip a second-level\n rollback from inside it.\n\nGo with (2). It is the smaller change and keeps the original behaviour:\nthe rollback still goes through tc_setup_cb_replace(), so the driver\ngets one real chance to restore its state. If that attempt also fails,\nwe just return the original error instead of recursing.\n\n[1]: https://lore.kernel.org/bpf/ce5a6005-3c5e-4696-9e05-eba9461dc860@std.uestc.edu.cn/T/#u"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:18:20.179Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a018f208ab7512380bd4cf670064d48cba00a1b1"
},
{
"url": "https://git.kernel.org/stable/c/33373e1f378a501bc51aa73312f74295c84e3101"
},
{
"url": "https://git.kernel.org/stable/c/e2d3b7bab3748c811dc5750ce9a8d62bc7f90ed7"
},
{
"url": "https://git.kernel.org/stable/c/4a76953c3ed043797e81529b9395e9ca6f4c7609"
},
{
"url": "https://git.kernel.org/stable/c/1387f252a242a51bfbb6eace29c8f8db21b457da"
},
{
"url": "https://git.kernel.org/stable/c/10753da2d659dd425a6e620f47f86852d604f67f"
},
{
"url": "https://git.kernel.org/stable/c/3fa6fb5d771c992ebedbfa7331c6bcc6f33f89b7"
},
{
"url": "https://git.kernel.org/stable/c/27db54b90bcc7c37867fe664107fa25ea6a116e4"
}
],
"title": "net/sched: cls_bpf: prevent unbounded recursion in offload rollback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74382",
"datePublished": "2026-08-15T05:58:59.106Z",
"dateReserved": "2026-08-15T05:44:03.890Z",
"dateUpdated": "2026-08-17T05:18:20.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74743 (GCVE-0-2026-74743)
Vulnerability from cvelistv5
Published
2026-08-26 14:36
Modified
2026-10-16 19:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
macvlan: inherit needed_headroom and needed_tailroom from lowerdev
macvlan devices inherit hard_header_len from lowerdev during macvlan_init(),
but leave needed_headroom and needed_tailroom set to 0.
When the underlying lowerdev requires extra headroom or tailroom for
headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx
headroom), upper layers calculating packet headroom and tailroom fail to
reserve sufficient space.
This can result in reallocation overhead, skb headroom underflows, or KASAN
slab-use-after-free crashes when dev_hard_header() / macvlan_hard_header()
prepends header data or when lower devices append tailroom.
Fix this by:
1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init().
2. Propagating needed_headroom and needed_tailroom updates to attached macvlans
in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53 Version: b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53 Version: b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53 Version: b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53 Version: b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53 Version: b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53 Version: b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53 Version: b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74743",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:16:04.634904Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:13.009Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/macvlan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c2ef3f134b069c54b9cc95cce1a16c38c4939336",
"status": "affected",
"version": "b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53",
"versionType": "git"
},
{
"lessThan": "7b0eb3e0f363ca79a3af9efd2e87c6258f11da2b",
"status": "affected",
"version": "b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53",
"versionType": "git"
},
{
"lessThan": "8cd90e850e434577bf6774778657d26d6995e53f",
"status": "affected",
"version": "b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53",
"versionType": "git"
},
{
"lessThan": "28afc87bd8da0b3348bbbd834c8a89e83712cf5e",
"status": "affected",
"version": "b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53",
"versionType": "git"
},
{
"lessThan": "8f6a05dbac05725e0786701eb04778c5bdbe4eaa",
"status": "affected",
"version": "b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53",
"versionType": "git"
},
{
"lessThan": "96fa90b74385b7f2b0d97251dd43d5ee6ca44668",
"status": "affected",
"version": "b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53",
"versionType": "git"
},
{
"lessThan": "bc9a00fb78e32bccc39d763bfd13a450705bac5d",
"status": "affected",
"version": "b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53",
"versionType": "git"
},
{
"lessThan": "cef51860becd9700217c81732ca1eb1ea6ed6fe1",
"status": "affected",
"version": "b863ceb7ddcea8c55fcf1d7b2ac591d50aa7ed53",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/macvlan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: inherit needed_headroom and needed_tailroom from lowerdev\n\nmacvlan devices inherit hard_header_len from lowerdev during macvlan_init(),\nbut leave needed_headroom and needed_tailroom set to 0.\n\nWhen the underlying lowerdev requires extra headroom or tailroom for\nheaders/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx\nheadroom), upper layers calculating packet headroom and tailroom fail to\nreserve sufficient space.\n\nThis can result in reallocation overhead, skb headroom underflows, or KASAN\nslab-use-after-free crashes when dev_hard_header() / macvlan_hard_header()\nprepends header data or when lower devices append tailroom.\n\nFix this by:\n1. Inheriting needed_headroom and needed_tailroom from lowerdev in macvlan_init().\n2. Propagating needed_headroom and needed_tailroom updates to attached macvlans\n in macvlan_device_event() when receiving NETDEV_FEAT_CHANGE events."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug fires on the macvlan transmit path (ip_finish_output2/neigh_resolve_output/macvlan_hard_header) when kernel-generated replies or forwarded traffic egress a macvlan netdev; remote peers trigger this by sending TCP/UDP/ICMP to an address on a pre-configured macvlan interface.\nAC:L - Once macvlan is stacked on a lowerdev with nonzero needed_headroom (WireGuard, MACsec, IPsec, tunnels, veth RX headroom), ordinary packets reliably hit under-reserved skb headroom/tailroom during dev_hard_header() without races or uncontrollable timing.\nPR:N - A remote attacker needs no local account or capabilities; sending routable traffic to a macvlan address suffices. Administrative macvlan setup is environmental (like other netdev CVEs), not an attacker privilege requirement.\nUI:N - Exploitation requires only normal network delivery to a reachable macvlan address; no victim must open files, mount filesystems, or perform any interactive action beyond existing connectivity.\nS:U - Impact is kernel skb heap corruption, slab-use-after-free, or panic within the host network stack; it does not cross VM, IOMMU, or container security boundaries into a separate authority.\nC:H - The fix commit documents KASAN slab-use-after-free from skb headroom underflow during header prepending; this class of kernel heap corruption is exploitable for arbitrary memory disclosure beyond a bounded leak.\nI:H - Insufficient headroom causes skb_push underflows and slab UAF during pskb_expand_head/reallocation, providing kernel heap write primitives that can be leveraged for control-flow hijacking and privilege escalation.\nA:H - The failure mode includes skb_under_panic (kernel BUG/panic) and KASAN-detected slab UAF crashes, causing immediate host kernel denial of service on affected transmit paths."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T10:56:05.561Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c2ef3f134b069c54b9cc95cce1a16c38c4939336"
},
{
"url": "https://git.kernel.org/stable/c/7b0eb3e0f363ca79a3af9efd2e87c6258f11da2b"
},
{
"url": "https://git.kernel.org/stable/c/8cd90e850e434577bf6774778657d26d6995e53f"
},
{
"url": "https://git.kernel.org/stable/c/28afc87bd8da0b3348bbbd834c8a89e83712cf5e"
},
{
"url": "https://git.kernel.org/stable/c/8f6a05dbac05725e0786701eb04778c5bdbe4eaa"
},
{
"url": "https://git.kernel.org/stable/c/96fa90b74385b7f2b0d97251dd43d5ee6ca44668"
},
{
"url": "https://git.kernel.org/stable/c/bc9a00fb78e32bccc39d763bfd13a450705bac5d"
},
{
"url": "https://git.kernel.org/stable/c/cef51860becd9700217c81732ca1eb1ea6ed6fe1"
}
],
"title": "macvlan: inherit needed_headroom and needed_tailroom from lowerdev",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74743",
"datePublished": "2026-08-26T14:36:54.175Z",
"dateReserved": "2026-08-15T05:44:03.930Z",
"dateUpdated": "2026-10-16T19:16:13.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74482 (GCVE-0-2026-74482)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios
__folio_split() keeps dereferencing the mapping after the split:
shmem_uncharge(mapping->host) and remap_page() while the folios are still
frozen/locked, and i_mmap_unlock_read(mapping) at the very end, after the
after-split folios have been unlocked and freed.
Nothing holds an inode reference across that. The split relies on @folio
-- which the beyond-EOF drop loop never removes, as it starts at
folio_next(folio) -- staying locked and in the page cache to hold off
eviction. But the unlock loop unlocks @folio before i_mmap_unlock_read()
runs. If the caller's @lock_at is a tail beyond EOF, as memory_failure()
passes when splitting a poisoned tail of a shmem THP that reaches past
i_size during truncation, it too is gone from the page cache; so once
@folio is unlocked no locked, in-cache folio pins the inode, and a
concurrent final iput() can evict and RCU-free it before
i_mmap_unlock_read() touches i_mmap_rwsem:
BUG: KASAN: slab-use-after-free in __up_read+0x634/0x790
i_mmap_unlock_read include/linux/fs.h:537 [inline]
__folio_split+0x732/0x1640 mm/huge_memory.c:4100
try_to_split_thp_page+0xab/0x390 mm/memory-failure.c:1675
memory_failure+0x1394/0x26e0 mm/memory-failure.c:2470
Freed by task 4601:
shmem_free_in_core_inode+0x54/0xb0 mm/shmem.c:5177
evict+0x57f/0xac0 fs/inode.c:870
Do every mapping dereference while @folio still pins the inode: drop
i_mmap_rwsem right after remap_page(), before the loop that unlocks and
frees the after-split folios, and clear @mapping so the exit path does not
unlock it again. shmem_uncharge() and remap_page() already run before
that point, so after this nothing past the unlock loop touches the inode
or the mapping.
This is now a rule the split depends on, alongside keeping @folio frozen
until the page cache is updated: no inode or mapping dereference once the
after-split folios start being unlocked.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: baa355fd331424526e742d41d9b90d5f9d10f716 Version: baa355fd331424526e742d41d9b90d5f9d10f716 Version: baa355fd331424526e742d41d9b90d5f9d10f716 Version: baa355fd331424526e742d41d9b90d5f9d10f716 Version: baa355fd331424526e742d41d9b90d5f9d10f716 Version: baa355fd331424526e742d41d9b90d5f9d10f716 Version: baa355fd331424526e742d41d9b90d5f9d10f716 Version: baa355fd331424526e742d41d9b90d5f9d10f716 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74482",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:57:49.050841Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:49.129Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/huge_memory.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bc2f5eabaaf60ec18da70b619a8fba1bfb7dea3a",
"status": "affected",
"version": "baa355fd331424526e742d41d9b90d5f9d10f716",
"versionType": "git"
},
{
"lessThan": "f87c08060818ebb19bafed37c38244538da25097",
"status": "affected",
"version": "baa355fd331424526e742d41d9b90d5f9d10f716",
"versionType": "git"
},
{
"lessThan": "6f5c272d71845a669e4c8ee5c72b376e29a0e6e5",
"status": "affected",
"version": "baa355fd331424526e742d41d9b90d5f9d10f716",
"versionType": "git"
},
{
"lessThan": "be106f7855f03d3128ed0ce70ba74b484a90b473",
"status": "affected",
"version": "baa355fd331424526e742d41d9b90d5f9d10f716",
"versionType": "git"
},
{
"lessThan": "e3dd774dbfd0b5bc2dbd0995221751b1234f8205",
"status": "affected",
"version": "baa355fd331424526e742d41d9b90d5f9d10f716",
"versionType": "git"
},
{
"lessThan": "10065fb891651d9541e7a5a2db84c1e656ece4f9",
"status": "affected",
"version": "baa355fd331424526e742d41d9b90d5f9d10f716",
"versionType": "git"
},
{
"lessThan": "d640efe94d86d3be893d4c19220362546a637e90",
"status": "affected",
"version": "baa355fd331424526e742d41d9b90d5f9d10f716",
"versionType": "git"
},
{
"lessThan": "e923bd21058ea02fd0dcd3549d151d143fd036e5",
"status": "affected",
"version": "baa355fd331424526e742d41d9b90d5f9d10f716",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/huge_memory.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios\n\n__folio_split() keeps dereferencing the mapping after the split:\nshmem_uncharge(mapping-\u003ehost) and remap_page() while the folios are still\nfrozen/locked, and i_mmap_unlock_read(mapping) at the very end, after the\nafter-split folios have been unlocked and freed.\n\nNothing holds an inode reference across that. The split relies on @folio\n-- which the beyond-EOF drop loop never removes, as it starts at\nfolio_next(folio) -- staying locked and in the page cache to hold off\neviction. But the unlock loop unlocks @folio before i_mmap_unlock_read()\nruns. If the caller\u0027s @lock_at is a tail beyond EOF, as memory_failure()\npasses when splitting a poisoned tail of a shmem THP that reaches past\ni_size during truncation, it too is gone from the page cache; so once\n@folio is unlocked no locked, in-cache folio pins the inode, and a\nconcurrent final iput() can evict and RCU-free it before\ni_mmap_unlock_read() touches i_mmap_rwsem:\n\n BUG: KASAN: slab-use-after-free in __up_read+0x634/0x790\n i_mmap_unlock_read include/linux/fs.h:537 [inline]\n __folio_split+0x732/0x1640 mm/huge_memory.c:4100\n try_to_split_thp_page+0xab/0x390 mm/memory-failure.c:1675\n memory_failure+0x1394/0x26e0 mm/memory-failure.c:2470\n\n Freed by task 4601:\n shmem_free_in_core_inode+0x54/0xb0 mm/shmem.c:5177\n evict+0x57f/0xac0 fs/inode.c:870\n\nDo every mapping dereference while @folio still pins the inode: drop\ni_mmap_rwsem right after remap_page(), before the loop that unlocks and\nfrees the after-split folios, and clear @mapping so the exit path does not\nunlock it again. shmem_uncharge() and remap_page() already run before\nthat point, so after this nothing past the unlock loop touches the inode\nor the mapping.\n\nThis is now a rule the split depends on, alongside keeping @folio frozen\nuntil the page cache is updated: no inode or mapping dereference once the\nafter-split folios start being unlocked."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is in __folio_split() on the memory_failure()-\u003etry_to_split_thp_page() path while splitting file-backed shmem THPs; reachability is via local syscalls (memfd/mmap/madvise/ftruncate) or admin hwpoison injection, not network or physical interfaces.\nAC:L - An attacker can deterministically create a shmem THP with tail pages beyond EOF and race MADV_HWPOISON-driven memory_failure() against concurrent truncate/close(iput) using attacker-controlled threads; both sides of the race are attacker-driven.\nPR:L - Reliable exploitation uses MADV_HWPOISON to invoke memory_failure() on a chosen tail page; CAP_SYS_ADMIN is available to user-namespace/container root, and the shmem THP setup needs only ordinary local mapping and truncation privileges.\nUI:N - No separate victim action is required; the attacker creates, maps, poisons, and truncates their own memfd/shmem/tmpfs object to reach the vulnerable split path.\nS:U - Impact is a kernel slab use-after-free on inode/mapping metadata in core MM within the same kernel security domain, not a VM escape, sandbox breakout, or other cross-authority boundary violation.\nC:H - KASAN reports slab-use-after-free in i_mmap_unlock_read() after shmem_free_in_core_inode() RCU-frees the inode; this inode/mapping UAF can be heap-sprayed into an arbitrary kernel memory read primitive.\nI:H - The same UAF corrupts freed inode slab objects and i_mmap_rwsem state, enabling heap grooming for arbitrary kernel writes and potential privilege escalation via control-flow hijacking per kernel UAF guidance.\nA:H - The use-after-free provokes a KASAN BUG/oops during i_mmap_unlock_read() and corrupts core MM inode state, capable of kernel panic or hang when triggered on production shmem/tmpfs workloads."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:37:38.544Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bc2f5eabaaf60ec18da70b619a8fba1bfb7dea3a"
},
{
"url": "https://git.kernel.org/stable/c/f87c08060818ebb19bafed37c38244538da25097"
},
{
"url": "https://git.kernel.org/stable/c/6f5c272d71845a669e4c8ee5c72b376e29a0e6e5"
},
{
"url": "https://git.kernel.org/stable/c/be106f7855f03d3128ed0ce70ba74b484a90b473"
},
{
"url": "https://git.kernel.org/stable/c/e3dd774dbfd0b5bc2dbd0995221751b1234f8205"
},
{
"url": "https://git.kernel.org/stable/c/10065fb891651d9541e7a5a2db84c1e656ece4f9"
},
{
"url": "https://git.kernel.org/stable/c/d640efe94d86d3be893d4c19220362546a637e90"
},
{
"url": "https://git.kernel.org/stable/c/e923bd21058ea02fd0dcd3549d151d143fd036e5"
}
],
"title": "mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74482",
"datePublished": "2026-08-15T12:27:15.083Z",
"dateReserved": "2026-08-15T05:44:03.904Z",
"dateUpdated": "2026-10-16T19:05:49.129Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64268 (GCVE-0-2026-64268)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: bound Read Response placement to the RREAD length
In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each
inbound Read Response DDP segment at sge->laddr + wqe->processed and then
accumulates wqe->processed, but it never checks the running total against
the sink buffer length on continuation segments. siw_check_sge() resolves
and validates the sink memory only on the first fragment (the if (!*mem)
branch), and siw_rresp_check_ntoh() compares the cumulative length against
wqe->bytes only on the final segment (the !frx->more_ddp_segs guard).
A connected siw peer that answers an outstanding RREAD with Read Response
segments that keep the DDP Last flag clear, carrying more total payload
than the RREAD requested, drives wqe->processed past the validated sink
buffer; the next siw_rx_data() call writes out of bounds at
sge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP,
so the peer is the remote end of an established RDMA connection and needs
no local privilege.
Bound every segment before placement, exactly as siw_proc_send() and
siw_proc_write() already do for their tagged and untagged paths, and
terminate the connection with a base-or-bounds DDP error when the
Read Response would overrun the sink buffer.
This is the second receive-path length fix for this file. A separate
change rejects an MPA FPDU length that underflows the per-fragment
remainder in the header decode; that guard does not cover this case,
because here each individual segment length is self-consistent and only
the accumulated placement offset overruns the buffer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8b6a361b8c482f22ac99c3273285ff16b23fba91 Version: 8b6a361b8c482f22ac99c3273285ff16b23fba91 Version: 8b6a361b8c482f22ac99c3273285ff16b23fba91 Version: 8b6a361b8c482f22ac99c3273285ff16b23fba91 Version: 8b6a361b8c482f22ac99c3273285ff16b23fba91 Version: 8b6a361b8c482f22ac99c3273285ff16b23fba91 Version: 8b6a361b8c482f22ac99c3273285ff16b23fba91 Version: 8b6a361b8c482f22ac99c3273285ff16b23fba91 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64268",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:38:06.422675Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:16.936Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_qp_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a31b6d18ded3cc32d9ee85a6ff0726d4274887b2",
"status": "affected",
"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
"versionType": "git"
},
{
"lessThan": "595e6537ad1a210da32cbb9a7f91aa73090915ba",
"status": "affected",
"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
"versionType": "git"
},
{
"lessThan": "3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf",
"status": "affected",
"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
"versionType": "git"
},
{
"lessThan": "b2e26c955f8dd7e8d3f16c858db05245ea4fa817",
"status": "affected",
"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
"versionType": "git"
},
{
"lessThan": "6bc89f34a4597f9f6d41f7a60c67a3153bfe8851",
"status": "affected",
"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
"versionType": "git"
},
{
"lessThan": "423a78ff7928c2601013f73ec6d896f5597d0df5",
"status": "affected",
"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
"versionType": "git"
},
{
"lessThan": "75c93cd3c421890f49ea93f0b978b9b7bb10e5e3",
"status": "affected",
"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
"versionType": "git"
},
{
"lessThan": "7d29f7e9dbd844cae4d3e559cf78324b9642fd6b",
"status": "affected",
"version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_qp_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: bound Read Response placement to the RREAD length\n\nIn drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each\ninbound Read Response DDP segment at sge-\u003eladdr + wqe-\u003eprocessed and then\naccumulates wqe-\u003eprocessed, but it never checks the running total against\nthe sink buffer length on continuation segments. siw_check_sge() resolves\nand validates the sink memory only on the first fragment (the if (!*mem)\nbranch), and siw_rresp_check_ntoh() compares the cumulative length against\nwqe-\u003ebytes only on the final segment (the !frx-\u003emore_ddp_segs guard).\n\nA connected siw peer that answers an outstanding RREAD with Read Response\nsegments that keep the DDP Last flag clear, carrying more total payload\nthan the RREAD requested, drives wqe-\u003eprocessed past the validated sink\nbuffer; the next siw_rx_data() call writes out of bounds at\nsge-\u003eladdr + wqe-\u003eprocessed. siw runs iWARP over ordinary routable TCP,\nso the peer is the remote end of an established RDMA connection and needs\nno local privilege.\n\nBound every segment before placement, exactly as siw_proc_send() and\nsiw_proc_write() already do for their tagged and untagged paths, and\nterminate the connection with a base-or-bounds DDP error when the\nRead Response would overrun the sink buffer.\n\nThis is the second receive-path length fix for this file. A separate\nchange rejects an MPA FPDU length that underflows the per-fragment\nremainder in the header decode; that guard does not cover this case,\nbecause here each individual segment length is self-consistent and only\nthe accumulated placement offset overruns the buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - siw carries iWARP over ordinary routable TCP, and the vulnerable receive callback processes crafted Read Response FPDUs from the remote endpoint of an established RDMA connection.\nAC:L - The peer learns the sink tag, address, and length from the RREAD and can deterministically send oversized continuation segments; no race or uncontrollable condition is required.\nPR:N - The MPA/siw data path performs no credential or capability check on the connected peer, and an unauthenticated RDMA service can accept the connection and issue attacker-induced RREADs.\nUI:N - The overflow is triggered through an automated RDMA protocol exchange and requires no human action.\nS:U - The corruption compromises resources within the affected host\u0027s kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The global DMA/KVA sink case exposes the sink address and permits attacker-controlled kernel memory corruption, which can enable control-flow hijacking and arbitrary kernel-memory disclosure.\nI:H - Attacker-chosen response bytes are written beyond the validated sink into adjacent kernel memory, providing an exploitable out-of-bounds write capable of modifying objects or achieving kernel code execution.\nA:H - The overwrite can corrupt critical kernel objects or reach invalid memory, causing an oops or panic; bounded FRWR sinks still permit connection-terminating denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:22.293Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2"
},
{
"url": "https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba"
},
{
"url": "https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf"
},
{
"url": "https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817"
},
{
"url": "https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851"
},
{
"url": "https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5"
},
{
"url": "https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3"
},
{
"url": "https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b"
}
],
"title": "RDMA/siw: bound Read Response placement to the RREAD length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64268",
"datePublished": "2026-07-25T08:49:16.336Z",
"dateReserved": "2026-07-19T15:36:31.775Z",
"dateUpdated": "2026-10-19T20:28:16.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64098 (GCVE-0-2026-64098)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: use uninterruptible resv lock for plane updates
virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock
the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv() and
ignore its return value. The function can fail with -EINTR from
dma_resv_lock_interruptible() (signal during lock wait) or with
-ENOMEM from dma_resv_reserve_fences() (fence slot allocation),
leaving the resv lock not held. The queue path then walks the object
array and calls dma_resv_add_fence(), which requires the lock held;
with lockdep enabled this trips dma_resv_assert_held():
WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840
Call Trace:
virtio_gpu_array_add_fence
virtio_gpu_queue_ctrl_sgs
virtio_gpu_queue_fenced_ctrl_buffer
virtio_gpu_cursor_plane_update
drm_atomic_helper_commit_planes
drm_atomic_helper_commit_tail
commit_tail
drm_atomic_helper_commit
drm_atomic_commit
drm_atomic_helper_update_plane
__setplane_atomic
drm_mode_cursor_universal
drm_mode_cursor_common
drm_mode_cursor_ioctl
drm_ioctl
__x64_sys_ioctl
Beyond the WARN, mutating the dma_resv fence list without the lock
races with concurrent readers/writers and can corrupt the list.
Both call sites run inside the .atomic_update plane callback, which
DRM atomic helpers do not allow to fail (by the time it runs, the
commit has been signed off to userspace and there is no clean
rollback path). Moving the lock acquisition to .prepare_fb was
rejected because the broader lock scope deadlocks against other BO
locking paths in the same atomic commit.
Introduce virtio_gpu_lock_one_resv_uninterruptible() that uses
dma_resv_lock() instead of dma_resv_lock_interruptible(). This
eliminates the -EINTR failure mode -- the realistic syzbot trigger
-- without extending the lock hold across the commit. The helper
locks a single BO and rejects nents > 1 with -EINVAL; both fix
sites lock exactly one BO.
Use it from virtio_gpu_cursor_plane_update() and
virtio_gpu_resource_flush(); check the return value to handle the
remaining -ENOMEM case from dma_resv_reserve_fences() by freeing
the objs and skipping the plane update for that frame. The
framebuffer BOs touched here are not shared with other contexts
and lock contention is expected to be brief, so the loss of
signal-interruptibility is acceptable.
Other callers of virtio_gpu_array_lock_resv() (the ioctl paths)
continue to use the interruptible variant.
The bug was reported by syzbot, triggered via fault injection
(fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the
-ENOMEM branch in dma_resv_reserve_fences().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 Version: 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 Version: 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 Version: 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 Version: 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 Version: 5cfd31c5b3a321aed0c9621b7b45efa2942056f8 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:36:16.269056Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:11.749Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_drv.h",
"drivers/gpu/drm/virtio/virtgpu_gem.c",
"drivers/gpu/drm/virtio/virtgpu_plane.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c86077d512ee980cc91322211d35dbcd3175f64c",
"status": "affected",
"version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
"versionType": "git"
},
{
"lessThan": "21ab64c77a30d56efc506c8fa2ad8959f8ce3d36",
"status": "affected",
"version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
"versionType": "git"
},
{
"lessThan": "7930eee22cd3df61e85be8aa512032ab303b7167",
"status": "affected",
"version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
"versionType": "git"
},
{
"lessThan": "8fadd01cf461fee5bb11506621339c548447e5c7",
"status": "affected",
"version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
"versionType": "git"
},
{
"lessThan": "a2359a411b15f495d12cfda6a7db6855ebb7f90f",
"status": "affected",
"version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
"versionType": "git"
},
{
"lessThan": "9af1b6e175c82daf4b423da339a722d8e67a735a",
"status": "affected",
"version": "5cfd31c5b3a321aed0c9621b7b45efa2942056f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_drv.h",
"drivers/gpu/drm/virtio/virtgpu_gem.c",
"drivers/gpu/drm/virtio/virtgpu_plane.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: use uninterruptible resv lock for plane updates\n\nvirtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock\nthe framebuffer BO\u0027s dma_resv via virtio_gpu_array_lock_resv() and\nignore its return value. The function can fail with -EINTR from\ndma_resv_lock_interruptible() (signal during lock wait) or with\n-ENOMEM from dma_resv_reserve_fences() (fence slot allocation),\nleaving the resv lock not held. The queue path then walks the object\narray and calls dma_resv_add_fence(), which requires the lock held;\nwith lockdep enabled this trips dma_resv_assert_held():\n\n WARNING: drivers/dma-buf/dma-resv.c:296 at dma_resv_add_fence+0x71e/0x840\n Call Trace:\n virtio_gpu_array_add_fence\n virtio_gpu_queue_ctrl_sgs\n virtio_gpu_queue_fenced_ctrl_buffer\n virtio_gpu_cursor_plane_update\n drm_atomic_helper_commit_planes\n drm_atomic_helper_commit_tail\n commit_tail\n drm_atomic_helper_commit\n drm_atomic_commit\n drm_atomic_helper_update_plane\n __setplane_atomic\n drm_mode_cursor_universal\n drm_mode_cursor_common\n drm_mode_cursor_ioctl\n drm_ioctl\n __x64_sys_ioctl\n\nBeyond the WARN, mutating the dma_resv fence list without the lock\nraces with concurrent readers/writers and can corrupt the list.\n\nBoth call sites run inside the .atomic_update plane callback, which\nDRM atomic helpers do not allow to fail (by the time it runs, the\ncommit has been signed off to userspace and there is no clean\nrollback path). Moving the lock acquisition to .prepare_fb was\nrejected because the broader lock scope deadlocks against other BO\nlocking paths in the same atomic commit.\n\nIntroduce virtio_gpu_lock_one_resv_uninterruptible() that uses\ndma_resv_lock() instead of dma_resv_lock_interruptible(). This\neliminates the -EINTR failure mode -- the realistic syzbot trigger\n-- without extending the lock hold across the commit. The helper\nlocks a single BO and rejects nents \u003e 1 with -EINVAL; both fix\nsites lock exactly one BO.\n\nUse it from virtio_gpu_cursor_plane_update() and\nvirtio_gpu_resource_flush(); check the return value to handle the\nremaining -ENOMEM case from dma_resv_reserve_fences() by freeing\nthe objs and skipping the plane update for that frame. The\nframebuffer BOs touched here are not shared with other contexts\nand lock contention is expected to be brief, so the loss of\nsignal-interruptibility is acceptable.\n\nOther callers of virtio_gpu_array_lock_resv() (the ioctl paths)\ncontinue to use the interruptible variant.\n\nThe bug was reported by syzbot, triggered via fault injection\n(fail_nth) on the DRM_IOCTL_MODE_CURSOR path, which forces the\n-ENOMEM branch in dma_resv_reserve_fences()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached only through local DRM ioctl syscalls (DRM_IOCTL_MODE_CURSOR and DRM_MASTER modesetting ioctls) on /dev/dri/card0, not via any network-facing kernel service.\nAC:L - An attacker can reliably trigger the bug by signaling a thread blocked in dma_resv_lock_interruptible (-EINTR), forcing memory pressure for -ENOMEM, or running concurrent plane updates to race the unlocked fence-list mutation.\nPR:L - Exploitation requires DRM master on the virtio-gpu device, which a local user with standard DRI access (video/render group membership on typical virtio-gpu VMs) can obtain when no compositor holds master; this is not init-namespace root.\nUI:N - Triggering the bug requires only attacker-initiated DRM ioctl calls (cursor/plane updates); no action by another user or victim is needed.\nS:U - The corruption occurs within the same kernel security domain (guest or host) that issued the ioctl; virtio-gpu runs in the guest kernel and this does not cross a VM/hypervisor boundary to the host.\nC:H - Mutating the dma_resv fence list without holding the lock races with concurrent readers and can corrupt kernel heap metadata, which is reasonably leverageable for arbitrary memory disclosure.\nI:H - The same unlocked fence-list corruption can corrupt kernel pointers and synchronization state, providing a plausible path to arbitrary kernel writes or control-flow hijacking.\nA:H - The bug produces kernel WARN/oops under lockdep and fence-list corruption can cause kernel crashes, hangs, or panics during subsequent dma_resv operations."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:12.587Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c86077d512ee980cc91322211d35dbcd3175f64c"
},
{
"url": "https://git.kernel.org/stable/c/21ab64c77a30d56efc506c8fa2ad8959f8ce3d36"
},
{
"url": "https://git.kernel.org/stable/c/7930eee22cd3df61e85be8aa512032ab303b7167"
},
{
"url": "https://git.kernel.org/stable/c/8fadd01cf461fee5bb11506621339c548447e5c7"
},
{
"url": "https://git.kernel.org/stable/c/a2359a411b15f495d12cfda6a7db6855ebb7f90f"
},
{
"url": "https://git.kernel.org/stable/c/9af1b6e175c82daf4b423da339a722d8e67a735a"
}
],
"title": "drm/virtio: use uninterruptible resv lock for plane updates",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64098",
"datePublished": "2026-07-19T15:40:04.264Z",
"dateReserved": "2026-07-19T07:54:57.033Z",
"dateUpdated": "2026-10-19T20:28:11.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68410 (GCVE-0-2026-68410)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-08-19 16:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: libertas: fix memory leak in helper_firmware_cb()
helper_firmware_cb() neglects to free the single-stage firmware image
after a successful async load, leading to a memory leak in the USB
firmware-download path.
Fix this memory leak by calling release_firmware() immediately after
lbs_fw_loaded() returns.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still present in
the current wireless tree.
An x86_64 allyesconfig build showed no new warnings. As we do not have
compatible Libertas USB hardware for exercising this firmware-download
path, no runtime testing was able to be performed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1dfba3060fe7ee03ccec25a91d35085142dfc295 Version: 1dfba3060fe7ee03ccec25a91d35085142dfc295 Version: 1dfba3060fe7ee03ccec25a91d35085142dfc295 Version: 1dfba3060fe7ee03ccec25a91d35085142dfc295 Version: 1dfba3060fe7ee03ccec25a91d35085142dfc295 Version: 1dfba3060fe7ee03ccec25a91d35085142dfc295 Version: 1dfba3060fe7ee03ccec25a91d35085142dfc295 Version: 1dfba3060fe7ee03ccec25a91d35085142dfc295 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/libertas/firmware.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c1f54a04813676c5a2150d99331c8d21f199374",
"status": "affected",
"version": "1dfba3060fe7ee03ccec25a91d35085142dfc295",
"versionType": "git"
},
{
"lessThan": "7f28722b3e4e0c8d49c859fea4a9b1fa13b5ae06",
"status": "affected",
"version": "1dfba3060fe7ee03ccec25a91d35085142dfc295",
"versionType": "git"
},
{
"lessThan": "ce829286f4935f1eb6b5dcb64da02910ce149c76",
"status": "affected",
"version": "1dfba3060fe7ee03ccec25a91d35085142dfc295",
"versionType": "git"
},
{
"lessThan": "d497b7566e74920acfe283dd6b2cbf1682890796",
"status": "affected",
"version": "1dfba3060fe7ee03ccec25a91d35085142dfc295",
"versionType": "git"
},
{
"lessThan": "eaeb1d74a47fc4864f2c754c0b9d654a9b7dc55c",
"status": "affected",
"version": "1dfba3060fe7ee03ccec25a91d35085142dfc295",
"versionType": "git"
},
{
"lessThan": "6cda91bbb8dc3d22ef0323008a12dcf73a5129da",
"status": "affected",
"version": "1dfba3060fe7ee03ccec25a91d35085142dfc295",
"versionType": "git"
},
{
"lessThan": "644640cde2fb216e6567de5eee780a38dbc95928",
"status": "affected",
"version": "1dfba3060fe7ee03ccec25a91d35085142dfc295",
"versionType": "git"
},
{
"lessThan": "63c2391deefb31e1b801b7f32bd502ca4808639b",
"status": "affected",
"version": "1dfba3060fe7ee03ccec25a91d35085142dfc295",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/libertas/firmware.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix memory leak in helper_firmware_cb()\n\nhelper_firmware_cb() neglects to free the single-stage firmware image\nafter a successful async load, leading to a memory leak in the USB\nfirmware-download path.\n\nFix this memory leak by calling release_firmware() immediately after\nlbs_fw_loaded() returns.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still present in\nthe current wireless tree.\n\nAn x86_64 allyesconfig build showed no new warnings. As we do not have\ncompatible Libertas USB hardware for exercising this firmware-download\npath, no runtime testing was able to be performed."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:35:04.634Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c1f54a04813676c5a2150d99331c8d21f199374"
},
{
"url": "https://git.kernel.org/stable/c/7f28722b3e4e0c8d49c859fea4a9b1fa13b5ae06"
},
{
"url": "https://git.kernel.org/stable/c/ce829286f4935f1eb6b5dcb64da02910ce149c76"
},
{
"url": "https://git.kernel.org/stable/c/d497b7566e74920acfe283dd6b2cbf1682890796"
},
{
"url": "https://git.kernel.org/stable/c/eaeb1d74a47fc4864f2c754c0b9d654a9b7dc55c"
},
{
"url": "https://git.kernel.org/stable/c/6cda91bbb8dc3d22ef0323008a12dcf73a5129da"
},
{
"url": "https://git.kernel.org/stable/c/644640cde2fb216e6567de5eee780a38dbc95928"
},
{
"url": "https://git.kernel.org/stable/c/63c2391deefb31e1b801b7f32bd502ca4808639b"
}
],
"title": "wifi: libertas: fix memory leak in helper_firmware_cb()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68410",
"datePublished": "2026-08-10T12:04:30.194Z",
"dateReserved": "2026-07-30T09:28:09.390Z",
"dateUpdated": "2026-08-19T16:35:04.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74673 (GCVE-0-2026-74673)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-08-25 05:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: evdev - fix information leak in evdev_pass_values()
In evdev_pass_values(), the input_event structure is allocated on the
kernel stack and populated field-by-field. However, it is never fully
initialized. On architectures where struct input_event contains explicit
or implicit padding (such as the 32-bit __pad field on SPARC64), these
padding bytes are left uninitialized.
When this event structure is subsequently passed to the client buffer
and later copied to userspace, the uninitialized padding bytes leak
kernel stack memory, potentially exposing sensitive information.
Similar issues exist in __evdev_queue_syn_dropped and __pass_event.
Fix this by explicitly zeroing the entire event structure with memset()
before populating its fields. This ensures all padding bytes are cleared
before the data crosses the security boundary.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 Version: 6addb1d6de1968b84852f54561cc9a999909b5a9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/evdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d2e3839419ac4047835762c4d7712bda1101b57e",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "c6d5fa46c1ee25d068fc730fd377f0f54188d290",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "e748811d9b80a3e101110ff4b3c612e5fca54d98",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "06a286b320236508d02ab2ccc9496352748652a8",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "7d17e9454a9af3ec7aebb88b41a9deedd5b19a6b",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "bd3c4108a56de34380edab670065e86283cb3029",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "7e55ca1080f09d9f7112c7f20ac31f682c1f2374",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
},
{
"lessThan": "90f305f2c7a30257c683e13f4bf7c798eea992a0",
"status": "affected",
"version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/evdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: evdev - fix information leak in evdev_pass_values()\n\nIn evdev_pass_values(), the input_event structure is allocated on the\nkernel stack and populated field-by-field. However, it is never fully\ninitialized. On architectures where struct input_event contains explicit\nor implicit padding (such as the 32-bit __pad field on SPARC64), these\npadding bytes are left uninitialized.\n\nWhen this event structure is subsequently passed to the client buffer\nand later copied to userspace, the uninitialized padding bytes leak\nkernel stack memory, potentially exposing sensitive information.\n\nSimilar issues exist in __evdev_queue_syn_dropped and __pass_event.\n\nFix this by explicitly zeroing the entire event structure with memset()\nbefore populating its fields. This ensures all padding bytes are cleared\nbefore the data crosses the security boundary."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:23:15.607Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d2e3839419ac4047835762c4d7712bda1101b57e"
},
{
"url": "https://git.kernel.org/stable/c/c6d5fa46c1ee25d068fc730fd377f0f54188d290"
},
{
"url": "https://git.kernel.org/stable/c/e748811d9b80a3e101110ff4b3c612e5fca54d98"
},
{
"url": "https://git.kernel.org/stable/c/06a286b320236508d02ab2ccc9496352748652a8"
},
{
"url": "https://git.kernel.org/stable/c/7d17e9454a9af3ec7aebb88b41a9deedd5b19a6b"
},
{
"url": "https://git.kernel.org/stable/c/bd3c4108a56de34380edab670065e86283cb3029"
},
{
"url": "https://git.kernel.org/stable/c/7e55ca1080f09d9f7112c7f20ac31f682c1f2374"
},
{
"url": "https://git.kernel.org/stable/c/90f305f2c7a30257c683e13f4bf7c798eea992a0"
}
],
"title": "Input: evdev - fix information leak in evdev_pass_values()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74673",
"datePublished": "2026-08-22T15:32:42.941Z",
"dateReserved": "2026-08-15T05:44:03.925Z",
"dateUpdated": "2026-08-25T05:23:15.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64015 (GCVE-0-2026-64015)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
security/keys: fix missed RCU read section on lookup
Nicholas Carlini reports that the keyring code calls assoc_array_find()
in find_key_to_update() without holding the RCU read lock, while the
assoc_array_gc() code really is designed around removing the node from
the tree and then freeing it after an RCU grace-period.
The regular key handling doesn't see this because holding the keyring
semaphore hides any lifetime issues, but the persistent key handling
uses a different model.
Instead of extending the keyring locking, just do the simple RCU locking
that the assoc_array was designed for.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 Version: b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 Version: b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 Version: b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 Version: b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 Version: b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64015",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:17.736168Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:08.372Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/keys/keyring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4c5d407ba3ff7f30561ff73ba1b07ed70c864edc",
"status": "affected",
"version": "b2a4df200d570b2c33a57e1ebfa5896e4bc81b69",
"versionType": "git"
},
{
"lessThan": "cefa4265b11176c897a7d9e8e54d89e3701c5584",
"status": "affected",
"version": "b2a4df200d570b2c33a57e1ebfa5896e4bc81b69",
"versionType": "git"
},
{
"lessThan": "5659e6923cb72f8e18e8b539109ab512455fe195",
"status": "affected",
"version": "b2a4df200d570b2c33a57e1ebfa5896e4bc81b69",
"versionType": "git"
},
{
"lessThan": "50bb3435a5e627bfbdc52eb4536f49f88b3486b8",
"status": "affected",
"version": "b2a4df200d570b2c33a57e1ebfa5896e4bc81b69",
"versionType": "git"
},
{
"lessThan": "66288dcadf80974436250e9f70ed848836b835b5",
"status": "affected",
"version": "b2a4df200d570b2c33a57e1ebfa5896e4bc81b69",
"versionType": "git"
},
{
"lessThan": "43a1e3744548e6fd85873e6fb43e293eb4010694",
"status": "affected",
"version": "b2a4df200d570b2c33a57e1ebfa5896e4bc81b69",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/keys/keyring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsecurity/keys: fix missed RCU read section on lookup\n\nNicholas Carlini reports that the keyring code calls assoc_array_find()\nin find_key_to_update() without holding the RCU read lock, while the\nassoc_array_gc() code really is designed around removing the node from\nthe tree and then freeing it after an RCU grace-period.\n\nThe regular key handling doesn\u0027t see this because holding the keyring\nsemaphore hides any lifetime issues, but the persistent key handling\nuses a different model.\n\nInstead of extending the keyring locking, just do the simple RCU locking\nthat the assoc_array was designed for."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through find_key_to_update() on the persistent keyring register, which is invoked from keyctl_get_persistent() via the keyctl(2) syscall. There is no network, adjacent-radio, or physical-device path to this code.\nAC:L - Exploitation is a race between assoc_array_find() and assoc_array_gc() on the .persistent_register keyring; the attacker controls both sides by repeatedly calling KEYCTL_GET_PERSISTENT (including from multiple threads) while driving key expiry/GC via keyctl timeouts or natural garbage collection. Per kernel guidance, attacker-controlled races are AC:L.\nPR:L - Any unprivileged local user who can invoke keyctl() can call KEYCTL_GET_PERSISTENT for their own UID (-1) with a writable destination keyring (e.g., session keyring). No real-root or CAP_SETUID capability is required for the vulnerable lookup path; this remains PR:L even inside user namespaces.\nUI:N - Exploitation requires only the attacker\u0027s own keyctl syscalls and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary on its own.\nC:H - assoc_array_find() is documented to require an RCU read lock, but the persistent-keyring path called it without one while assoc_array_gc() frees tree nodes via call_rcu(), yielding a use-after-free on assoc_array nodes/leaves. UAF on kernel heap objects can be turned into arbitrary kernel memory reads.\nI:H - The freed assoc_array nodes can be reallocated and corrupted through concurrent GC versus lookup, providing a standard kernel heap UAF primitive that can be developed into arbitrary write or code-execution primitives.\nA:H - Dereferencing RCU-freed assoc_array tree nodes during lookup can cause kernel oops/panic from invalid pointer access, and UAF exploitation commonly destabilizes or crashes the kernel even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:12.353Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4c5d407ba3ff7f30561ff73ba1b07ed70c864edc"
},
{
"url": "https://git.kernel.org/stable/c/cefa4265b11176c897a7d9e8e54d89e3701c5584"
},
{
"url": "https://git.kernel.org/stable/c/5659e6923cb72f8e18e8b539109ab512455fe195"
},
{
"url": "https://git.kernel.org/stable/c/50bb3435a5e627bfbdc52eb4536f49f88b3486b8"
},
{
"url": "https://git.kernel.org/stable/c/66288dcadf80974436250e9f70ed848836b835b5"
},
{
"url": "https://git.kernel.org/stable/c/43a1e3744548e6fd85873e6fb43e293eb4010694"
}
],
"title": "security/keys: fix missed RCU read section on lookup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64015",
"datePublished": "2026-07-19T15:39:10.557Z",
"dateReserved": "2026-07-19T07:54:57.027Z",
"dateUpdated": "2026-10-19T20:28:08.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63801 (GCVE-0-2026-63801)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-10-19 20:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done
tipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to
crypto_aead_decrypt(req) without taking a reference on the netns, unlike
the encrypt path. When crypto_aead_decrypt() is offloaded asynchronously
(e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs
tipc_aead_decrypt_done() later. If the bearer's netns is torn down in the
meantime, cleanup_net() -> tipc_exit_net() -> tipc_crypto_stop() frees the
per-netns tipc_crypto, and the completion then reads it:
tipc_aead_decrypt_done() dereferences aead->crypto->stats and
aead->crypto->net, and tipc_crypto_rcv_complete() dereferences
aead->crypto->aead[] and the node table -- reading freed memory.
Decoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO):
BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999)
Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51
Workqueue: events_unbound
Call Trace:
tipc_aead_decrypt_done (net/tipc/crypto.c:999)
process_one_work (kernel/workqueue.c:3314)
worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Allocated by task 169:
__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
tipc_crypto_start (net/tipc/crypto.c:1502)
tipc_init_net (net/tipc/core.c:72)
ops_init (net/core/net_namespace.c:137)
setup_net (net/core/net_namespace.c:446)
copy_net_ns (net/core/net_namespace.c:579)
create_new_namespaces (kernel/nsproxy.c:132)
__x64_sys_unshare (kernel/fork.c:3316)
do_syscall_64 (arch/x86/entry/syscall_64.c:63)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Freed by task 8:
kfree (mm/slub.c:6566)
tipc_exit_net (net/tipc/core.c:119)
cleanup_net (net/core/net_namespace.c:704)
process_one_work (kernel/workqueue.c:3314)
kthread (kernel/kthread.c:436)
This is the same class of bug that commit e279024617134 ("net/tipc: fix
slab-use-after-free Read in tipc_aead_encrypt_done") fixed for the encrypt
side. The encrypt path takes maybe_get_net(aead->crypto->net) before
crypto_aead_encrypt() and drops it with put_net() on the synchronous
return paths and in tipc_aead_encrypt_done(); the -EINPROGRESS/-EBUSY
return keeps the reference for the async callback to release. The decrypt
path was left without the equivalent guard.
Mirror the encrypt-side fix on the decrypt path: take a net reference
before crypto_aead_decrypt() (failing with -ENODEV and the matching
bearer put if it cannot be acquired), keep it across the
-EINPROGRESS/-EBUSY async return, and drop it with put_net() on the
synchronous success/error return and at the end of
tipc_aead_decrypt_done().
Reproduced under KASAN on v7.1-rc7: a UDP bearer with a cluster key is
flooded with crafted encrypted frames from an unknown peer (driving the
cluster-key decrypt path) while the bearer's netns is repeatedly torn
down. The completion must run asynchronously to outlive
tipc_crypto_stop(); on x86 the stock aesni gcm(aes) now decrypts
synchronously, so the async path was exercised via cryptd offload. The
unguarded aead->crypto dereference in tipc_aead_decrypt_done() is the
unpatched upstream path; tipc_aead_decrypt() still lacks
maybe_get_net(aead->crypto->net), so the completion can outlive the free
on any config where crypto_aead_decrypt() goes async.
Found by 0sec automated security-research tooling (https://0sec.ai).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 Version: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 Version: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 Version: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 Version: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 Version: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 Version: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 Version: fc1b6d6de2208774efd2a20bf0daddb02d18b1e0 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63801",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:30:43.559887Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:07:47.669Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/crypto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "171d31245d11bf84836fad3b394cb465a4d008ec",
"status": "affected",
"version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
"versionType": "git"
},
{
"lessThan": "2d1f21419ec121232c916d3a3fc9b6766473a0e7",
"status": "affected",
"version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
"versionType": "git"
},
{
"lessThan": "0a780653b2a7569a7af9be7d0b00b1251baca63a",
"status": "affected",
"version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
"versionType": "git"
},
{
"lessThan": "eaca7dae02fab70c8d223cffe03cec1b93249ce2",
"status": "affected",
"version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
"versionType": "git"
},
{
"lessThan": "dca7713fe044a2067387948557ea099056e1679e",
"status": "affected",
"version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
"versionType": "git"
},
{
"lessThan": "e18769616fd5a90ec1e12aabbba544c488284292",
"status": "affected",
"version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
"versionType": "git"
},
{
"lessThan": "1eea5e1820a2f5164d706bd1277bc97ff31ce32d",
"status": "affected",
"version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
"versionType": "git"
},
{
"lessThan": "bda3348872a2ef0d19f2df6aa8cb5025adce2f20",
"status": "affected",
"version": "fc1b6d6de2208774efd2a20bf0daddb02d18b1e0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/crypto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix slab-use-after-free Read in tipc_aead_decrypt_done\n\ntipc_aead_decrypt() goes straight from tipc_bearer_hold(b) to\ncrypto_aead_decrypt(req) without taking a reference on the netns, unlike\nthe encrypt path. When crypto_aead_decrypt() is offloaded asynchronously\n(e.g. the SIMD aead wrapper queuing to cryptd), the cryptd worker runs\ntipc_aead_decrypt_done() later. If the bearer\u0027s netns is torn down in the\nmeantime, cleanup_net() -\u003e tipc_exit_net() -\u003e tipc_crypto_stop() frees the\nper-netns tipc_crypto, and the completion then reads it:\ntipc_aead_decrypt_done() dereferences aead-\u003ecrypto-\u003estats and\naead-\u003ecrypto-\u003enet, and tipc_crypto_rcv_complete() dereferences\naead-\u003ecrypto-\u003eaead[] and the node table -- reading freed memory.\n\nDecoded KASAN splat (v7.1-rc7, CONFIG_KASAN_INLINE + TIPC + TIPC_CRYPTO):\n\n BUG: KASAN: slab-use-after-free in tipc_aead_decrypt_done (net/tipc/crypto.c:999)\n Read of size 8 at addr ffff8881056258a8 by task kworker/u16:2/51\n Workqueue: events_unbound\n Call Trace:\n tipc_aead_decrypt_done (net/tipc/crypto.c:999)\n process_one_work (kernel/workqueue.c:3314)\n worker_thread (kernel/workqueue.c:3397 kernel/workqueue.c:3478)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\n Allocated by task 169:\n __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)\n tipc_crypto_start (net/tipc/crypto.c:1502)\n tipc_init_net (net/tipc/core.c:72)\n ops_init (net/core/net_namespace.c:137)\n setup_net (net/core/net_namespace.c:446)\n copy_net_ns (net/core/net_namespace.c:579)\n create_new_namespaces (kernel/nsproxy.c:132)\n __x64_sys_unshare (kernel/fork.c:3316)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\n Freed by task 8:\n kfree (mm/slub.c:6566)\n tipc_exit_net (net/tipc/core.c:119)\n cleanup_net (net/core/net_namespace.c:704)\n process_one_work (kernel/workqueue.c:3314)\n kthread (kernel/kthread.c:436)\n\nThis is the same class of bug that commit e279024617134 (\"net/tipc: fix\nslab-use-after-free Read in tipc_aead_encrypt_done\") fixed for the encrypt\nside. The encrypt path takes maybe_get_net(aead-\u003ecrypto-\u003enet) before\ncrypto_aead_encrypt() and drops it with put_net() on the synchronous\nreturn paths and in tipc_aead_encrypt_done(); the -EINPROGRESS/-EBUSY\nreturn keeps the reference for the async callback to release. The decrypt\npath was left without the equivalent guard.\n\nMirror the encrypt-side fix on the decrypt path: take a net reference\nbefore crypto_aead_decrypt() (failing with -ENODEV and the matching\nbearer put if it cannot be acquired), keep it across the\n-EINPROGRESS/-EBUSY async return, and drop it with put_net() on the\nsynchronous success/error return and at the end of\ntipc_aead_decrypt_done().\n\nReproduced under KASAN on v7.1-rc7: a UDP bearer with a cluster key is\nflooded with crafted encrypted frames from an unknown peer (driving the\ncluster-key decrypt path) while the bearer\u0027s netns is repeatedly torn\ndown. The completion must run asynchronously to outlive\ntipc_crypto_stop(); on x86 the stock aesni gcm(aes) now decrypts\nsynchronously, so the async path was exercised via cryptd offload. The\nunguarded aead-\u003ecrypto dereference in tipc_aead_decrypt_done() is the\nunpatched upstream path; tipc_aead_decrypt() still lacks\nmaybe_get_net(aead-\u003ecrypto-\u003enet), so the completion can outlive the free\non any config where crypto_aead_decrypt() goes async.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is reached from the TIPC packet receive path (UDP bearer on port 6118 or L2 bearer) when encrypted frames arrive from a remote peer; no local syscall is required to enter tipc_aead_decrypt().\nAC:L - The attacker can reliably win the race by flooding packets to queue async decrypt completions while repeatedly destroying the network namespace; the repro demonstrates full control of both sides of the timing window.\nPR:L - Reliable exploitation is demonstrated via unshare-created user/network namespaces where the attacker gains CAP_NET_ADMIN-equivalent control to configure TIPC crypto and cycle namespace teardown, which per kernel CNA guidance maps to Low rather than High.\nUI:N - Exploitation requires only sending network packets and namespace lifecycle manipulation; no victim user action such as opening a file or mounting a filesystem is needed.\nS:U - Impact is confined to kernel memory within the same security authority; this is a standard kernel UAF/privilege-escalation class bug, not a VM escape or cross-authority boundary bypass.\nC:H - The UAF reads freed slab memory including aead-\u003ecrypto-\u003estats, aead-\u003ecrypto-\u003enet, and aead[] pointers in tipc_crypto_rcv_complete, enabling arbitrary kernel memory disclosure via controlled reuse of the freed tipc_crypto object.\nI:H - Use-after-free of tipc_crypto structures can be leveraged for heap spraying and arbitrary write primitives, and tipc_crypto_rcv_complete continues processing with freed pointers including key attachment and node table operations.\nA:H - KASAN confirmed slab-use-after-free in tipc_aead_decrypt_done on a workqueue thread; UAF on this path causes kernel oops/panic even when not fully exploited for code execution."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:06.693Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/171d31245d11bf84836fad3b394cb465a4d008ec"
},
{
"url": "https://git.kernel.org/stable/c/2d1f21419ec121232c916d3a3fc9b6766473a0e7"
},
{
"url": "https://git.kernel.org/stable/c/0a780653b2a7569a7af9be7d0b00b1251baca63a"
},
{
"url": "https://git.kernel.org/stable/c/eaca7dae02fab70c8d223cffe03cec1b93249ce2"
},
{
"url": "https://git.kernel.org/stable/c/dca7713fe044a2067387948557ea099056e1679e"
},
{
"url": "https://git.kernel.org/stable/c/e18769616fd5a90ec1e12aabbba544c488284292"
},
{
"url": "https://git.kernel.org/stable/c/1eea5e1820a2f5164d706bd1277bc97ff31ce32d"
},
{
"url": "https://git.kernel.org/stable/c/bda3348872a2ef0d19f2df6aa8cb5025adce2f20"
}
],
"title": "tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63801",
"datePublished": "2026-07-19T12:02:07.457Z",
"dateReserved": "2026-07-19T07:54:57.013Z",
"dateUpdated": "2026-10-19T20:07:47.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64137 (GCVE-0-2026-64137)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-08-05 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: require net admin for CIFS SWN netlink
CIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The
intended sender is the cifs.witness helper, but the generic-netlink
operation currently has no capability flag, so any local process can send
RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness
handler.
The same family exposes CIFS_GENL_MCGRP_SWN without multicast-group
capability flags. Register messages sent to that group include the witness
registration id and, for NTLM-authenticated mounts, the username, domain,
and password attributes copied from the CIFS session. An unprivileged
local process should not be able to join that group and receive those
messages.
Require CAP_NET_ADMIN for incoming SWN_NOTIFY commands with
GENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for
joining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The
cifs.witness service runs with the privileges needed for both operations.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9cf7eb8919344932f909b2fac76296f7656fda8d",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "9919021a3b7974ae66a5f9915e3a48c10cfd409b",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "969bc6370334a5b4720c5470783295d6484bbc95",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "a3238b09c58f323e40743ce174cd0ab81b5c09ed",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "a8d17d22db591099519a89f14dd24810daba74c3",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "c2397b93fbb6f44a788fff30f99be2c20cc5e50f",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "d1ebfce2c1d161186a82e77590bf7da2ea1bce91",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: require net admin for CIFS SWN netlink\n\nCIFS_GENL_CMD_SWN_NOTIFY is the userspace witness-notify command. The\nintended sender is the cifs.witness helper, but the generic-netlink\noperation currently has no capability flag, so any local process can send\nRESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness\nhandler.\n\nThe same family exposes CIFS_GENL_MCGRP_SWN without multicast-group\ncapability flags. Register messages sent to that group include the witness\nregistration id and, for NTLM-authenticated mounts, the username, domain,\nand password attributes copied from the CIFS session. An unprivileged\nlocal process should not be able to join that group and receive those\nmessages.\n\nRequire CAP_NET_ADMIN for incoming SWN_NOTIFY commands with\nGENL_ADMIN_PERM, and require CAP_NET_ADMIN over the network namespace for\njoining the SWN multicast group with GENL_MCAST_CAP_NET_ADMIN. The\ncifs.witness service runs with the privileges needed for both operations."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local access via generic-netlink syscalls (socket/bind/sendmsg/setsockopt on NETLINK_GENERIC), not remote SMB or network packet handling.\nAC:L - An unprivileged attacker can reliably join the SWN multicast group and send crafted SWN_NOTIFY commands; registration IDs are exposed in multicast register messages, with no races or uncontrollable conditions.\nPR:L - Before the fix, no capability checks guarded SWN_NOTIFY or multicast group membership, so any unprivileged local user could exploit without CAP_NET_ADMIN or user-namespace tricks.\nUI:N - Exploitation is passive (multicast subscription) or active (netlink injection) and does not require any victim action at attack time beyond pre-existing witness-enabled CIFS mounts.\nS:U - Impact is confined to the local kernel/CIFS client security domain (credential theft and connection manipulation); it does not cross VM, container, or IOMMU boundaries.\nC:H - Multicast register messages disclose NTLM username, domain, and plaintext password from active CIFS witness sessions to any local subscriber.\nI:H - Forged CLIENT_MOVE notifications redirect SMB reconnects to attacker-controlled endpoints, compromising connection integrity and enabling MITM against mounted cluster shares.\nA:H - Forged RESOURCE_CHANGE notifications force CIFS reconnect cycles on all channels, enabling reliable denial-of-service against witness-enabled mounts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:38.366Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9cf7eb8919344932f909b2fac76296f7656fda8d"
},
{
"url": "https://git.kernel.org/stable/c/9919021a3b7974ae66a5f9915e3a48c10cfd409b"
},
{
"url": "https://git.kernel.org/stable/c/969bc6370334a5b4720c5470783295d6484bbc95"
},
{
"url": "https://git.kernel.org/stable/c/a3238b09c58f323e40743ce174cd0ab81b5c09ed"
},
{
"url": "https://git.kernel.org/stable/c/a8d17d22db591099519a89f14dd24810daba74c3"
},
{
"url": "https://git.kernel.org/stable/c/c2397b93fbb6f44a788fff30f99be2c20cc5e50f"
},
{
"url": "https://git.kernel.org/stable/c/d1ebfce2c1d161186a82e77590bf7da2ea1bce91"
}
],
"title": "smb: client: require net admin for CIFS SWN netlink",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64137",
"datePublished": "2026-07-19T15:40:31.045Z",
"dateReserved": "2026-07-19T07:54:57.037Z",
"dateUpdated": "2026-08-05T12:39:38.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63868 (GCVE-0-2026-63868)
Vulnerability from cvelistv5
Published
2026-07-19 14:18
Modified
2026-07-19 14:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
The receive-side GARP attribute parser computes dlen with reversed
operands:
dlen = sizeof(*ga) - ga->len;
ga->len is the on-wire attribute length and includes the GARP attribute
header. For normal attributes with data, ga->len is larger than
sizeof(*ga), so the subtraction underflows in unsigned arithmetic.
The resulting value is later passed to garp_attr_lookup(), whose length
argument is u8. After truncation, the parsed data length usually no
longer matches the length stored for locally registered attributes, so
received Join/Leave events are ignored. This breaks the GARP receive path
for common attributes, such as GVRP VLAN registration attributes.
Compute the data length as the attribute length minus the header length.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eca9ebac651f774d8b10fce7c5d173c3c3d3394f Version: eca9ebac651f774d8b10fce7c5d173c3c3d3394f Version: eca9ebac651f774d8b10fce7c5d173c3c3d3394f Version: eca9ebac651f774d8b10fce7c5d173c3c3d3394f Version: eca9ebac651f774d8b10fce7c5d173c3c3d3394f Version: eca9ebac651f774d8b10fce7c5d173c3c3d3394f Version: eca9ebac651f774d8b10fce7c5d173c3c3d3394f Version: eca9ebac651f774d8b10fce7c5d173c3c3d3394f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/802/garp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "29f28172afb2ae7b31e9bf3e978396f20b381688",
"status": "affected",
"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f",
"versionType": "git"
},
{
"lessThan": "973cf7c433d27f4d9556d0b7c332543be7ed7a6e",
"status": "affected",
"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f",
"versionType": "git"
},
{
"lessThan": "d8dcd14aa886b8effd83022c550669f4f262854b",
"status": "affected",
"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f",
"versionType": "git"
},
{
"lessThan": "74e02121be1dcc0efcd56ebdf0171d6129105659",
"status": "affected",
"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f",
"versionType": "git"
},
{
"lessThan": "d4c86ea09ae3e63ee5aa86e941fcc38e0e39874a",
"status": "affected",
"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f",
"versionType": "git"
},
{
"lessThan": "04e22fefac1af3e32f245e9045382348773b5d59",
"status": "affected",
"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f",
"versionType": "git"
},
{
"lessThan": "a11f1a671b1361f0f1278dc0041374f2730df73f",
"status": "affected",
"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f",
"versionType": "git"
},
{
"lessThan": "16e408e607a94b646fb14a2a98422c6877ae4b3c",
"status": "affected",
"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/802/garp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: garp: fix unsigned integer underflow in garp_pdu_parse_attr\n\nThe receive-side GARP attribute parser computes dlen with reversed\noperands:\n\n dlen = sizeof(*ga) - ga-\u003elen;\n\nga-\u003elen is the on-wire attribute length and includes the GARP attribute\nheader. For normal attributes with data, ga-\u003elen is larger than\nsizeof(*ga), so the subtraction underflows in unsigned arithmetic.\n\nThe resulting value is later passed to garp_attr_lookup(), whose length\nargument is u8. After truncation, the parsed data length usually no\nlonger matches the length stored for locally registered attributes, so\nreceived Join/Leave events are ignored. This breaks the GARP receive path\nfor common attributes, such as GVRP VLAN registration attributes.\n\nCompute the data length as the attribute length minus the header length."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T14:18:37.823Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/29f28172afb2ae7b31e9bf3e978396f20b381688"
},
{
"url": "https://git.kernel.org/stable/c/973cf7c433d27f4d9556d0b7c332543be7ed7a6e"
},
{
"url": "https://git.kernel.org/stable/c/d8dcd14aa886b8effd83022c550669f4f262854b"
},
{
"url": "https://git.kernel.org/stable/c/74e02121be1dcc0efcd56ebdf0171d6129105659"
},
{
"url": "https://git.kernel.org/stable/c/d4c86ea09ae3e63ee5aa86e941fcc38e0e39874a"
},
{
"url": "https://git.kernel.org/stable/c/04e22fefac1af3e32f245e9045382348773b5d59"
},
{
"url": "https://git.kernel.org/stable/c/a11f1a671b1361f0f1278dc0041374f2730df73f"
},
{
"url": "https://git.kernel.org/stable/c/16e408e607a94b646fb14a2a98422c6877ae4b3c"
}
],
"title": "net: garp: fix unsigned integer underflow in garp_pdu_parse_attr",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63868",
"datePublished": "2026-07-19T14:18:37.823Z",
"dateReserved": "2026-07-19T07:54:57.017Z",
"dateUpdated": "2026-07-19T14:18:37.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68278 (GCVE-0-2026-68278)
Vulnerability from cvelistv5
Published
2026-08-10 12:01
Modified
2026-08-23 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/dp/mst: fix buffer overflows in sideband chunk accumulation
drm_dp_sideband_append_payload() has three related bugs when processing
device-provided sideband reply data:
1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken
directly from the DP sideband header. If a device sends msg_len=0,
curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len)
is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).
drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()
writes 255 bytes into msg[], both far out of bounds.
2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is
only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks
until curchunk_idx reaches curchunk_len, writing up to 15 bytes past
the end of chunk[] into msg[].
3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to
msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256],
so the memcpy can spill into adjacent struct fields.
All three are reachable from any DP MST device that can forge sideband
reply messages on a physical connection.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/display/drm_dp_mst_topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ef2ecb6cf268debf3890df99fea01b6452dcf78e",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "d4e05dedb252ed3e540a0c9be511e427f098110a",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "4d5109075a787de28c9e89940f9dee45269f91fa",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "53937a2787d29c7a460e984dc4f20ff6ac91dc65",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "ef0dbcc200c3389f1f781ab181932a97e54b51af",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "1e5827839ad0ceb0079d1560c321fa3656b54f21",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "a6366b551079c79bf7bdbadd74c97358bcfe2d58",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "55bd5e685bda455b9b50c835f8c8442d52a344a3",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/display/drm_dp_mst_topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp/mst: fix buffer overflows in sideband chunk accumulation\n\ndrm_dp_sideband_append_payload() has three related bugs when processing\ndevice-provided sideband reply data:\n\n1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken\n directly from the DP sideband header. If a device sends msg_len=0,\n curchunk_len is set to zero. The condition (curchunk_idx \u003e= curchunk_len)\n is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).\n drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()\n writes 255 bytes into msg[], both far out of bounds.\n\n2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is\n only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks\n until curchunk_idx reaches curchunk_len, writing up to 15 bytes past\n the end of chunk[] into msg[].\n\n3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to\n msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256],\n so the memcpy can spill into adjacent struct fields.\n\nAll three are reachable from any DP MST device that can forge sideband\nreply messages on a physical connection."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:15.450Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ef2ecb6cf268debf3890df99fea01b6452dcf78e"
},
{
"url": "https://git.kernel.org/stable/c/d4e05dedb252ed3e540a0c9be511e427f098110a"
},
{
"url": "https://git.kernel.org/stable/c/4d5109075a787de28c9e89940f9dee45269f91fa"
},
{
"url": "https://git.kernel.org/stable/c/53937a2787d29c7a460e984dc4f20ff6ac91dc65"
},
{
"url": "https://git.kernel.org/stable/c/ef0dbcc200c3389f1f781ab181932a97e54b51af"
},
{
"url": "https://git.kernel.org/stable/c/1e5827839ad0ceb0079d1560c321fa3656b54f21"
},
{
"url": "https://git.kernel.org/stable/c/a6366b551079c79bf7bdbadd74c97358bcfe2d58"
},
{
"url": "https://git.kernel.org/stable/c/55bd5e685bda455b9b50c835f8c8442d52a344a3"
}
],
"title": "drm/dp/mst: fix buffer overflows in sideband chunk accumulation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68278",
"datePublished": "2026-08-10T12:01:54.285Z",
"dateReserved": "2026-07-30T09:28:09.379Z",
"dateUpdated": "2026-08-23T12:46:15.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64582 (GCVE-0-2026-64582)
Vulnerability from cvelistv5
Published
2026-08-05 11:25
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix a use-after-free problem in rxe_mmap
rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list
and releases pending_lock while the struct's kref is still at 1:
list_del_init(&ip->pending_mmaps);
spin_unlock_bh(&rxe->pending_lock); /* ref == 1, no lock held */
ret = remap_vmalloc_range(vma, ip->obj, 0); /* walks PTEs */
[...]
rxe_vma_open(vma); /* kref_get, ref → 2 */
remap_vmalloc_range_partial() walks PTEs without any lock.
A concurrent DESTROY_CQ ioctl on another CPU calls:
kref_put(&q->ip->ref, rxe_mmap_release) /* ref 1→0 */
vfree(ip->obj) /* clears vmalloc PTEs mid-walk */
kfree(ip) /* frees rxe_mmap_info */
This yields:
1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the
per-PTE race -> vm_insert_page(NULL) → GPF in validate_page_before_insert
2. Page UAF, vmalloc_to_page() reads a stale PTE before vfree clears
it. User VMA holds a PTE to a free'd page which might eventually get
reallocated later by vmalloc which allows the attacker to get a clean
page-level UAF.
It is worth noting that even though a page-level UAF is possible given
the strong primitive, it is statistically very difficult to achieve
given the very short time window (after the last insert_page and before
the kref_get).
The call trace are as below:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 1000 PID: 413 Comm: poc Not tainted 7.0.0-rc5-dirty #28 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:validate_page_before_insert+0x32/0x300
Code: e5 41 57 41 56 49 89 fe 41 55 41 54 53 48 89 f3 e8 93 b5 a3 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 7b 02 00 00 4c 8b 63 08 31 ff 4d 89 e5 41 83 e5
RSP: 0018:ffff88811b15f2f0 EFLAGS: 00000202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000008
RBP: ffff88811b15f318 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881181eee00
R13: 0000000000000000 R14: ffff8881181eee00 R15: ffff8881181eee20
FS: 00007b1e000f76c0(0000) GS:ffff8884268e0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007b1e00a24ac0 CR3: 0000000116eb3000 CR4: 00000000000006f0
Call Trace:
<TASK>
insert_page+0x8f/0x190
? __pfx_insert_page+0x10/0x10
? kasan_save_alloc_info+0x38/0x60
vm_insert_page+0x2e7/0x400
remap_vmalloc_range_partial+0x212/0x3e0
remap_vmalloc_range+0x6e/0xb0
? __kasan_check_write+0x14/0x30
rxe_mmap+0x2e9/0x5d0
ib_uverbs_mmap+0x1ad/0x2c0
__mmap_region+0x12c2/0x2ad0
? __pfx___mmap_region+0x10/0x10
? __sanitizer_cov_trace_switch+0x58/0xb0
? mas_prev_slot+0x360/0x39c0
? __sanitizer_cov_trace_switch+0x58/0xb0
? mas_next_slot+0x1e5b/0x2f40
? __sanitizer_cov_trace_cmp8+0x18/0x30
? unmapped_area_topdown+0x4dd/0x610
? kfree+0x1b1/0x440
? free_cpumask_var+0x16/0x30
? __kasan_slab_free+0x7d/0xa0
? __sanitizer_cov_trace_cmp8+0x18/0x30
mmap_region+0x2e6/0x3c0
do_mmap+0xa3e/0x12a0
? __pfx_do_mmap+0x10/0x10
? __kasan_check_write+0x14/0x30
? down_write_killable+0xba/0x160
? __pfx_down_write_killable+0x10/0x10
? __sanitizer_cov_trace_cmp4+0x16/0x30
vm_mmap_pgoff+0x2d4/0x4a0
? __pfx_vm_mmap_pgoff+0x10/0x10
? fget+0x1bf/0x270
ksys_mmap_pgoff+0x40c/0x690
? __sanitizer_cov_trace_const_cmp4+0x16/0x30
? __pfx_ksys_mmap_pgoff+0x10/0x10
? __kasan_check_write+0x14/0x30
? _raw_spin_trylock+0xbb/0x130
? __pfx__raw_spin_trylock+0x10/0x10
__x64_sys_mmap+0x135/0x1e0
x64_sys_c
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 Version: 8700e3e7c4857d28ebaa824509934556da0b3e76 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64582",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:43:19.210360Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:43.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b810352d0916796dabe633cdb9adee9863ab4911",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "aef5ea8578f97f2701039600846a8bcf5f21e863",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "3371f2036e0f970166bbb624e25bba46d32fa18e",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "665fb7d22a700c66a78db0cf88c6e6a649aba9d0",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "3525987a392536f31a484833af258971af63b24c",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "35744ab3d03c5fca8c1752f53fc8fc674e14c561",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix a use-after-free problem in rxe_mmap\n\nrxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list\nand releases pending_lock while the struct\u0027s kref is still at 1:\n\n list_del_init(\u0026ip-\u003epending_mmaps);\n spin_unlock_bh(\u0026rxe-\u003epending_lock); /* ref == 1, no lock held */\n ret = remap_vmalloc_range(vma, ip-\u003eobj, 0); /* walks PTEs */\n [...]\n rxe_vma_open(vma); /* kref_get, ref \u2192 2 */\n remap_vmalloc_range_partial() walks PTEs without any lock.\n\nA concurrent DESTROY_CQ ioctl on another CPU calls:\n\n kref_put(\u0026q-\u003eip-\u003eref, rxe_mmap_release) /* ref 1\u21920 */\n vfree(ip-\u003eobj) /* clears vmalloc PTEs mid-walk */\n kfree(ip) /* frees rxe_mmap_info */\n\nThis yields:\n\n 1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the\n per-PTE race -\u003e vm_insert_page(NULL) \u2192 GPF in validate_page_before_insert\n\n 2. Page UAF, vmalloc_to_page() reads a stale PTE before vfree clears\n it. User VMA holds a PTE to a free\u0027d page which might eventually get\n reallocated later by vmalloc which allows the attacker to get a clean\n page-level UAF.\n\n It is worth noting that even though a page-level UAF is possible given\n the strong primitive, it is statistically very difficult to achieve\n given the very short time window (after the last insert_page and before\n the kref_get).\n\nThe call trace are as below:\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n CPU: 0 UID: 1000 PID: 413 Comm: poc Not tainted 7.0.0-rc5-dirty #28 PREEMPT(lazy)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n RIP: 0010:validate_page_before_insert+0x32/0x300\n Code: e5 41 57 41 56 49 89 fe 41 55 41 54 53 48 89 f3 e8 93 b5 a3 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 7b 02 00 00 4c 8b 63 08 31 ff 4d 89 e5 41 83 e5\n RSP: 0018:ffff88811b15f2f0 EFLAGS: 00000202\n RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\n RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000008\n RBP: ffff88811b15f318 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881181eee00\n R13: 0000000000000000 R14: ffff8881181eee00 R15: ffff8881181eee20\n FS: 00007b1e000f76c0(0000) GS:ffff8884268e0000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007b1e00a24ac0 CR3: 0000000116eb3000 CR4: 00000000000006f0\n Call Trace:\n \u003cTASK\u003e\n insert_page+0x8f/0x190\n ? __pfx_insert_page+0x10/0x10\n ? kasan_save_alloc_info+0x38/0x60\n vm_insert_page+0x2e7/0x400\n remap_vmalloc_range_partial+0x212/0x3e0\n remap_vmalloc_range+0x6e/0xb0\n ? __kasan_check_write+0x14/0x30\n rxe_mmap+0x2e9/0x5d0\n ib_uverbs_mmap+0x1ad/0x2c0\n __mmap_region+0x12c2/0x2ad0\n ? __pfx___mmap_region+0x10/0x10\n ? __sanitizer_cov_trace_switch+0x58/0xb0\n ? mas_prev_slot+0x360/0x39c0\n ? __sanitizer_cov_trace_switch+0x58/0xb0\n ? mas_next_slot+0x1e5b/0x2f40\n ? __sanitizer_cov_trace_cmp8+0x18/0x30\n ? unmapped_area_topdown+0x4dd/0x610\n ? kfree+0x1b1/0x440\n ? free_cpumask_var+0x16/0x30\n ? __kasan_slab_free+0x7d/0xa0\n ? __sanitizer_cov_trace_cmp8+0x18/0x30\n mmap_region+0x2e6/0x3c0\n do_mmap+0xa3e/0x12a0\n ? __pfx_do_mmap+0x10/0x10\n ? __kasan_check_write+0x14/0x30\n ? down_write_killable+0xba/0x160\n ? __pfx_down_write_killable+0x10/0x10\n ? __sanitizer_cov_trace_cmp4+0x16/0x30\n vm_mmap_pgoff+0x2d4/0x4a0\n ? __pfx_vm_mmap_pgoff+0x10/0x10\n ? fget+0x1bf/0x270\n ksys_mmap_pgoff+0x40c/0x690\n ? __sanitizer_cov_trace_const_cmp4+0x16/0x30\n ? __pfx_ksys_mmap_pgoff+0x10/0x10\n ? __kasan_check_write+0x14/0x30\n ? _raw_spin_trylock+0xbb/0x130\n ? __pfx__raw_spin_trylock+0x10/0x10\n __x64_sys_mmap+0x135/0x1e0\n x64_sys_c\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Triggered via local mmap on /dev/infiniband/uverbsN (ib_uverbs_mmap\u2192rxe_mmap) racing DESTROY_CQ/QP/SRQ ioctls; not reachable from RoCE/UDP packet processing.\nAC:L - Attacker controls both sides\u2014mmap of the pending CQ/QP/SRQ queue buffer and concurrent destroy that kref_puts to rxe_mmap_release\u2014and can retry unboundedly; PoC shows reliable crash.\nPR:L - uverbs_devnode() publishes /dev/infiniband/uverbs* as 0666 with no capability checks on create/mmap/destroy; once Soft-RoCE exists (admin setup), any unprivileged user (PoC UID 1000) can exploit.\nUI:N - Attacker opens uverbs, creates a CQ/QP/SRQ, then races mmap with destroy from its own threads; no victim action required.\nS:U - UAF corrupts kernel heap/vmalloc within the host kernel authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Race frees rxe_mmap_info and vfree\u0027s the queue while remap_vmalloc_range still walks it; stale PTEs can leave a user VMA mapped to reallocated pages, enabling page-level UAF reads.\nI:H - Same page-level UAF / freed-object control yields write primitives via remapped freed pages and heap reuse, sufficient for control-flow hijacking per UAF guidance.\nA:H - Concurrent vfree during PTE walk returns NULL to vm_insert_page, causing the documented GPF/oops in validate_page_before_insert; crash is reliably repeatable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:09.006Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b810352d0916796dabe633cdb9adee9863ab4911"
},
{
"url": "https://git.kernel.org/stable/c/aef5ea8578f97f2701039600846a8bcf5f21e863"
},
{
"url": "https://git.kernel.org/stable/c/3371f2036e0f970166bbb624e25bba46d32fa18e"
},
{
"url": "https://git.kernel.org/stable/c/665fb7d22a700c66a78db0cf88c6e6a649aba9d0"
},
{
"url": "https://git.kernel.org/stable/c/e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e"
},
{
"url": "https://git.kernel.org/stable/c/e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6"
},
{
"url": "https://git.kernel.org/stable/c/3525987a392536f31a484833af258971af63b24c"
},
{
"url": "https://git.kernel.org/stable/c/35744ab3d03c5fca8c1752f53fc8fc674e14c561"
}
],
"title": "RDMA/rxe: Fix a use-after-free problem in rxe_mmap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64582",
"datePublished": "2026-08-05T11:25:29.082Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-10-19T20:48:43.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64564 (GCVE-0-2026-64564)
Vulnerability from cvelistv5
Published
2026-08-04 06:23
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: don't free the ASCONF's own transport in DEL-IP processing
sctp_process_asconf() caches the transport the ASCONF chunk is processed
against in asconf->transport (== chunk->transport, set once in sctp_rcv()).
For an ASCONF located through its Address Parameter by
__sctp_rcv_asconf_lookup(), that cached transport corresponds to the
Address Parameter, which need not be the packet's source address.
sctp_process_asconf_param() rejects a DEL-IP for the packet source address
(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport.
A single ASCONF can therefore carry, in order:
[Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]
where L differs from the source. The DEL-IP for L passes the D8 check and
calls sctp_assoc_rm_peer() on the transport that asconf->transport still
points at, freeing it (RCU-deferred). The following wildcard DEL-IP then
reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and
sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed
transport (->ipaddr, ->state) and plants the dangling pointer into
asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping
only the pointer that is no longer on the list, removes every real
transport, leaving the association with a transport_count of 0 and
primary_path/active_path pointing at freed memory.
Reject a DEL-IP that targets the transport the ASCONF is being processed
against, mirroring the existing source-address guard, so the wildcard
branch can never reuse a freed transport.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 42e30bf3463cd37d73839376662cb79b4d5c416c Version: 42e30bf3463cd37d73839376662cb79b4d5c416c Version: 42e30bf3463cd37d73839376662cb79b4d5c416c Version: 42e30bf3463cd37d73839376662cb79b4d5c416c Version: 42e30bf3463cd37d73839376662cb79b4d5c416c Version: 42e30bf3463cd37d73839376662cb79b4d5c416c Version: 42e30bf3463cd37d73839376662cb79b4d5c416c Version: 42e30bf3463cd37d73839376662cb79b4d5c416c |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-08-08T01:31:36.501Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/06/3"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/06/4"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/06/13"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/07/1"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/07/2"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/07/8"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64564",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:57.454548Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:42.076Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293",
"status": "affected",
"version": "42e30bf3463cd37d73839376662cb79b4d5c416c",
"versionType": "git"
},
{
"lessThan": "a63afa1f9b12d5293cbe0b77fd45dc0632533a13",
"status": "affected",
"version": "42e30bf3463cd37d73839376662cb79b4d5c416c",
"versionType": "git"
},
{
"lessThan": "2b324ba3494ae958cba16a453e3e71489b4de7fc",
"status": "affected",
"version": "42e30bf3463cd37d73839376662cb79b4d5c416c",
"versionType": "git"
},
{
"lessThan": "fedeb4468987bcaff85fe3061de5ae052d414740",
"status": "affected",
"version": "42e30bf3463cd37d73839376662cb79b4d5c416c",
"versionType": "git"
},
{
"lessThan": "74e8f3e7114f0e26d1b2c4c048044db9fcc27603",
"status": "affected",
"version": "42e30bf3463cd37d73839376662cb79b4d5c416c",
"versionType": "git"
},
{
"lessThan": "85aca407c560aba81b5ce9d3d6cf94c74077d19b",
"status": "affected",
"version": "42e30bf3463cd37d73839376662cb79b4d5c416c",
"versionType": "git"
},
{
"lessThan": "d136b29bf91dd8e3161281b87de597b7311d9462",
"status": "affected",
"version": "42e30bf3463cd37d73839376662cb79b4d5c416c",
"versionType": "git"
},
{
"lessThan": "9b2854f86f0b56e9027d68e7a3fc909d1a9b566f",
"status": "affected",
"version": "42e30bf3463cd37d73839376662cb79b4d5c416c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing\n\nsctp_process_asconf() caches the transport the ASCONF chunk is processed\nagainst in asconf-\u003etransport (== chunk-\u003etransport, set once in sctp_rcv()).\nFor an ASCONF located through its Address Parameter by\n__sctp_rcv_asconf_lookup(), that cached transport corresponds to the\nAddress Parameter, which need not be the packet\u0027s source address.\n\nsctp_process_asconf_param() rejects a DEL-IP for the packet source address\n(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf-\u003etransport.\nA single ASCONF can therefore carry, in order:\n\n [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]\n\nwhere L differs from the source. The DEL-IP for L passes the D8 check and\ncalls sctp_assoc_rm_peer() on the transport that asconf-\u003etransport still\npoints at, freeing it (RCU-deferred). The following wildcard DEL-IP then\nreuses the now-dangling asconf-\u003etransport in sctp_assoc_set_primary() and\nsctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed\ntransport (-\u003eipaddr, -\u003estate) and plants the dangling pointer into\nasoc-\u003epeer.primary_path / active_path, and del_nonprimary_peers(), keeping\nonly the pointer that is no longer on the list, removes every real\ntransport, leaving the association with a transport_count of 0 and\nprimary_path/active_path pointing at freed memory.\n\nReject a DEL-IP that targets the transport the ASCONF is being processed\nagainst, mirroring the existing source-address guard, so the wildcard\nbranch can never reuse a freed transport."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in SCTP ASCONF receive processing (sctp_rcv \u2192 sctp_sf_do_asconf \u2192 sctp_process_asconf \u2192 sctp_process_asconf_param); a remote peer triggers it by sending a crafted ASCONF over IP/IPv6 on an established association, matching kernel guidance that net/ stack bugs reachable via received packets are Network.\nAC:L - A single attacker-controlled ASCONF with [Address Parameter L][DEL-IP L][DEL-IP 0.0.0.0] reliably frees asconf-\u003etransport then reuses it in the same softirq; the peer fully controls multi-homing, serial, and parameter order, with no race or other condition outside attacker influence.\nPR:N - Any remote SCTP peer that completes a normal association with ADD-IP negotiated can send the ASCONF; SCTP-AUTH keys come from the handshake the peer itself performs (or addip_noauth), and no local credentials or capabilities on the target are required.\nUI:N - Exploitation requires only attacker-sent SCTP packets processed automatically in the receive/state-machine path; no victim user action such as opening a file or mounting a device is needed.\nS:U - Impact is confined to the vulnerable host kernel (sctp_transport UAF / crash or privilege escalation) and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - This is a heap use-after-free of an sctp_transport planted into primary_path/active_path after RCU-deferred free; freed-object reuse yields arbitrary kernel read primitives, scored High per UAF guidance.\nI:H - The same transport UAF enables heap spraying and write/control-flow hijacking via later dereferences of the dangling primary_path/active_path, so integrity impact is High.\nA:H - set_primary() immediately dereferences the freed transport and leaves the association with transport_count 0 and dangling path pointers, causing a reproducible kernel oops/panic on subsequent use, which is High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:36.947Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293"
},
{
"url": "https://git.kernel.org/stable/c/a63afa1f9b12d5293cbe0b77fd45dc0632533a13"
},
{
"url": "https://git.kernel.org/stable/c/2b324ba3494ae958cba16a453e3e71489b4de7fc"
},
{
"url": "https://git.kernel.org/stable/c/fedeb4468987bcaff85fe3061de5ae052d414740"
},
{
"url": "https://git.kernel.org/stable/c/74e8f3e7114f0e26d1b2c4c048044db9fcc27603"
},
{
"url": "https://git.kernel.org/stable/c/85aca407c560aba81b5ce9d3d6cf94c74077d19b"
},
{
"url": "https://git.kernel.org/stable/c/d136b29bf91dd8e3161281b87de597b7311d9462"
},
{
"url": "https://git.kernel.org/stable/c/9b2854f86f0b56e9027d68e7a3fc909d1a9b566f"
},
{
"url": "https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564"
}
],
"title": "sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64564",
"datePublished": "2026-08-04T06:23:23.339Z",
"dateReserved": "2026-07-19T15:36:31.797Z",
"dateUpdated": "2026-10-19T20:48:42.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43502 (GCVE-0-2026-43502)
Vulnerability from cvelistv5
Published
2026-05-21 12:17
Modified
2026-10-15 01:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/rds: handle zerocopy send cleanup before the message is queued
A zerocopy send can fail after user pages have been pinned but before
the message is attached to the sending socket.
The purge path currently infers zerocopy state from rm->m_rs, so an
unqueued message can be cleaned up as if it owned normal payload pages.
However, zerocopy ownership is really determined by the presence of
op_mmp_znotifier, regardless of whether the message has reached the
socket queue.
Capture op_mmp_znotifier up front in rds_message_purge() and use it as
the cleanup discriminator. If the message is already associated with a
socket, keep the existing completion path. Otherwise, drop the pinned
page accounting directly and release the notifier before putting the
payload pages.
This keeps early send failure cleanup consistent with the zerocopy
lifetime rules without changing the normal queued completion path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43502",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401 Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T03:56:01.157Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-43502-openSUSE-6.4.0-150600"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:19:32.714Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/message.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e9aefdc5c53fe9aed108c14e3d155710a1bb14c9",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "46662f7dc59475995609bf3e9d27eb36f4acf26f",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "1e262db7675e27f42c3f3f47d6011855f4454f24",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "21d70744e6d3bbf9293aa1ee6fba7c53ad75275e",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "3abc8983b2bae3f487f77d9da5527d7d6b210d46",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "14ef6fd18db2494098b21e0471bf27a1d8e9993e",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "44b550d88b267320459d518c0743a241ab2108fa",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/message.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: handle zerocopy send cleanup before the message is queued\n\nA zerocopy send can fail after user pages have been pinned but before\nthe message is attached to the sending socket.\n\nThe purge path currently infers zerocopy state from rm-\u003em_rs, so an\nunqueued message can be cleaned up as if it owned normal payload pages.\nHowever, zerocopy ownership is really determined by the presence of\nop_mmp_znotifier, regardless of whether the message has reached the\nsocket queue.\n\nCapture op_mmp_znotifier up front in rds_message_purge() and use it as\nthe cleanup discriminator. If the message is already associated with a\nsocket, keep the existing completion path. Otherwise, drop the pinned\npage accounting directly and release the notifier before putting the\npayload pages.\n\nThis keeps early send failure cleanup consistent with the zerocopy\nlifetime rules without changing the normal queued completion path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is triggered by a local sendmsg(MSG_ZEROCOPY) syscall on an AF_RDS socket; the buggy cleanup decision depends only on local send-side failure conditions, not on any data received from a remote peer.\nAC:L - The attacker fully and deterministically controls the pre-queue failure (e.g., nonblocking socket with a full send buffer, or an invalid RDMA/atomic cmsg), so no race or uncontrolled condition is involved.\nPR:L - Creating an AF_RDS SOCK_SEQPACKET socket and enabling SO_ZEROCOPY require no capabilities (rds_create has no privilege check), so any unprivileged local user can reach the code.\nUI:N - The attacker triggers the entire flow through its own syscall; no action by another user is required.\nS:U - The memory corruption stays within the kernel\u0027s own security authority and does not cross into another security scope such as a VM or IOMMU boundary.\nC:H - Releasing GUP-pinned user pages through the wrong path (and underflowing compound-page refcounts) can free/reuse pages still owned by user space, enabling disclosure of memory contents after reuse.\nI:H - The struct-page refcount underflow and improper page free constitute memory corruption that can be leveraged into a page use-after-free/write primitive, not merely a clean crash.\nA:H - The corrupted page accounting/refcounting and improper buddy-allocator free can cause VM_BUG_ON, oops, or kernel panic, in addition to leaking pinned-page accounting and the notifier struct."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:25.250Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e9aefdc5c53fe9aed108c14e3d155710a1bb14c9"
},
{
"url": "https://git.kernel.org/stable/c/46662f7dc59475995609bf3e9d27eb36f4acf26f"
},
{
"url": "https://git.kernel.org/stable/c/1e262db7675e27f42c3f3f47d6011855f4454f24"
},
{
"url": "https://git.kernel.org/stable/c/21d70744e6d3bbf9293aa1ee6fba7c53ad75275e"
},
{
"url": "https://git.kernel.org/stable/c/3abc8983b2bae3f487f77d9da5527d7d6b210d46"
},
{
"url": "https://git.kernel.org/stable/c/14ef6fd18db2494098b21e0471bf27a1d8e9993e"
},
{
"url": "https://git.kernel.org/stable/c/0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b"
},
{
"url": "https://git.kernel.org/stable/c/44b550d88b267320459d518c0743a241ab2108fa"
}
],
"title": "net/rds: handle zerocopy send cleanup before the message is queued",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43502",
"datePublished": "2026-05-21T12:17:50.444Z",
"dateReserved": "2026-05-01T14:12:56.014Z",
"dateUpdated": "2026-10-15T01:19:32.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64007 (GCVE-0-2026-64007)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: synproxy: refresh tcphdr after skb_ensure_writable
synproxy_tstamp_adjust() rewrites the TCP timestamp option in place
and then patches the TCP checksum via inet_proto_csum_replace4() on
the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and
ipv6_synproxy_hook() obtain that pointer with skb_header_pointer()
before calling in, so it may either alias skb->head directly or
point at the caller's on-stack _tcph buffer.
Between obtaining the pointer and using it, the function calls
skb_ensure_writable(skb, optend), which on a cloned or non-linear
skb invokes pskb_expand_head() and frees the old skb->head. After
that point the cached th is stale:
caller (ipv[46]_synproxy_hook)
th = skb_header_pointer(skb, ..., &_tcph)
synproxy_tstamp_adjust(skb, protoff, th, ...)
skb_ensure_writable(skb, optend)
pskb_expand_head() /* kfree(old skb->head) */
...
inet_proto_csum_replace4(&th->check, ...)
/* writes into freed head, or
into the caller's stack copy
leaving the on-wire checksum
stale */
The option bytes are written through skb->data and are fine; only
the checksum update goes through th and so lands in the wrong
place. The result is either a write into freed slab memory or a
packet leaving with a checksum that does not match its payload.
Fix by re-deriving th from skb->data + protoff immediately after
skb_ensure_writable() succeeds, so the subsequent checksum update
targets the linear, writable header.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64007",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:12.812094Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:08.086Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_synproxy_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9902a1058992de5d95656b64a3bd95c077f7ba2c",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "d3019c61799adc21811af4b521f11f3dc77f8e04",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "dd206819f210522579010d889d45a9530bb494bc",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "af2c22ccb1f621aff487ff47a040e38e058541e7",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "c7f945f7da097245a2f8ed7775ce48421047ee96",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "f0fea2b6d5453a11ad11713bbf37561b9b3a7edf",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "a91887a5b6ee4b98dfbf1db657ed2b879430149e",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "92170e6afe927ab2792a3f71902845789c8e31b1",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_synproxy_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: refresh tcphdr after skb_ensure_writable\n\nsynproxy_tstamp_adjust() rewrites the TCP timestamp option in place\nand then patches the TCP checksum via inet_proto_csum_replace4() on\nthe caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()\nbefore calling in, so it may either alias skb-\u003ehead directly or\npoint at the caller\u0027s on-stack _tcph buffer.\n\nBetween obtaining the pointer and using it, the function calls\nskb_ensure_writable(skb, optend), which on a cloned or non-linear\nskb invokes pskb_expand_head() and frees the old skb-\u003ehead. After\nthat point the cached th is stale:\n\n caller (ipv[46]_synproxy_hook)\n th = skb_header_pointer(skb, ..., \u0026_tcph)\n synproxy_tstamp_adjust(skb, protoff, th, ...)\n skb_ensure_writable(skb, optend)\n pskb_expand_head() /* kfree(old skb-\u003ehead) */\n ...\n inet_proto_csum_replace4(\u0026th-\u003echeck, ...)\n /* writes into freed head, or\n into the caller\u0027s stack copy\n leaving the on-wire checksum\n stale */\n\nThe option bytes are written through skb-\u003edata and are fine; only\nthe checksum update goes through th and so lands in the wrong\nplace. The result is either a write into freed slab memory or a\npacket leaving with a checksum that does not match its payload.\n\nFix by re-deriving th from skb-\u003edata + protoff immediately after\nskb_ensure_writable() succeeds, so the subsequent checksum update\ntargets the linear, writable header."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is triggered when remote TCP packets traverse SYNPROXY netfilter hooks (NF_INET_LOCAL_IN / NF_INET_POST_ROUTING) on a host with SYNPROXY configured, which is the standard internet-facing firewall/router deployment for this subsystem.\nAC:L - An attacker who controls a TCP session through SYNPROXY can reliably send timestamp-bearing packets to hit the vulnerable path; the stale-pointer UAF write occurs whenever skb_ensure_writable() must expand a cloned skb, which the attacker can influence by sustaining traffic on the proxied connection.\nPR:N - Exploitation requires only that the victim already runs SYNPROXY (normal for protected services); the remote attacker needs no credentials or local privileges on the target system to send the triggering TCP packets.\nUI:N - No victim user action is required beyond normal network operation; exploitation is fully automated via crafted or sustained TCP traffic through the SYNPROXY session.\nS:U - Impact is confined to kernel memory on the affected host running SYNPROXY; this is standard kernel privilege escalation/memory corruption, not a cross-VM or cross-security-boundary escape.\nC:H - The stale tcphdr pointer causes inet_proto_csum_replace4() to write into freed slab memory, a use-after-free class bug that can be leveraged for arbitrary kernel memory read via heap grooming techniques.\nI:H - The out-of-bounds write into freed slab memory via a stale tcphdr pointer is a use-after-free write primitive that can be developed into arbitrary kernel memory writes and local privilege escalation.\nA:H - Writing into freed slab memory can corrupt adjacent kernel objects and cause kernel oops, panic, or crash, and UAF conditions are inherently capable of destabilizing the system even during exploitation attempts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:06.995Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c"
},
{
"url": "https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04"
},
{
"url": "https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc"
},
{
"url": "https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7"
},
{
"url": "https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96"
},
{
"url": "https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf"
},
{
"url": "https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e"
},
{
"url": "https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1"
}
],
"title": "netfilter: synproxy: refresh tcphdr after skb_ensure_writable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64007",
"datePublished": "2026-07-19T14:56:23.049Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-10-19T20:28:08.086Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-40022 (GCVE-0-2025-40022)
Vulnerability from cvelistv5
Published
2025-10-24 12:24
Modified
2026-10-15 01:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in
af_alg_sendmsg") changed some fields from bool to 1-bit bitfields of
type u32.
However, some assignments to these fields, specifically 'more' and
'merge', assign values greater than 1. These relied on C's implicit
conversion to bool, such that zero becomes false and nonzero becomes
true.
With a 1-bit bitfields of type u32 instead, mod 2 of the value is taken
instead, resulting in 0 being assigned in some cases when 1 was intended.
Fix this by restoring the bool type.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0f28c4adbc4a97437874c9b669fd7958a8c6d6ce Version: e4c1ec11132ec466f7362a95f36a506ce4dc08c9 Version: 1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8 Version: 7c4491b5644e3a3708f3dbd7591be0a570135b84 Version: 9aee87da5572b3a14075f501752e209801160d3d Version: 45bcf60fe49b37daab1acee57b27211ad1574042 Version: 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:08:50.599Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/crypto/if_alg.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3a21698ace915a445bce2d0dcfc84b6d2199baf7",
"status": "affected",
"version": "0f28c4adbc4a97437874c9b669fd7958a8c6d6ce",
"versionType": "git"
},
{
"lessThan": "d382d6daf0184490f366562469a5673f65ee2662",
"status": "affected",
"version": "e4c1ec11132ec466f7362a95f36a506ce4dc08c9",
"versionType": "git"
},
{
"lessThan": "54506c6335690f4ef1b9f154e34f5a604c72c1ed",
"status": "affected",
"version": "1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8",
"versionType": "git"
},
{
"lessThan": "8703940bd30b5ad94408d28d7192db2491cd3592",
"status": "affected",
"version": "7c4491b5644e3a3708f3dbd7591be0a570135b84",
"versionType": "git"
},
{
"lessThan": "316b090c2fee964c307a634fecc7df269664b158",
"status": "affected",
"version": "9aee87da5572b3a14075f501752e209801160d3d",
"versionType": "git"
},
{
"lessThan": "fbe96bd25423e61273d8831e995260b429d850b6",
"status": "affected",
"version": "45bcf60fe49b37daab1acee57b27211ad1574042",
"versionType": "git"
},
{
"lessThan": "d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb",
"status": "affected",
"version": "1b34cbbf4f011a121ef7b2d7d6e6920a036d5285",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/crypto/if_alg.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.1.155",
"status": "affected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThan": "6.6.109",
"status": "affected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThan": "6.12.50",
"status": "affected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThan": "6.16.10",
"status": "affected",
"version": "6.16.9",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.155",
"versionStartIncluding": "6.1.154",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.109",
"versionStartIncluding": "6.6.108",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.50",
"versionStartIncluding": "6.12.49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.10",
"versionStartIncluding": "6.16.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Fix incorrect boolean values in af_alg_ctx\n\nCommit 1b34cbbf4f01 (\"crypto: af_alg - Disallow concurrent writes in\naf_alg_sendmsg\") changed some fields from bool to 1-bit bitfields of\ntype u32.\n\nHowever, some assignments to these fields, specifically \u0027more\u0027 and\n\u0027merge\u0027, assign values greater than 1. These relied on C\u0027s implicit\nconversion to bool, such that zero becomes false and nonzero becomes\ntrue.\n\nWith a 1-bit bitfields of type u32 instead, mod 2 of the value is taken\ninstead, resulting in 0 being assigned in some cases when 1 was intended.\n\nFix this by restoring the bool type."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T21:40:58.053Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3a21698ace915a445bce2d0dcfc84b6d2199baf7"
},
{
"url": "https://git.kernel.org/stable/c/d382d6daf0184490f366562469a5673f65ee2662"
},
{
"url": "https://git.kernel.org/stable/c/54506c6335690f4ef1b9f154e34f5a604c72c1ed"
},
{
"url": "https://git.kernel.org/stable/c/8703940bd30b5ad94408d28d7192db2491cd3592"
},
{
"url": "https://git.kernel.org/stable/c/316b090c2fee964c307a634fecc7df269664b158"
},
{
"url": "https://git.kernel.org/stable/c/fbe96bd25423e61273d8831e995260b429d850b6"
},
{
"url": "https://git.kernel.org/stable/c/d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb"
}
],
"title": "crypto: af_alg - Fix incorrect boolean values in af_alg_ctx",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40022",
"datePublished": "2025-10-24T12:24:57.875Z",
"dateReserved": "2025-04-16T07:20:57.152Z",
"dateUpdated": "2026-10-15T01:08:50.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68121 (GCVE-0-2026-68121)
Vulnerability from cvelistv5
Published
2026-08-10 11:58
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pppoe: reload header pointer after dev_hard_header()
pppoe_sendmsg() saves a pointer to the PPPoE header before calling
dev_hard_header(). Device header callbacks are allowed to reallocate the
skb head, invalidating pointers into it.
This can happen when a send is blocked in copy_from_user() while the first
non-Ethernet port is added to an empty team device. The team's delegated
GRE header callback then expands the skb head. PPPoE subsequently writes
six bytes through the stale pointer into the freed head.
Reload the PPPoE header through the skb's network-header offset after
device header creation. pskb_expand_head() updates that offset when it
relocates the head.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:44:11.187043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:51.778Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/pppoe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a56e7c9b08e08fd55a1bcada24cf4fe3782b722",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6eed5ae7887a93160803d2b81ff88e75eefd4a4c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ba3409369c5413cdf0dcbf3a928f76b48e8c3e6a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e6493a4d1ee17595766165fa446d45b7e0c318d0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7e9fbd7f96bcde63a7c798fe16b38cedee7a1501",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6866abf59976d273164a6624234d96a967280223",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bed4caecd723693f750e13adbb2c42ca1249a3fd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e9c238f6fe42fb1b4dba3a578277de32cb487937",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/pppoe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npppoe: reload header pointer after dev_hard_header()\n\npppoe_sendmsg() saves a pointer to the PPPoE header before calling\ndev_hard_header(). Device header callbacks are allowed to reallocate the\nskb head, invalidating pointers into it.\n\nThis can happen when a send is blocked in copy_from_user() while the first\nnon-Ethernet port is added to an empty team device. The team\u0027s delegated\nGRE header callback then expands the skb head. PPPoE subsequently writes\nsix bytes through the stale pointer into the freed head.\n\nReload the PPPoE header through the skb\u0027s network-header offset after\ndevice header creation. pskb_expand_head() updates that offset when it\nrelocates the head."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in pppoe_sendmsg(), reached only via the local sendmsg() syscall on a PF_PPPOX/PPPoE socket; it is not triggered by remote packet reception or in-kernel PPP transmit paths such as __pppoe_xmit().\nAC:L - Exploitation requires a race between copy_from_user() blocking in sendmsg and changing team header_ops (e.g., adding the first non-Ethernet GRE port), which an attacker can drive with concurrent threads and retries rather than uncontrollable timing.\nPR:L - PPPoE sockets can be created without special privileges, and configuring the team/GRE topology needed to trigger dev_hard_header() head expansion is achievable with CAP_NET_ADMIN inside an unprivileged user/network namespace (unshare -Urn).\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through socket I/O and netlink/rtnl configuration of the team device.\nS:U - Impact is kernel heap corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - Writing PPPoE header fields through a stale pointer after pskb_expand_head() frees the old skb head is a slab use-after-free; freed kmalloc objects can be reclaimed for sensitive data, enabling arbitrary kernel memory disclosure.\nI:H - The post-dev_hard_header() memcpy/ph-\u003elength stores up to eight attacker-influenced bytes into freed skb head memory, providing a heap corruption primitive that can be developed into arbitrary kernel writes or code execution.\nA:H - Use-after-free writes into freed slab memory commonly cause kernel oops/panic and can be triggered repeatedly via sendmsg, yielding persistent denial of service even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:31.935Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a56e7c9b08e08fd55a1bcada24cf4fe3782b722"
},
{
"url": "https://git.kernel.org/stable/c/6eed5ae7887a93160803d2b81ff88e75eefd4a4c"
},
{
"url": "https://git.kernel.org/stable/c/ba3409369c5413cdf0dcbf3a928f76b48e8c3e6a"
},
{
"url": "https://git.kernel.org/stable/c/e6493a4d1ee17595766165fa446d45b7e0c318d0"
},
{
"url": "https://git.kernel.org/stable/c/7e9fbd7f96bcde63a7c798fe16b38cedee7a1501"
},
{
"url": "https://git.kernel.org/stable/c/6866abf59976d273164a6624234d96a967280223"
},
{
"url": "https://git.kernel.org/stable/c/bed4caecd723693f750e13adbb2c42ca1249a3fd"
},
{
"url": "https://git.kernel.org/stable/c/e9c238f6fe42fb1b4dba3a578277de32cb487937"
}
],
"title": "pppoe: reload header pointer after dev_hard_header()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68121",
"datePublished": "2026-08-10T11:58:41.489Z",
"dateReserved": "2026-07-30T09:28:09.369Z",
"dateUpdated": "2026-10-19T20:58:51.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64381 (GCVE-0-2026-64381)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: Fix next buffer leak in receive_encrypted_standard()
receive_encrypted_standard() allocates next_buffer before checking
whether the number of compound PDUs already reached MAX_COMPOUND. If
the limit check fails, the function returns immediately and the newly
allocated next_buffer is not assigned to server->smallbuf/server->bigbuf,
making it leaked.
Move the MAX_COMPOUND check before allocating next_buffer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94e4f672db029414b9888b5137a7559f1febf2d8",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "68fc0b6cc03ca58060c0f36454e169f5fe258974",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "07e0ab81df1790afa35732a4e8e07ff831b29008",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "9136a08dc29328edd9867f2545e73906ac9df93b",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "67097772df7791c53d608f04bd31c676ccf79b83",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "297243e365fc9fe2f8e9b7dd535a65d922cd108b",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "927d4805aea0a287d36dd4f826ee24d69a2afee3",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "1c6267a1d5cf4c73b656f8181b310cbbb3e4767b",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: Fix next buffer leak in receive_encrypted_standard()\n\nreceive_encrypted_standard() allocates next_buffer before checking\nwhether the number of compound PDUs already reached MAX_COMPOUND. If\nthe limit check fails, the function returns immediately and the newly\nallocated next_buffer is not assigned to server-\u003esmallbuf/server-\u003ebigbuf,\nmaking it leaked.\n\nMove the MAX_COMPOUND check before allocating next_buffer."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:32.853Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94e4f672db029414b9888b5137a7559f1febf2d8"
},
{
"url": "https://git.kernel.org/stable/c/68fc0b6cc03ca58060c0f36454e169f5fe258974"
},
{
"url": "https://git.kernel.org/stable/c/07e0ab81df1790afa35732a4e8e07ff831b29008"
},
{
"url": "https://git.kernel.org/stable/c/9136a08dc29328edd9867f2545e73906ac9df93b"
},
{
"url": "https://git.kernel.org/stable/c/67097772df7791c53d608f04bd31c676ccf79b83"
},
{
"url": "https://git.kernel.org/stable/c/297243e365fc9fe2f8e9b7dd535a65d922cd108b"
},
{
"url": "https://git.kernel.org/stable/c/927d4805aea0a287d36dd4f826ee24d69a2afee3"
},
{
"url": "https://git.kernel.org/stable/c/1c6267a1d5cf4c73b656f8181b310cbbb3e4767b"
}
],
"title": "smb: client: Fix next buffer leak in receive_encrypted_standard()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64381",
"datePublished": "2026-07-25T08:50:31.209Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-08-17T04:54:32.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68398 (GCVE-0-2026-68398)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:
l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv()
-> ppp_input(&po->chan)
It runs under rcu_read_lock() holding only an l2tp_session reference and
takes NO reference on the internal PPP channel (struct channel,
chan->ppp) that ppp_input() dereferences.
The pppox socket is SOCK_RCU_FREE, so 'po' and the embedded ppp_channel
are RCU-safe. But the internal struct channel is a separate allocation
that ppp_release_channel() frees with a plain kfree():
close(data socket) -> pppol2tp_release() -> pppox_unbind_sock()
-> ppp_unregister_channel() -> ppp_release_channel() -> kfree(pch)
For a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit
(no PPPIOCCONNECT, pch->ppp == NULL) and not bridged, teardown skips
both ppp_disconnect_channel()'s synchronize_net() and
ppp_unbridge_channels()'s synchronize_rcu(), so the kfree() has no grace
period. rcu_read_lock() in pppol2tp_recv() does not protect against a
plain kfree(), so an in-flight ppp_input() on one CPU can dereference
the channel just freed by close() on another CPU.
The bug is reachable by an unprivileged user.
Defer the channel free to an RCU callback via call_rcu() so the grace
period fences any in-flight ppp_input(). The disconnect and unbridge
teardown paths already fence with synchronize_net()/synchronize_rcu();
call_rcu() does the same here without stalling the close() path.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741 Version: d36e5ba7bbed5d7bd26e8609ffed503c2def401b Version: 9bcc0508576b2d50efd958f2ea1c5906749c2c89 Version: c2984681fe15cfb803a9132aaaf1140ab20a72c1 Version: 5803ecd7f6ac6f747582e775caa62ac9d0489261 Version: 26f8819ddd10141ebe7bbce700fbab36bfa5f478 Version: 3.2.99 ≤ Version: 3.16.54 ≤ Version: 4.4.225 ≤ Version: 4.9.225 ≤ Version: 4.14.182 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:09.975001Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:08.443Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4e47f1ac188ece11d6fdabe44166a2776cc5bd4e",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"lessThan": "110b765744b147c63882f5e9cb12931c5dc8d85f",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"lessThan": "4bb84e964ff0fe0a171c965362de72f9820dbce9",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"lessThan": "3ab32218d7182705dae5c86f13925f458072da2c",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"lessThan": "c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"lessThan": "06213c85d8c0994f786c093b8b2a517987943ca6",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"lessThan": "ec4215683e47424c9c4762fd3c60f552a3119142",
"status": "affected",
"version": "ee40fb2e1eb5bc0ddd3f2f83c6e39a454ef5a741",
"versionType": "git"
},
{
"status": "affected",
"version": "d36e5ba7bbed5d7bd26e8609ffed503c2def401b",
"versionType": "git"
},
{
"status": "affected",
"version": "9bcc0508576b2d50efd958f2ea1c5906749c2c89",
"versionType": "git"
},
{
"status": "affected",
"version": "c2984681fe15cfb803a9132aaaf1140ab20a72c1",
"versionType": "git"
},
{
"status": "affected",
"version": "5803ecd7f6ac6f747582e775caa62ac9d0489261",
"versionType": "git"
},
{
"status": "affected",
"version": "26f8819ddd10141ebe7bbce700fbab36bfa5f478",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.99",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.54",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.225",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.225",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.182",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.225",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.182",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF\n\npppol2tp_recv() runs in the L2TP UDP-encap softirq RX path:\n\n l2tp_udp_encap_recv() -\u003e l2tp_recv_common() -\u003e pppol2tp_recv()\n -\u003e ppp_input(\u0026po-\u003echan)\n\nIt runs under rcu_read_lock() holding only an l2tp_session reference and\ntakes NO reference on the internal PPP channel (struct channel,\nchan-\u003eppp) that ppp_input() dereferences.\n\nThe pppox socket is SOCK_RCU_FREE, so \u0027po\u0027 and the embedded ppp_channel\nare RCU-safe. But the internal struct channel is a separate allocation\nthat ppp_release_channel() frees with a plain kfree():\n\n close(data socket) -\u003e pppol2tp_release() -\u003e pppox_unbind_sock()\n -\u003e ppp_unregister_channel() -\u003e ppp_release_channel() -\u003e kfree(pch)\n\nFor a channel that is bound (PPPIOCGCHAN) but not attached to a ppp unit\n(no PPPIOCCONNECT, pch-\u003eppp == NULL) and not bridged, teardown skips\nboth ppp_disconnect_channel()\u0027s synchronize_net() and\nppp_unbridge_channels()\u0027s synchronize_rcu(), so the kfree() has no grace\nperiod. rcu_read_lock() in pppol2tp_recv() does not protect against a\nplain kfree(), so an in-flight ppp_input() on one CPU can dereference\nthe channel just freed by close() on another CPU.\n\nThe bug is reachable by an unprivileged user.\n\nDefer the channel free to an RCU callback via call_rcu() so the grace\nperiod fences any in-flight ppp_input(). The disconnect and unbridge\nteardown paths already fence with synchronize_net()/synchronize_rcu();\ncall_rcu() does the same here without stalling the close() path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The free side of the race is a local close() of the pppol2tp socket, which no remote peer can invoke; the full attack (create tunnel/session via AF_PPPOX socket, drive RX with loopback UDP datagrams, close concurrently) is performed entirely through local syscalls.\nAC:L - The attacker controls both sides of the race, feeding the UDP-encap RX softirq from one thread while closing the pppox socket on another, and can retry the loop indefinitely until the window is hit.\nPR:L - No capability check exists on this path: pppox_create()/pppol2tp_connect() and ppp_register_net_channel() need no CAP_NET_ADMIN, and PPPIOCGCHAN is handled by pppox_ioctl() on the socket itself, so /dev/ppp access is not required; the fix commit states the bug is reachable by an unprivileged user.\nUI:N - The attacker performs every step \u2014 socket creation, session setup, packet injection and close() \u2014 with no action by any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the channel is freed and its slab object reallocated, ppp_input() reads pch-\u003ebridge and pch-\u003eppp from attacker-groomed memory and can route received frames to an arbitrary attacker-chosen structure, giving a path to disclosing kernel memory.\nI:H - skb_queue_tail(\u0026pch-\u003efile.rq, skb) writes a linked-list insertion into the freed object and wake_up_interruptible(\u0026pch-\u003efile.rwait) traverses a freed waitqueue, so heap grooming yields controlled writes and function-pointer traversal usable for privilege escalation.\nA:H - Dereferencing and writing to the kfree()d struct channel from softirq context reliably corrupts the slab and panics or oopses the kernel, and the race can be re-triggered at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:34:49.839Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4e47f1ac188ece11d6fdabe44166a2776cc5bd4e"
},
{
"url": "https://git.kernel.org/stable/c/110b765744b147c63882f5e9cb12931c5dc8d85f"
},
{
"url": "https://git.kernel.org/stable/c/4bb84e964ff0fe0a171c965362de72f9820dbce9"
},
{
"url": "https://git.kernel.org/stable/c/3ab32218d7182705dae5c86f13925f458072da2c"
},
{
"url": "https://git.kernel.org/stable/c/c9574b8a8edeb4edd3ac6472c27ef7184bdb2baa"
},
{
"url": "https://git.kernel.org/stable/c/06213c85d8c0994f786c093b8b2a517987943ca6"
},
{
"url": "https://git.kernel.org/stable/c/ec4215683e47424c9c4762fd3c60f552a3119142"
}
],
"title": "ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68398",
"datePublished": "2026-08-10T12:04:17.771Z",
"dateReserved": "2026-07-30T09:28:09.389Z",
"dateUpdated": "2026-10-19T21:09:08.443Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64567 (GCVE-0-2026-64567)
Vulnerability from cvelistv5
Published
2026-08-05 08:08
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: reject free space cache with more entries than pages
When loading a v1 free space cache, __load_free_space_cache() takes
num_entries and num_bitmaps straight from the on-disk
btrfs_free_space_header. That header is stored in the tree_root under a key
with type 0, which the tree-checker has no case for, so neither count is
validated before the load trusts it.
The load loops num_entries times and maps the next page whenever the current
one runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which
does io_ctl->pages[io_ctl->index++]. But pages[] is allocated in
io_ctl_init() from the cache inode's i_size, not from num_entries:
num_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
io_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);
So if num_entries claims more records than the pages can hold, io_ctl->index
runs off the end of pages[]. The write side never hits this because
io_ctl_add_entry() and io_ctl_add_bitmap() both stop once
io_ctl->index >= io_ctl->num_pages; the read side just never had the same
check.
To trigger it, take a clean cache (num_entries = <N> here), set num_entries
in the header to 0x10000, and fix up the leaf checksum so it still passes
the tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and
pages[] is a 16-pointer (kmalloc-128) array. The load now tries to read
65536 entries, io_ctl->index walks up to 16, and pages[16] is read past the
array:
BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)
Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58
io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)
__load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820)
load_free_space_cache (fs/btrfs/free-space-cache.c:1017)
caching_thread (fs/btrfs/block-group.c:880)
btrfs_work_helper (fs/btrfs/async-thread.c:312)
process_one_work
worker_thread
kthread
ret_from_fork
free-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc()
at line 565, which is why that is the frame KASAN names. The out-of-bounds
slot is then treated as a struct page and handed to crc32c(), so the bad
read turns into a GP fault.
Add the missing check to io_ctl_check_crc(), which is where both the entry
loop and the bitmap loop end up. When num_entries is too large the load now
fails like any corrupt cache: __load_free_space_cache() drops it and rebuilds
the free space from the extent tree, so a valid cache is never rejected.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5b0e95bf607ddd59b39f52d3d55e6581c817b530 Version: 5b0e95bf607ddd59b39f52d3d55e6581c817b530 Version: 5b0e95bf607ddd59b39f52d3d55e6581c817b530 Version: 5b0e95bf607ddd59b39f52d3d55e6581c817b530 Version: 5b0e95bf607ddd59b39f52d3d55e6581c817b530 Version: 5b0e95bf607ddd59b39f52d3d55e6581c817b530 Version: 5b0e95bf607ddd59b39f52d3d55e6581c817b530 Version: 5b0e95bf607ddd59b39f52d3d55e6581c817b530 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64567",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:42:59.944567Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:42.223Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/free-space-cache.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8ded74c654a982dc8581a17b0caa7fcedb20de69",
"status": "affected",
"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530",
"versionType": "git"
},
{
"lessThan": "c9c38066b6446e83668c041702bb639b0ca49363",
"status": "affected",
"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530",
"versionType": "git"
},
{
"lessThan": "094734c7aaa2b36751dc32480a680a4952685e78",
"status": "affected",
"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530",
"versionType": "git"
},
{
"lessThan": "33878ba25e2638bc0c61623d7a05c9ca2b74c039",
"status": "affected",
"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530",
"versionType": "git"
},
{
"lessThan": "404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2",
"status": "affected",
"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530",
"versionType": "git"
},
{
"lessThan": "5e1b2ca6b34939e70fb0785e8222b53cf060016f",
"status": "affected",
"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530",
"versionType": "git"
},
{
"lessThan": "f9fef131fa3f59b857217f522fa5ea430d1b707c",
"status": "affected",
"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530",
"versionType": "git"
},
{
"lessThan": "a2d8d5647ed854e38f941741aea45b9eb15a6350",
"status": "affected",
"version": "5b0e95bf607ddd59b39f52d3d55e6581c817b530",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/free-space-cache.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reject free space cache with more entries than pages\n\nWhen loading a v1 free space cache, __load_free_space_cache() takes\nnum_entries and num_bitmaps straight from the on-disk\nbtrfs_free_space_header. That header is stored in the tree_root under a key\nwith type 0, which the tree-checker has no case for, so neither count is\nvalidated before the load trusts it.\n\nThe load loops num_entries times and maps the next page whenever the current\none runs out, going through io_ctl_check_crc() -\u003e io_ctl_map_page(), which\ndoes io_ctl-\u003epages[io_ctl-\u003eindex++]. But pages[] is allocated in\nio_ctl_init() from the cache inode\u0027s i_size, not from num_entries:\n\n\tnum_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);\n\tio_ctl-\u003epages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);\n\nSo if num_entries claims more records than the pages can hold, io_ctl-\u003eindex\nruns off the end of pages[]. The write side never hits this because\nio_ctl_add_entry() and io_ctl_add_bitmap() both stop once\nio_ctl-\u003eindex \u003e= io_ctl-\u003enum_pages; the read side just never had the same\ncheck.\n\nTo trigger it, take a clean cache (num_entries = \u003cN\u003e here), set num_entries\nin the header to 0x10000, and fix up the leaf checksum so it still passes\nthe tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and\npages[] is a 16-pointer (kmalloc-128) array. The load now tries to read\n65536 entries, io_ctl-\u003eindex walks up to 16, and pages[16] is read past the\narray:\n\n BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58\n io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)\n __load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820)\n load_free_space_cache (fs/btrfs/free-space-cache.c:1017)\n caching_thread (fs/btrfs/block-group.c:880)\n btrfs_work_helper (fs/btrfs/async-thread.c:312)\n process_one_work\n worker_thread\n kthread\n ret_from_fork\n\nfree-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc()\nat line 565, which is why that is the frame KASAN names. The out-of-bounds\nslot is then treated as a struct page and handed to crc32c(), so the bad\nread turns into a GP fault.\n\nAdd the missing check to io_ctl_check_crc(), which is where both the entry\nloop and the bitmap loop end up. When num_entries is too large the load now\nfails like any corrupt cache: __load_free_space_cache() drops it and rebuilds\nthe free space from the extent tree, so a valid cache is never rejected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only by mounting a crafted btrfs image so caching_thread \u2192 load_free_space_cache \u2192 __load_free_space_cache runs; there is no network or adjacent protocol path into v1 free-space cache loading.\nAC:L - The attacker authors a v1 cache with inflated num_entries (and a matching leaf checksum); cache_generation auto-enables SPACE_CACHE on mount, and the OOB in io_ctl_check_crc/io_ctl_map_page is deterministic with no race or uncontrolled condition.\nPR:L - btrfs lacks FS_USERNS_MOUNT, but an unprivileged local user can loop-setup and mount a crafted image via udisks2/polkit on typical desktops/kiosks; real init-namespace root is not required.\nUI:N - In the loop/udisks mount scenario the attacker mounts the image themselves; no separate victim must open a file, click through a prompt, or otherwise interact.\nS:U - The slab OOB and resulting kernel memory misuse stay inside the host kernel\u0027s authority; no VM escape, IOMMU bypass, or sandbox boundary is crossed.\nC:H - An out-of-bounds pages[] read yields a forged struct page pointer that is passed to page_address/crc32c and then used as the source for further cache parsing, giving an arbitrary kernel-memory read primitive once adjacent slab contents are groomed.\nI:H - The forged page pointer continues into entry/bitmap load paths (including copy_page into kernel bitmaps and linking attacker-controlled free-space records), a memory-corruption primitive exploitable for arbitrary write and control-flow hijack.\nA:H - Without a valid page pointer the OOB dereference reliably faults (KASAN slab-OOB then GP fault on crc32c as in the report), crashing or oopsing the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:41.793Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8ded74c654a982dc8581a17b0caa7fcedb20de69"
},
{
"url": "https://git.kernel.org/stable/c/c9c38066b6446e83668c041702bb639b0ca49363"
},
{
"url": "https://git.kernel.org/stable/c/094734c7aaa2b36751dc32480a680a4952685e78"
},
{
"url": "https://git.kernel.org/stable/c/33878ba25e2638bc0c61623d7a05c9ca2b74c039"
},
{
"url": "https://git.kernel.org/stable/c/404a0b986e0b6e79738fdf1f0ebbbc43b9acd2a2"
},
{
"url": "https://git.kernel.org/stable/c/5e1b2ca6b34939e70fb0785e8222b53cf060016f"
},
{
"url": "https://git.kernel.org/stable/c/f9fef131fa3f59b857217f522fa5ea430d1b707c"
},
{
"url": "https://git.kernel.org/stable/c/a2d8d5647ed854e38f941741aea45b9eb15a6350"
}
],
"title": "btrfs: reject free space cache with more entries than pages",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64567",
"datePublished": "2026-08-05T08:08:06.015Z",
"dateReserved": "2026-07-19T15:36:31.797Z",
"dateUpdated": "2026-10-19T20:48:42.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68111 (GCVE-0-2026-68111)
Vulnerability from cvelistv5
Published
2026-08-10 11:58
Modified
2026-08-19 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()
There's no need to crash the kernel for these cases.
(cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b1023571479020e9e9c15a51b43bf8e15406952b Version: b1023571479020e9e9c15a51b43bf8e15406952b Version: b1023571479020e9e9c15a51b43bf8e15406952b Version: b1023571479020e9e9c15a51b43bf8e15406952b Version: b1023571479020e9e9c15a51b43bf8e15406952b Version: b1023571479020e9e9c15a51b43bf8e15406952b Version: b1023571479020e9e9c15a51b43bf8e15406952b Version: b1023571479020e9e9c15a51b43bf8e15406952b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "67965f576f9337e387dc8efaf9a46cb6b7ea12cb",
"status": "affected",
"version": "b1023571479020e9e9c15a51b43bf8e15406952b",
"versionType": "git"
},
{
"lessThan": "9b5e4fa18fea1e7f6017e1af02fa10276628d9a0",
"status": "affected",
"version": "b1023571479020e9e9c15a51b43bf8e15406952b",
"versionType": "git"
},
{
"lessThan": "6978b10861850b93292fcd6b22a5495d69fce276",
"status": "affected",
"version": "b1023571479020e9e9c15a51b43bf8e15406952b",
"versionType": "git"
},
{
"lessThan": "6c8b9c1f03c7169c9577098b0c3035617606f8d4",
"status": "affected",
"version": "b1023571479020e9e9c15a51b43bf8e15406952b",
"versionType": "git"
},
{
"lessThan": "d74a6351d3f64e1f8a0fba28b369c0eeecf517f1",
"status": "affected",
"version": "b1023571479020e9e9c15a51b43bf8e15406952b",
"versionType": "git"
},
{
"lessThan": "042c047e8bc9c9ada7574028a8e4592102e2e1fd",
"status": "affected",
"version": "b1023571479020e9e9c15a51b43bf8e15406952b",
"versionType": "git"
},
{
"lessThan": "43768ad42b8f1a91652b86e0731ac14d6853cebb",
"status": "affected",
"version": "b1023571479020e9e9c15a51b43bf8e15406952b",
"versionType": "git"
},
{
"lessThan": "6302be10b521f5106ce01eb5a724b9e7945a5061",
"status": "affected",
"version": "b1023571479020e9e9c15a51b43bf8e15406952b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()\n\nThere\u0027s no need to crash the kernel for these cases.\n\n(cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:24.565Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/67965f576f9337e387dc8efaf9a46cb6b7ea12cb"
},
{
"url": "https://git.kernel.org/stable/c/9b5e4fa18fea1e7f6017e1af02fa10276628d9a0"
},
{
"url": "https://git.kernel.org/stable/c/6978b10861850b93292fcd6b22a5495d69fce276"
},
{
"url": "https://git.kernel.org/stable/c/6c8b9c1f03c7169c9577098b0c3035617606f8d4"
},
{
"url": "https://git.kernel.org/stable/c/d74a6351d3f64e1f8a0fba28b369c0eeecf517f1"
},
{
"url": "https://git.kernel.org/stable/c/042c047e8bc9c9ada7574028a8e4592102e2e1fd"
},
{
"url": "https://git.kernel.org/stable/c/43768ad42b8f1a91652b86e0731ac14d6853cebb"
},
{
"url": "https://git.kernel.org/stable/c/6302be10b521f5106ce01eb5a724b9e7945a5061"
}
],
"title": "drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68111",
"datePublished": "2026-08-10T11:58:28.489Z",
"dateReserved": "2026-07-30T09:28:09.368Z",
"dateUpdated": "2026-08-19T16:29:24.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68082 (GCVE-0-2026-68082)
Vulnerability from cvelistv5
Published
2026-08-08 09:17
Modified
2026-10-19 20:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: fix two unsafe bare decodes in decode_lockers()
decode_lockers() in cls_lock_client.c contains two bare decode operations
that allow a malicious or compromised OSD to trigger slab-out-of-bounds
reads:
1. ceph_decode_32(p) at the num_lockers field has no preceding bounds
check. ceph_start_decoding() accepts struct_len=0 as valid -- the
internal ceph_decode_need(p, end, 0, bad) always passes -- so when an
OSD sends struct_len=0, ceph_start_decoding() returns success with
p == end. The immediately following bare ceph_decode_32(p) then reads
4 bytes past the validated buffer boundary. The garbage value is
passed directly to kzalloc_objs() as the locker count.
The sibling function decode_watchers() in osd_client.c already uses
ceph_decode_32_safe() after its own ceph_start_decoding() call.
decode_lockers() was the only site using the bare variant.
2. ceph_decode_8(p) after the decode_locker() loop has no preceding
bounds check. If an OSD crafts num_lockers such that the loop
advances p exactly to end, the subsequent bare ceph_decode_8(p) reads
one byte past the validated buffer boundary. The result is passed
directly into *type, which is used as a lock type discriminator by
callers, giving an OSD-controlled one-byte OOB read with direct
influence over the lock type field.
Fix both by replacing bare operations with their safe variants:
ceph_decode_32(p) -> ceph_decode_32_safe(p, end, *num_lockers,
err_inval)
ceph_decode_8(p) -> ceph_decode_8_safe(p, end, *type,
err_free_lockers)
The goto targets differ intentionally:
err_inval: is a new label returning -EINVAL directly. It is used for
the pre-allocation failure path where *lockers is not yet allocated
and must not be passed to ceph_free_lockers().
err_free_lockers: is the existing label. It is used for the
post-allocation failure path where *lockers is allocated and must
be freed.
ret is set to -EINVAL before ceph_decode_8_safe() so that
err_free_lockers returns the correct error code on bounds violation.
Without this, err_free_lockers would return a stale ret value (0 from
the successful decode_locker() loop), silently swallowing the error.
-EINVAL is correct for both failure paths. The data received from the
OSD is structurally malformed. -ENOMEM would misrepresent the failure
class to callers and to stable@ backporters triaging error paths.
Attacker model: a malicious or compromised OSD in a multi-tenant Ceph
deployment can trigger this against any kernel client that issues the
lock.get_info class method (e.g. during RBD exclusive lock acquisition).
[ idryomov: trim changelog, formatting ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d4ed4a530562881cc5225050e42d96034f405aae Version: d4ed4a530562881cc5225050e42d96034f405aae Version: d4ed4a530562881cc5225050e42d96034f405aae Version: d4ed4a530562881cc5225050e42d96034f405aae Version: d4ed4a530562881cc5225050e42d96034f405aae Version: d4ed4a530562881cc5225050e42d96034f405aae Version: d4ed4a530562881cc5225050e42d96034f405aae Version: d4ed4a530562881cc5225050e42d96034f405aae |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68082",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:43:33.803451Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:44.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/cls_lock_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c8ade01170a27d8ede0d761c255268af81e417f8",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "001835c599899ef1bd3506a815110a6374451554",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "7c422364acd93d7da1dfc27d6b54635a269653a1",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "02430f6f729b297e803d0605871f0a670b4eafd6",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "57ba829804fe6d34bbac3b826c4b15c1caa54862",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "89df5d71f83f8e2781286798fd8ae5e42cf5f1a7",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "a54be593d0b749161b08a1e56189b2cb9114267a",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
},
{
"lessThan": "a109a556115271ca7896dcda7b4b7e45e156c227",
"status": "affected",
"version": "d4ed4a530562881cc5225050e42d96034f405aae",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/cls_lock_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix two unsafe bare decodes in decode_lockers()\n\ndecode_lockers() in cls_lock_client.c contains two bare decode operations\nthat allow a malicious or compromised OSD to trigger slab-out-of-bounds\nreads:\n\n1. ceph_decode_32(p) at the num_lockers field has no preceding bounds\n check. ceph_start_decoding() accepts struct_len=0 as valid -- the\n internal ceph_decode_need(p, end, 0, bad) always passes -- so when an\n OSD sends struct_len=0, ceph_start_decoding() returns success with\n p == end. The immediately following bare ceph_decode_32(p) then reads\n 4 bytes past the validated buffer boundary. The garbage value is\n passed directly to kzalloc_objs() as the locker count.\n\n The sibling function decode_watchers() in osd_client.c already uses\n ceph_decode_32_safe() after its own ceph_start_decoding() call.\n decode_lockers() was the only site using the bare variant.\n\n2. ceph_decode_8(p) after the decode_locker() loop has no preceding\n bounds check. If an OSD crafts num_lockers such that the loop\n advances p exactly to end, the subsequent bare ceph_decode_8(p) reads\n one byte past the validated buffer boundary. The result is passed\n directly into *type, which is used as a lock type discriminator by\n callers, giving an OSD-controlled one-byte OOB read with direct\n influence over the lock type field.\n\nFix both by replacing bare operations with their safe variants:\n ceph_decode_32(p) -\u003e ceph_decode_32_safe(p, end, *num_lockers,\n err_inval)\n ceph_decode_8(p) -\u003e ceph_decode_8_safe(p, end, *type,\n err_free_lockers)\n\nThe goto targets differ intentionally:\n err_inval: is a new label returning -EINVAL directly. It is used for\n the pre-allocation failure path where *lockers is not yet allocated\n and must not be passed to ceph_free_lockers().\n\n err_free_lockers: is the existing label. It is used for the\n post-allocation failure path where *lockers is allocated and must\n be freed.\n\nret is set to -EINVAL before ceph_decode_8_safe() so that\nerr_free_lockers returns the correct error code on bounds violation.\nWithout this, err_free_lockers would return a stale ret value (0 from\nthe successful decode_locker() loop), silently swallowing the error.\n\n-EINVAL is correct for both failure paths. The data received from the\nOSD is structurally malformed. -ENOMEM would misrepresent the failure\nclass to callers and to stable@ backporters triaging error paths.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment can trigger this against any kernel client that issues the\nlock.get_info class method (e.g. during RBD exclusive lock acquisition).\n\n[ idryomov: trim changelog, formatting ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is reached when libceph decodes a crafted MOSDOpReply for the lock.get_info class method received over the Ceph messenger TCP session from a compromised or malicious OSD; no local syscall or ioctl is required on the victim.\nAC:L - A malicious OSD can deterministically send struct_len=0 or craft num_lockers so the decode pointer reaches end, triggering both bare decodes on every attempt without races, special memory layout, or rare kernel configuration.\nPR:N - The attacker acts as the remote Ceph OSD peer and needs no account or privileges on the victim Linux host; any kernel RBD client connected to a multi-tenant or attacker-controlled cluster is exposed during automatic exclusive-lock operations.\nUI:N - Once an RBD image is mapped, ceph_cls_lock_info() is invoked automatically during exclusive-lock acquisition and object-map lock recovery; no further victim user or administrator action is required at exploit time.\nS:U - The slab out-of-bounds reads and any resulting kernel memory corruption occur entirely within the victim host kernel running the Ceph client, without crossing VM, container, or IOMMU security boundaries.\nC:H - Bare ceph_decode_32/8 past the validated reply boundary perform slab out-of-bounds reads of adjacent kernel memory; the leaked u32 can drive kzalloc_objs() sizing and the OOB u8 directly controls the lock-type field consumed by RBD lock logic.\nI:H - Attacker-influenced out-of-bounds values feed heap allocation sizing and lock-type discrimination in kernel lock-handling paths, providing memory-corruption primitives in a privileged parser that can be leveraged beyond simple information disclosure.\nA:H - Slab out-of-bounds reads can trigger KASAN faults or kernel oops on instrumented builds, and attacker-controlled locker counts can force very large kzalloc attempts causing severe memory pressure, OOM conditions, and loss of availability on RBD client hosts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:45:46.891Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c8ade01170a27d8ede0d761c255268af81e417f8"
},
{
"url": "https://git.kernel.org/stable/c/001835c599899ef1bd3506a815110a6374451554"
},
{
"url": "https://git.kernel.org/stable/c/7c422364acd93d7da1dfc27d6b54635a269653a1"
},
{
"url": "https://git.kernel.org/stable/c/02430f6f729b297e803d0605871f0a670b4eafd6"
},
{
"url": "https://git.kernel.org/stable/c/57ba829804fe6d34bbac3b826c4b15c1caa54862"
},
{
"url": "https://git.kernel.org/stable/c/89df5d71f83f8e2781286798fd8ae5e42cf5f1a7"
},
{
"url": "https://git.kernel.org/stable/c/a54be593d0b749161b08a1e56189b2cb9114267a"
},
{
"url": "https://git.kernel.org/stable/c/a109a556115271ca7896dcda7b4b7e45e156c227"
}
],
"title": "libceph: fix two unsafe bare decodes in decode_lockers()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68082",
"datePublished": "2026-08-08T09:17:45.394Z",
"dateReserved": "2026-07-30T09:28:09.367Z",
"dateUpdated": "2026-10-19T20:48:44.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80909 (GCVE-0-2026-80909)
Vulnerability from cvelistv5
Published
2026-09-04 17:19
Modified
2026-09-07 14:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Reject UVD message with invalid number of h265 refs
Same change as for h264, avoids overflow later when calculating
min dpb size.
(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 Version: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 Version: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 Version: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 Version: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 Version: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 Version: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 Version: 86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1facad2a78c1a8aeecc36eb4d560c7f1e10ce198",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "499907e5d46e575e96967c0230a0a6af980a17ab",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "cbf1c84bf5cac2b3742ea3d2085fa713424465cc",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "a930c54cb67200de8bc0de87480d09ece7dcd85d",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "2abcdc5f738574e7fcdd9417575dffb877fdc26f",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "e304c3e0d9ce251887be1f274aa0ed52219d5fd7",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "0acdf1a575f59bd46717d5c487d84575af5bee8f",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
},
{
"lessThan": "9fca434208f1f9ab977feac62df8ebb1cc7ce893",
"status": "affected",
"version": "86fa0bdc6fd7b2debc07ce86f1bcd5fb254822e3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Reject UVD message with invalid number of h265 refs\n\nSame change as for h264, avoids overflow later when calculating\nmin dpb size.\n\n(cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T14:21:32.011Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1facad2a78c1a8aeecc36eb4d560c7f1e10ce198"
},
{
"url": "https://git.kernel.org/stable/c/499907e5d46e575e96967c0230a0a6af980a17ab"
},
{
"url": "https://git.kernel.org/stable/c/cbf1c84bf5cac2b3742ea3d2085fa713424465cc"
},
{
"url": "https://git.kernel.org/stable/c/a930c54cb67200de8bc0de87480d09ece7dcd85d"
},
{
"url": "https://git.kernel.org/stable/c/2abcdc5f738574e7fcdd9417575dffb877fdc26f"
},
{
"url": "https://git.kernel.org/stable/c/e304c3e0d9ce251887be1f274aa0ed52219d5fd7"
},
{
"url": "https://git.kernel.org/stable/c/0acdf1a575f59bd46717d5c487d84575af5bee8f"
},
{
"url": "https://git.kernel.org/stable/c/9fca434208f1f9ab977feac62df8ebb1cc7ce893"
}
],
"title": "drm/amdgpu: Reject UVD message with invalid number of h265 refs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80909",
"datePublished": "2026-09-04T17:19:20.085Z",
"dateReserved": "2026-08-26T14:34:25.801Z",
"dateUpdated": "2026-09-07T14:21:32.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68450 (GCVE-0-2026-68450)
Vulnerability from cvelistv5
Published
2026-08-12 00:51
Modified
2026-08-19 16:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: free mapping node on duplicate reloc root insert
__add_reloc_root() allocates a mapping_node before inserting it into
rc->reloc_root_tree. If rb_simple_insert() finds an existing entry, it
returns the existing rb_node and leaves the newly allocated node unlinked.
The error path then returns -EEXIST without freeing the new node. Since
the node was never inserted into reloc_root_tree, the later cleanup in
put_reloc_control() cannot find it either.
Free the newly allocated node before returning -EEXIST.
The callers currently assert that -EEXIST should not happen, so this is a
defensive cleanup for an unexpected duplicate insert path. If the path is
ever reached, the local allocation should still be released.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 Version: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 Version: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 Version: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 Version: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 Version: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 Version: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/relocation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "29d9746812d8b7c37d594f484e994fd552c3ec33",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "b7c5b8e1d5f0779dfbabc3068b7ac0f12e53b3a8",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "92bedc0455552b42ada1a1f42b0e3a8593cdfccc",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "14a8be9428435ee17f17fae7991215c246b7fd43",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "797dc567146c7e3c4f8d9680e4fbc76e0a6d9151",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "ae0629ff9ccb836416ada129f4edc7efea6eaaad",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
},
{
"lessThan": "6a8269b6459ed870a8156c106a0f597383907872",
"status": "affected",
"version": "57a304cfd43b2b4a5b44b8f5dc026abb34183068",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/relocation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: free mapping node on duplicate reloc root insert\n\n__add_reloc_root() allocates a mapping_node before inserting it into\nrc-\u003ereloc_root_tree. If rb_simple_insert() finds an existing entry, it\nreturns the existing rb_node and leaves the newly allocated node unlinked.\n\nThe error path then returns -EEXIST without freeing the new node. Since\nthe node was never inserted into reloc_root_tree, the later cleanup in\nput_reloc_control() cannot find it either.\n\nFree the newly allocated node before returning -EEXIST.\n\nThe callers currently assert that -EEXIST should not happen, so this is a\ndefensive cleanup for an unexpected duplicate insert path. If the path is\never reached, the local allocation should still be released."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:35:45.490Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/29d9746812d8b7c37d594f484e994fd552c3ec33"
},
{
"url": "https://git.kernel.org/stable/c/b7c5b8e1d5f0779dfbabc3068b7ac0f12e53b3a8"
},
{
"url": "https://git.kernel.org/stable/c/92bedc0455552b42ada1a1f42b0e3a8593cdfccc"
},
{
"url": "https://git.kernel.org/stable/c/14a8be9428435ee17f17fae7991215c246b7fd43"
},
{
"url": "https://git.kernel.org/stable/c/797dc567146c7e3c4f8d9680e4fbc76e0a6d9151"
},
{
"url": "https://git.kernel.org/stable/c/ae0629ff9ccb836416ada129f4edc7efea6eaaad"
},
{
"url": "https://git.kernel.org/stable/c/6a8269b6459ed870a8156c106a0f597383907872"
}
],
"title": "btrfs: free mapping node on duplicate reloc root insert",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68450",
"datePublished": "2026-08-12T00:51:48.970Z",
"dateReserved": "2026-07-30T09:28:09.395Z",
"dateUpdated": "2026-08-19T16:35:45.490Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74548 (GCVE-0-2026-74548)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
forcedeth: fix UAF of txrx_stats in nv_remove
nv_remove() frees the per-CPU txrx_stats before unregister_netdev().
Until unregister completes, ndo_get_stats64, the NAPI/xmit data path,
and nv_close()/drain may still access txrx_stats, leading to a
use-after-free.
Free the stats only after unregister_netdev().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f4b633b911fd3b4cbe1dc065e8fb064078d0889d Version: f4b633b911fd3b4cbe1dc065e8fb064078d0889d Version: f4b633b911fd3b4cbe1dc065e8fb064078d0889d Version: f4b633b911fd3b4cbe1dc065e8fb064078d0889d Version: f4b633b911fd3b4cbe1dc065e8fb064078d0889d Version: f4b633b911fd3b4cbe1dc065e8fb064078d0889d Version: f4b633b911fd3b4cbe1dc065e8fb064078d0889d Version: f4b633b911fd3b4cbe1dc065e8fb064078d0889d |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74548",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:59:51.900384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:55.094Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/nvidia/forcedeth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9",
"status": "affected",
"version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
"versionType": "git"
},
{
"lessThan": "7c22b4ee0bd003cecfc14ca28981cb213e201f70",
"status": "affected",
"version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
"versionType": "git"
},
{
"lessThan": "d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc",
"status": "affected",
"version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
"versionType": "git"
},
{
"lessThan": "cf2dcde2284562ff87830ca0b7fa2b06e95aef1e",
"status": "affected",
"version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
"versionType": "git"
},
{
"lessThan": "c9d24a205fd508b9999fcab6aca4c590490a12cf",
"status": "affected",
"version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
"versionType": "git"
},
{
"lessThan": "ae20a8a4de06a289d40b0a0633d8d573f1fcb049",
"status": "affected",
"version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
"versionType": "git"
},
{
"lessThan": "201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1",
"status": "affected",
"version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
"versionType": "git"
},
{
"lessThan": "22666ba1420164753d7b0f5a841986b25ace5435",
"status": "affected",
"version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/nvidia/forcedeth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nforcedeth: fix UAF of txrx_stats in nv_remove\n\nnv_remove() frees the per-CPU txrx_stats before unregister_netdev().\nUntil unregister completes, ndo_get_stats64, the NAPI/xmit data path,\nand nv_close()/drain may still access txrx_stats, leading to a\nuse-after-free.\n\nFree the stats only after unregister_netdev()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is opened in nv_remove() during local PCI/driver teardown (sysfs unbind, module unload, or hot-unplug); although NAPI/xmit and stats readers can run concurrently on still-registered netdev traffic, there is no standalone remote path into nv_remove itself.\nAC:L - Once teardown starts, unregister_netdev() deterministically calls nv_close()\u2192nv_drain_tx(), which increments freed txrx_stats when TX skbs remain, and an attacker can also drive the race by timing unbind against stats polling or packet I/O they control.\nPR:L - Privileged teardown opens the window, but unprivileged peers can supply the concurrent netdev access (rtnetlink/sysfs stats via nv_get_stats64, and RX/TX on the still-up interface) that performs the UAF; per CNA driver-removal UAF precedent and the higher-severity tiebreak, PR:L.\nUI:N - No separate victim action is required beyond routine driver removal or module unload on a live interface; monitoring daemons and network traffic can hit the freed stats automatically during the unregister window without user cooperation.\nS:U - Impact is kernel heap corruption and crash/privilege escalation within the host kernel security authority; it does not cross VM, hypervisor, IOMMU, or container sandbox boundaries.\nC:H - The bug is a kmalloc-backed per-CPU UAF: nv_get_stats64 reads freed nv_txrx_stats counters via per_cpu_ptr(), and once the slab is reallocated an attacker can obtain arbitrary kernel memory disclosure.\nI:H - Freed txrx_stats are updated from NAPI/xmit and nv_drain_tx() via __this_cpu_inc/add on attacker-influenced traffic, enabling heap grooming and controlled writes through the dangling per-CPU pointer for code execution.\nA:H - Use-after-free dereferences of txrx_stats during netdev teardown reliably cause kernel oops/panic (as in the fix description), and even unsuccessful exploitation still crashes the system when concurrent RX/TX or drain paths touch freed memory."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:38:39.684Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9"
},
{
"url": "https://git.kernel.org/stable/c/7c22b4ee0bd003cecfc14ca28981cb213e201f70"
},
{
"url": "https://git.kernel.org/stable/c/d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc"
},
{
"url": "https://git.kernel.org/stable/c/cf2dcde2284562ff87830ca0b7fa2b06e95aef1e"
},
{
"url": "https://git.kernel.org/stable/c/c9d24a205fd508b9999fcab6aca4c590490a12cf"
},
{
"url": "https://git.kernel.org/stable/c/ae20a8a4de06a289d40b0a0633d8d573f1fcb049"
},
{
"url": "https://git.kernel.org/stable/c/201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1"
},
{
"url": "https://git.kernel.org/stable/c/22666ba1420164753d7b0f5a841986b25ace5435"
}
],
"title": "forcedeth: fix UAF of txrx_stats in nv_remove",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74548",
"datePublished": "2026-08-15T12:27:56.387Z",
"dateReserved": "2026-08-15T05:44:03.915Z",
"dateUpdated": "2026-10-16T19:05:55.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46150 (GCVE-0-2026-46150)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-10-19 19:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fanotify: fix false positive on permission events
fsnotify_get_mark_safe() may return false for a mark on an unrelated group,
which results in bypassing the permission check.
Fix by skipping over detached marks that are not in the current group.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:20:50.275Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46150",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:20:28.641291Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:36:52.765Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/notify/fsnotify.c",
"fs/notify/mark.c",
"include/linux/fsnotify_backend.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a24765332e129c1916d5a6615418b75599b8fcdc",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "4a7611ad653785fcdea5ff5f4441e2b7d05b7f11",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "04bb66be92f48ed13c3faf1139d892df228789bc",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "895ebbedf88318607c24acc0f591c74b165e1d0a",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "f130790f1acc8399f32652846c875a251efd040f",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "7baa02b0ae9d17ec5f08836d8ea88ce1927d0678",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "b7b24b28c8cd55844cab908f4f39dded638d5538",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "7746e3bd4cc19b5092e00d32d676e329bfcb6900",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/notify/fsnotify.c",
"fs/notify/mark.c",
"include/linux/fsnotify_backend.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfanotify: fix false positive on permission events\n\nfsnotify_get_mark_safe() may return false for a mark on an unrelated group,\nwhich results in bypassing the permission check.\n\nFix by skipping over detached marks that are not in the current group."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code runs in the context of a local file operation (open/read/exec) that triggers the fanotify permission event; the attacker bypasses the control by performing local file ops plus churning a local inotify watch. The fully-controllable, reliable attack is local (a remote file-server scenario would lose attacker control of the race).\nAC:L - The attacker controls both sides of the race \u2014 the lifecycle of the unrelated (unprivileged inotify) mark and the retried file operation \u2014 and each open() is a fresh permission event, so with unlimited retries the bypass is reliably reachable.\nPR:L - Exploitation only needs an unprivileged local account: creating an inotify watch on the parent directory and opening/executing the target file require no capabilities (the privileged CAP_SYS_ADMIN fanotify group is the victim control, not the attacker).\nUI:N - The attacker performs all actions (inotify churn plus repeated file access) with no interaction from any other user.\nS:U - The flaw and its impact are both mediated entirely within the kernel\u0027s own access-control path; no boundary to a separately-managed security authority (VM, IOMMU) is crossed.\nC:H - Bypassing FAN_ACCESS_PERM/FAN_OPEN_PERM lets read access to files the policy (AV/sandbox/EDR) would deny proceed; via targeted retries the attacker can force disclosure of chosen protected files, approaching total loss of confidentiality of protected resources.\nI:H - Bypassing FAN_OPEN_PERM/FAN_OPEN_EXEC_PERM lets writes to protected files and execution of binaries the policy would block proceed, allowing modification of protected resources and execution of disallowed code.\nA:N - The bug is fail-open (it only allows operations that should be blocked); it causes no crash, hang, or resource exhaustion, so availability is unaffected."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:03.577Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a24765332e129c1916d5a6615418b75599b8fcdc"
},
{
"url": "https://git.kernel.org/stable/c/4a7611ad653785fcdea5ff5f4441e2b7d05b7f11"
},
{
"url": "https://git.kernel.org/stable/c/04bb66be92f48ed13c3faf1139d892df228789bc"
},
{
"url": "https://git.kernel.org/stable/c/895ebbedf88318607c24acc0f591c74b165e1d0a"
},
{
"url": "https://git.kernel.org/stable/c/f130790f1acc8399f32652846c875a251efd040f"
},
{
"url": "https://git.kernel.org/stable/c/7baa02b0ae9d17ec5f08836d8ea88ce1927d0678"
},
{
"url": "https://git.kernel.org/stable/c/b7b24b28c8cd55844cab908f4f39dded638d5538"
},
{
"url": "https://git.kernel.org/stable/c/7746e3bd4cc19b5092e00d32d676e329bfcb6900"
}
],
"title": "fanotify: fix false positive on permission events",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46150",
"datePublished": "2026-05-28T09:36:06.494Z",
"dateReserved": "2026-05-13T15:03:33.101Z",
"dateUpdated": "2026-10-19T19:36:52.765Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74265 (GCVE-0-2026-74265)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-08-17 05:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: mana: initialize gdma queue id to INVALID_QUEUE_ID
mana_gd_create_mana_wq_cq() leaves queue->id as 0 (from kzalloc_obj())
until mana_create_wq_obj() assigns the firmware-returned id. If creation
fails before that, cleanup calls mana_gd_destroy_cq() with id 0, NULLing
gc->cq_table[0] and silently breaking whichever real CQ owns that slot.
Initialize queue->id to INVALID_QUEUE_ID right after allocation, matching
mana_gd_create_eq(). The existing (id >= max_num_cqs) guard then
short-circuits cleanly.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f Version: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f Version: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f Version: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f Version: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f Version: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f Version: ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/microsoft/mana/gdma_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "372e7318af379eee29ab6e60848ce7d7db76c85a",
"status": "affected",
"version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
"versionType": "git"
},
{
"lessThan": "c6662f3ad1c7c3549a1c39545651833220b0de89",
"status": "affected",
"version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
"versionType": "git"
},
{
"lessThan": "8e52a247d9aa979d43eb9ff1e445b9b3bf229d4d",
"status": "affected",
"version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
"versionType": "git"
},
{
"lessThan": "a493cbb6b11acd4adc93397a4b12bd460d47620d",
"status": "affected",
"version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
"versionType": "git"
},
{
"lessThan": "62ce489acb428a936bdf243e7b92b3eb341447cf",
"status": "affected",
"version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
"versionType": "git"
},
{
"lessThan": "150590d9ab0dbeb0087193058363819d4c82a00f",
"status": "affected",
"version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
"versionType": "git"
},
{
"lessThan": "5985474e1cb4034680fac2145497a94b0860be50",
"status": "affected",
"version": "ca9c54d2d6a5ab2430c4eda364c77125d62e5e0f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/microsoft/mana/gdma_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: initialize gdma queue id to INVALID_QUEUE_ID\n\nmana_gd_create_mana_wq_cq() leaves queue-\u003eid as 0 (from kzalloc_obj())\nuntil mana_create_wq_obj() assigns the firmware-returned id. If creation\nfails before that, cleanup calls mana_gd_destroy_cq() with id 0, NULLing\ngc-\u003ecq_table[0] and silently breaking whichever real CQ owns that slot.\n\nInitialize queue-\u003eid to INVALID_QUEUE_ID right after allocation, matching\nmana_gd_create_eq(). The existing (id \u003e= max_num_cqs) guard then\nshort-circuits cleanly."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:16:07.784Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/372e7318af379eee29ab6e60848ce7d7db76c85a"
},
{
"url": "https://git.kernel.org/stable/c/c6662f3ad1c7c3549a1c39545651833220b0de89"
},
{
"url": "https://git.kernel.org/stable/c/8e52a247d9aa979d43eb9ff1e445b9b3bf229d4d"
},
{
"url": "https://git.kernel.org/stable/c/a493cbb6b11acd4adc93397a4b12bd460d47620d"
},
{
"url": "https://git.kernel.org/stable/c/62ce489acb428a936bdf243e7b92b3eb341447cf"
},
{
"url": "https://git.kernel.org/stable/c/150590d9ab0dbeb0087193058363819d4c82a00f"
},
{
"url": "https://git.kernel.org/stable/c/5985474e1cb4034680fac2145497a94b0860be50"
}
],
"title": "net: mana: initialize gdma queue id to INVALID_QUEUE_ID",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74265",
"datePublished": "2026-08-15T05:57:40.976Z",
"dateReserved": "2026-08-15T05:44:03.878Z",
"dateUpdated": "2026-08-17T05:16:07.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53089 (GCVE-0-2026-53089)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-09-02 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix use-after-free in offloaded map/prog info fill
When querying info for an offloaded BPF map or program,
bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns()
obtain the network namespace with get_net(dev_net(offmap->netdev)).
However, the associated netdev's netns may be racing with teardown
during netns destruction. If the netns refcount has already reached 0,
get_net() performs a refcount_t increment on 0, triggering:
refcount_t: addition on 0; use-after-free.
Although rtnl_lock and bpf_devs_lock ensure the netdev pointer remains
valid, they cannot prevent the netns refcount from reaching zero.
Fix this by using maybe_get_net() instead of get_net(). maybe_get_net()
uses refcount_inc_not_zero() and returns NULL if the refcount is already
zero, which causes ns_get_path_cb() to fail and the caller to return
-ENOENT -- the correct behavior when the netns is being destroyed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 675fc275a3a2d905535207237402c6d8dcb5fa4b Version: 675fc275a3a2d905535207237402c6d8dcb5fa4b Version: 675fc275a3a2d905535207237402c6d8dcb5fa4b Version: 675fc275a3a2d905535207237402c6d8dcb5fa4b Version: 675fc275a3a2d905535207237402c6d8dcb5fa4b Version: 675fc275a3a2d905535207237402c6d8dcb5fa4b Version: 675fc275a3a2d905535207237402c6d8dcb5fa4b Version: 675fc275a3a2d905535207237402c6d8dcb5fa4b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "43d6848a2a6c92ccfd614d9f0bb6fd85b95dfa9d",
"status": "affected",
"version": "675fc275a3a2d905535207237402c6d8dcb5fa4b",
"versionType": "git"
},
{
"lessThan": "642943ae5bdacabc8109dc4a5e0ebb4a6b99ef3e",
"status": "affected",
"version": "675fc275a3a2d905535207237402c6d8dcb5fa4b",
"versionType": "git"
},
{
"lessThan": "fea55b034328feaafef75aee252f305e6f85a991",
"status": "affected",
"version": "675fc275a3a2d905535207237402c6d8dcb5fa4b",
"versionType": "git"
},
{
"lessThan": "5662dac41a3442aa378d7c405164903eb109fc05",
"status": "affected",
"version": "675fc275a3a2d905535207237402c6d8dcb5fa4b",
"versionType": "git"
},
{
"lessThan": "1a2dc103e16448d022a77ad5fc3234641436c4b7",
"status": "affected",
"version": "675fc275a3a2d905535207237402c6d8dcb5fa4b",
"versionType": "git"
},
{
"lessThan": "85dc711f742b192eb97c0e00b521312f5a7a415e",
"status": "affected",
"version": "675fc275a3a2d905535207237402c6d8dcb5fa4b",
"versionType": "git"
},
{
"lessThan": "a51e7fbe94a87e236631a83973d4f558310b2cd2",
"status": "affected",
"version": "675fc275a3a2d905535207237402c6d8dcb5fa4b",
"versionType": "git"
},
{
"lessThan": "a0c584fc18056709c8e047a82a6045d6c209f4ce",
"status": "affected",
"version": "675fc275a3a2d905535207237402c6d8dcb5fa4b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.269",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.187",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.156",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.269",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.220",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.187",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.156",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.108",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.49",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free in offloaded map/prog info fill\n\nWhen querying info for an offloaded BPF map or program,\nbpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns()\nobtain the network namespace with get_net(dev_net(offmap-\u003enetdev)).\nHowever, the associated netdev\u0027s netns may be racing with teardown\nduring netns destruction. If the netns refcount has already reached 0,\nget_net() performs a refcount_t increment on 0, triggering:\n\n refcount_t: addition on 0; use-after-free.\n\nAlthough rtnl_lock and bpf_devs_lock ensure the netdev pointer remains\nvalid, they cannot prevent the netns refcount from reaching zero.\n\nFix this by using maybe_get_net() instead of get_net(). maybe_get_net()\nuses refcount_inc_not_zero() and returns NULL if the refcount is already\nzero, which causes ns_get_path_cb() to fail and the caller to return\n-ENOENT -- the correct behavior when the netns is being destroyed."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:49:34.606Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/43d6848a2a6c92ccfd614d9f0bb6fd85b95dfa9d"
},
{
"url": "https://git.kernel.org/stable/c/642943ae5bdacabc8109dc4a5e0ebb4a6b99ef3e"
},
{
"url": "https://git.kernel.org/stable/c/fea55b034328feaafef75aee252f305e6f85a991"
},
{
"url": "https://git.kernel.org/stable/c/5662dac41a3442aa378d7c405164903eb109fc05"
},
{
"url": "https://git.kernel.org/stable/c/1a2dc103e16448d022a77ad5fc3234641436c4b7"
},
{
"url": "https://git.kernel.org/stable/c/85dc711f742b192eb97c0e00b521312f5a7a415e"
},
{
"url": "https://git.kernel.org/stable/c/a51e7fbe94a87e236631a83973d4f558310b2cd2"
},
{
"url": "https://git.kernel.org/stable/c/a0c584fc18056709c8e047a82a6045d6c209f4ce"
}
],
"title": "bpf: Fix use-after-free in offloaded map/prog info fill",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53089",
"datePublished": "2026-06-24T16:30:28.531Z",
"dateReserved": "2026-06-09T07:44:35.384Z",
"dateUpdated": "2026-09-02T12:49:34.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72289 (GCVE-0-2026-72289)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Check the interrupt is still ours before migrating it
vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating
an interrupt to another vCPU. After reacquiring the locks it only checks
that the affinity is unchanged (target_vcpu == vgic_target_oracle(irq))
before moving the interrupt, which assumes that an interrupt whose affinity
is preserved is still queued on this vCPU's ap_list.
That assumption no longer holds if the interrupt is taken off the ap_list
while the locks are dropped. vgic_flush_pending_lpis() removes the
interrupt from the list and sets irq->vcpu to NULL, but leaves
enabled/pending/target_vcpu untouched. As the interrupt is still enabled
and pending, vgic_target_oracle() returns the same target_vcpu, so the
affinity check passes and list_del() is run a second time on an entry that
has already been removed.
Also check that the interrupt is still assigned to this vCPU
(irq->vcpu == vcpu) before moving it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72289",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:45:52.646883Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:15.201Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3893e1fcf6f306b327a8358dcd1cbd077989a240",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "cb3efe1a354f1638726725c3ecee1ce8d1a7e2dc",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "da2d249a39a1881681c303ceea33f38ba1c5bbeb",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "654be81c4c637af12709d47c7efc3302cd336513",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "e363c0bc0226dc5ea5046a88e9a6864b82c45399",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "79fdd2aa774e44847cd9bb7edc811e73e3dc7bfe",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "0658b09cba7fe866c6cd70cd2dcdfdcabe80328f",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Check the interrupt is still ours before migrating it\n\nvgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating\nan interrupt to another vCPU. After reacquiring the locks it only checks\nthat the affinity is unchanged (target_vcpu == vgic_target_oracle(irq))\nbefore moving the interrupt, which assumes that an interrupt whose affinity\nis preserved is still queued on this vCPU\u0027s ap_list.\n\nThat assumption no longer holds if the interrupt is taken off the ap_list\nwhile the locks are dropped. vgic_flush_pending_lpis() removes the\ninterrupt from the list and sets irq-\u003evcpu to NULL, but leaves\nenabled/pending/target_vcpu untouched. As the interrupt is still enabled\nand pending, vgic_target_oracle() returns the same target_vcpu, so the\naffinity check passes and list_del() is run a second time on an entry that\nhas already been removed.\n\nAlso check that the interrupt is still assigned to this vCPU\n(irq-\u003evcpu == vcpu) before moving it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only from KVM guest execution paths\u2014GICv3 redistributor GICR_CTLR LPI-disable MMIO traps into vgic_flush_pending_lpis() and vCPU exit/sync paths into vgic_prune_ap_list()\u2014not from any remote network, adjacent-radio, or physical-device interface on the host.\nAC:L - A malicious multi-vCPU guest controls both racing sides by pinning threads, changing LPI affinity via ITS so an interrupt must migrate off one vCPU\u0027s ap_list, and concurrently disabling LPIS on that redistributor; the attacker creates the window rather than depending on uncontrollable host timing or memory layout.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant on arm64 KVM who needs no host privileges beyond code already running inside the assigned guest; exploitation uses guest-kernel GIC MMIO/ITS operations, not host root, CAP_SYS_ADMIN in the init namespace, or additional /dev/kvm access beyond having a VM.\nUI:N - Exploitation is fully attacker-driven from within the guest VM through deliberate LPI setup, affinity changes, and timed GICR_CTLR writes; no victim user or administrator action on the host is required beyond normal VM operation.\nS:C - Double list_del()/list_add_tail() on host-kernel ap_list linkages corrupts KVM VGIC state from guest-controlled interrupt operations, crossing the guest-to-host virtualization security boundary with VM-escape-class impact rather than confining damage to the attacker\u0027s VM.\nC:H - Corrupting detached ap_list pointers and inserting them into another vCPU\u0027s ap_list_head enables out-of-bounds kernel linked-list traversal and disclosure of adjacent kmalloc slab memory (struct vgic_irq and neighboring objects); per kernel guidance, this list corruption is leverageable for arbitrary host memory read primitives.\nI:H - The vulnerable path performs list_del() on an already removed entry and may follow with list_add_tail() onto another vCPU\u0027s ap_list, letting a guest steer kernel list pointers and overwrite adjacent vgic_irq/host heap metadata for control-flow or data corruption on the hypervisor.\nA:H - Re-running list_del() on an entry already removed by vgic_flush_pending_lpis() dereferences poisoned list pointers and corrupts live ap_list_heads, causing immediate host kernel BUG/oops/panic or persistent interrupt-delivery failure during subsequent VGIC processing."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:42:24.760Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3893e1fcf6f306b327a8358dcd1cbd077989a240"
},
{
"url": "https://git.kernel.org/stable/c/cb3efe1a354f1638726725c3ecee1ce8d1a7e2dc"
},
{
"url": "https://git.kernel.org/stable/c/da2d249a39a1881681c303ceea33f38ba1c5bbeb"
},
{
"url": "https://git.kernel.org/stable/c/654be81c4c637af12709d47c7efc3302cd336513"
},
{
"url": "https://git.kernel.org/stable/c/e363c0bc0226dc5ea5046a88e9a6864b82c45399"
},
{
"url": "https://git.kernel.org/stable/c/79fdd2aa774e44847cd9bb7edc811e73e3dc7bfe"
},
{
"url": "https://git.kernel.org/stable/c/0658b09cba7fe866c6cd70cd2dcdfdcabe80328f"
},
{
"url": "https://git.kernel.org/stable/c/0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe"
}
],
"title": "KVM: arm64: vgic: Check the interrupt is still ours before migrating it",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72289",
"datePublished": "2026-08-15T05:55:10.870Z",
"dateReserved": "2026-08-09T03:40:39.917Z",
"dateUpdated": "2026-10-16T18:55:15.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64088 (GCVE-0-2026-64088)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-08-05 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tt: fix negative tt_buff_len
batadv_orig_node::tt_buff_len was declared as s16, but the field is never
intended to hold a negative value. When a value greater than 32767 is
assigned, it wraps to a negative signed integer.
In batadv_send_other_tt_response(), tt_buff_len is temporarily widened to
s32. The incorrectly negative s16 value propagates into the s32, causing
batadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but
populates only a small portion of it with the collected changeset. All
remaining bits are kept uninitialized.
Using an u16 avoids this type confusion and ensures that no (negative) sign
extension is performed in batadv_send_other_tt_response().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 Version: a73105b8d4c765d9ebfb664d0a66802127d8e4c7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/types.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4c4c2f340f4c27373bfcac8dc5032ce7bb474e47",
"status": "affected",
"version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
"versionType": "git"
},
{
"lessThan": "33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430",
"status": "affected",
"version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
"versionType": "git"
},
{
"lessThan": "3c96dff00998314983b68a3e7caac07a66ebe496",
"status": "affected",
"version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
"versionType": "git"
},
{
"lessThan": "32edd2a28e112064020a2f319a8cb8a9e5a09767",
"status": "affected",
"version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
"versionType": "git"
},
{
"lessThan": "4dab98961426d0cf6a1599cda6950b7596ca2fcd",
"status": "affected",
"version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
"versionType": "git"
},
{
"lessThan": "730de8733dd90f70d7580a9b329b971f8e1474a2",
"status": "affected",
"version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
"versionType": "git"
},
{
"lessThan": "ed28ead3420c373a7928622f114bc6168075d1e1",
"status": "affected",
"version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
"versionType": "git"
},
{
"lessThan": "b64963a2ceeb7529310b6cf253a1e540784422f4",
"status": "affected",
"version": "a73105b8d4c765d9ebfb664d0a66802127d8e4c7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/types.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tt: fix negative tt_buff_len\n\nbatadv_orig_node::tt_buff_len was declared as s16, but the field is never\nintended to hold a negative value. When a value greater than 32767 is\nassigned, it wraps to a negative signed integer.\n\nIn batadv_send_other_tt_response(), tt_buff_len is temporarily widened to\ns32. The incorrectly negative s16 value propagates into the s32, causing\nbatadv_tt_prepare_tvlv_global_data() to allocate a full sized buffer but\npopulates only a small portion of it with the collected changeset. All\nremaining bits are kept uninitialized.\n\nUsing an u16 avoids this type confusion and ensures that no (negative) sign\nextension is performed in batadv_send_other_tt_response()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Batman-adv processes attacker-controlled translation-table TVLV traffic from mesh peers over WiFi/Ethernet L2; exploitation requires the attacker to be on the same wireless or LAN segment as the victim mesh node, matching the Adjacent definition for WiFi/L2 mesh protocols.\nAC:L - An adjacent mesh attacker can send unauthenticated TT_REQUEST/TT_RESPONSE/OGM TVLV packets to populate `tt_buff_len` and then trigger `batadv_send_other_tt_response()` without depending on victim-controlled timing or memory layout.\nPR:N - The vulnerable path is reached from pre-authentication mesh control-plane packet handling (`batadv_recv_unicast_tvlv` \u2192 `batadv_tt_tvlv_unicast_handler_v1`); no Linux credentials or capabilities are required on the victim host beyond having an active batman-adv mesh interface.\nUI:N - Exploitation requires only crafted mesh protocol packets from an adjacent attacker; no victim user action (opening files, clicking links, etc.) is needed at attack time.\nS:U - Impact is confined to kernel memory disclosure/corruption and potential local privilege escalation within the same kernel security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - Sign-extended negative `tt_buff_len` causes `batadv_tt_prepare_tvlv_global_data()` to allocate a large buffer but only partially fill it, leaving the remainder uninitialized and transmitted to the requester in the TT_RESPONSE via `batadv_tvlv_unicast_send()`.\nI:H - The same type confusion passes a negative `s16` length to `memcpy()`, which promotes to a very large `size_t` and can cause out-of-bounds reads/writes from the undersized `tt_buff` allocation, enabling heap memory corruption.\nA:H - The malformed `memcpy()` and associated heap corruption can trigger kernel oops/panic on the responding mesh node, and the bug class inherently threatens system availability even when not fully weaponized."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:05.060Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4c4c2f340f4c27373bfcac8dc5032ce7bb474e47"
},
{
"url": "https://git.kernel.org/stable/c/33e5ede7ce6d92e531920d4bbd6d3e18ef1c6430"
},
{
"url": "https://git.kernel.org/stable/c/3c96dff00998314983b68a3e7caac07a66ebe496"
},
{
"url": "https://git.kernel.org/stable/c/32edd2a28e112064020a2f319a8cb8a9e5a09767"
},
{
"url": "https://git.kernel.org/stable/c/4dab98961426d0cf6a1599cda6950b7596ca2fcd"
},
{
"url": "https://git.kernel.org/stable/c/730de8733dd90f70d7580a9b329b971f8e1474a2"
},
{
"url": "https://git.kernel.org/stable/c/ed28ead3420c373a7928622f114bc6168075d1e1"
},
{
"url": "https://git.kernel.org/stable/c/b64963a2ceeb7529310b6cf253a1e540784422f4"
}
],
"title": "batman-adv: tt: fix negative tt_buff_len",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64088",
"datePublished": "2026-07-19T15:39:58.084Z",
"dateReserved": "2026-07-19T07:54:57.032Z",
"dateUpdated": "2026-08-05T12:39:05.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68351 (GCVE-0-2026-68351)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-08-19 16:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read
When the firmware sends a command response with a length mismatch,
carl9170_cmd_callback() logs the mismatch and calls carl9170_restart()
but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4).
Since len comes from the firmware and can exceed ar->readlen, this
copies more data than the readbuf was allocated for.
Bound the memcpy to min(len - 4, ar->readlen) so that the response
is still completed -- avoiding repeated restarts from queued garbage --
while preventing an overread past the response buffer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/carl9170/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "38e240996a6a78c94ab07d461fd66e361d55c3c4",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "2d05c321d27624c413c950278d2dc8e0f44a8950",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "525036b20ef01d814a7fcd0567d123992e4479fa",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "f74e34e66379e487a09009a4f2d42470051672bd",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "500c36649f270de05a56591fcc1aaaa36687958e",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "9aee949c68dc6dccbc54333537b109c53fe2079f",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "cb7a38810cf25738176dac32dec7a146b3f959cf",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "4cde55b2feff9504d1f993ab80e84e7ccb62791c",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/carl9170/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: carl9170: bound memcpy length in cmd callback to prevent OOB read\n\nWhen the firmware sends a command response with a length mismatch,\ncarl9170_cmd_callback() logs the mismatch and calls carl9170_restart()\nbut then falls through to memcpy(ar-\u003ereadbuf, buffer + 4, len - 4).\nSince len comes from the firmware and can exceed ar-\u003ereadlen, this\ncopies more data than the readbuf was allocated for.\n\nBound the memcpy to min(len - 4, ar-\u003ereadlen) so that the response\nis still completed -- avoiding repeated restarts from queued garbage --\nwhile preventing an overread past the response buffer."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:33:53.098Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/38e240996a6a78c94ab07d461fd66e361d55c3c4"
},
{
"url": "https://git.kernel.org/stable/c/2d05c321d27624c413c950278d2dc8e0f44a8950"
},
{
"url": "https://git.kernel.org/stable/c/525036b20ef01d814a7fcd0567d123992e4479fa"
},
{
"url": "https://git.kernel.org/stable/c/f74e34e66379e487a09009a4f2d42470051672bd"
},
{
"url": "https://git.kernel.org/stable/c/500c36649f270de05a56591fcc1aaaa36687958e"
},
{
"url": "https://git.kernel.org/stable/c/9aee949c68dc6dccbc54333537b109c53fe2079f"
},
{
"url": "https://git.kernel.org/stable/c/cb7a38810cf25738176dac32dec7a146b3f959cf"
},
{
"url": "https://git.kernel.org/stable/c/4cde55b2feff9504d1f993ab80e84e7ccb62791c"
}
],
"title": "wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68351",
"datePublished": "2026-08-10T12:03:28.312Z",
"dateReserved": "2026-07-30T09:28:09.384Z",
"dateUpdated": "2026-08-19T16:33:53.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72339 (GCVE-0-2026-72339)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
qede: fix off-by-one in BD ring consumption on build_skb failure
qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
NULL return from qede_build_skb(). When it returns NULL under memory
pressure, the functions still consume a BD from the ring before
returning NULL. The callers then recycle additional BDs, resulting in
one extra BD being consumed (off-by-one). This desynchronizes the BD
ring, which can corrupt DMA page reference counts and lead to SLUB
freelist corruption.
Commit 4e910dbe3650 ("qede: confirm skb is allocated before using")
added a NULL check inside qede_build_skb() to prevent a NULL pointer
dereference, but did not address the missing NULL checks in the
callers, making this off-by-one reachable.
Fix this by adding NULL checks for the return value of
qede_build_skb() in both qede_rx_build_skb() and
qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring
manipulation.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8a8633978b842c88fbcfe00d4e5dde96048f630e Version: 8a8633978b842c88fbcfe00d4e5dde96048f630e Version: 8a8633978b842c88fbcfe00d4e5dde96048f630e Version: 8a8633978b842c88fbcfe00d4e5dde96048f630e Version: 8a8633978b842c88fbcfe00d4e5dde96048f630e Version: 8a8633978b842c88fbcfe00d4e5dde96048f630e Version: 8a8633978b842c88fbcfe00d4e5dde96048f630e Version: 8a8633978b842c88fbcfe00d4e5dde96048f630e |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72339",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:47:21.272710Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:18.961Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qlogic/qede/qede_fp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ecc05d4b20220a09c9c69584fc46ca55248a374a",
"status": "affected",
"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
"versionType": "git"
},
{
"lessThan": "07be8b8adf91b7ada4c3dacce064d572a6066421",
"status": "affected",
"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
"versionType": "git"
},
{
"lessThan": "1624aa100c0b218181aa74e3696a389b509298cb",
"status": "affected",
"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
"versionType": "git"
},
{
"lessThan": "0bf78df2d3ecb1f4964ff42a7327d25845955153",
"status": "affected",
"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
"versionType": "git"
},
{
"lessThan": "814a5edac8c9fc04051808d5faaa93768e989281",
"status": "affected",
"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
"versionType": "git"
},
{
"lessThan": "b066420e57f3402a52c998678b4678252ac9bb63",
"status": "affected",
"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
"versionType": "git"
},
{
"lessThan": "982d6d6bc059c5dff37a2201c2f08c14bcfcbd20",
"status": "affected",
"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
"versionType": "git"
},
{
"lessThan": "a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f",
"status": "affected",
"version": "8a8633978b842c88fbcfe00d4e5dde96048f630e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qlogic/qede/qede_fp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqede: fix off-by-one in BD ring consumption on build_skb failure\n\nqede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a\nNULL return from qede_build_skb(). When it returns NULL under memory\npressure, the functions still consume a BD from the ring before\nreturning NULL. The callers then recycle additional BDs, resulting in\none extra BD being consumed (off-by-one). This desynchronizes the BD\nring, which can corrupt DMA page reference counts and lead to SLUB\nfreelist corruption.\n\nCommit 4e910dbe3650 (\"qede: confirm skb is allocated before using\")\nadded a NULL check inside qede_build_skb() to prevent a NULL pointer\ndereference, but did not address the missing NULL checks in the\ncallers, making this off-by-one reachable.\n\nFix this by adding NULL checks for the return value of\nqede_build_skb() in both qede_rx_build_skb() and\nqede_tpa_rx_build_skb(), returning NULL immediately before any BD ring\nmanipulation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the qede NIC RX fastpath reached when remote Ethernet frames are received, hardware posts completion queue entries, and NAPI runs qede_poll() -\u003e qede_rx_int() -\u003e qede_rx_process_cqe()/qede_tpa_start() into qede_rx_build_skb() or qede_tpa_rx_build_skb().\nAC:L - An attacker can reliably trigger build_skb() NULL returns by flooding the interface with frames larger than rx_copybreak (256 bytes) to exhaust GFP_ATOMIC skb slab allocations, then the off-by-one BD consumption desynchronizes the ring without races or victim-specific state.\nPR:N - No local account, capability, or authentication is required; any unauthenticated remote host that can send IP/Ethernet traffic to a server using a Marvell/QLogic FastLinQ qede NIC can hit the vulnerable RX/TPA handlers.\nUI:N - Exploitation requires no victim interaction beyond normal network operation; packet reception, MSI-X interrupt handling, and NAPI polling process attacker-supplied frames automatically in kernel context.\nS:U - The flaw corrupts kernel heap metadata (DMA page refcounts and SLUB freelists) within the host kernel security boundary; it does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - BD ring desynchronization corrupts DMA page reference counts and can corrupt SLUB freelists; this class of kernel heap corruption is exploitable for arbitrary kernel memory reads and information disclosure beyond a simple crash.\nI:H - SLUB freelist corruption from mismatched BD ring consumption enables arbitrary kernel memory writes and control-flow hijacking primitives, supporting local privilege escalation or arbitrary code execution in kernel context.\nA:H - Reference-count and SLUB corruption from the desynchronized BD ring can cause kernel BUG/oops/panic or a wedged RX datapath, resulting in complete loss of host availability on affected systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:42:57.907Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ecc05d4b20220a09c9c69584fc46ca55248a374a"
},
{
"url": "https://git.kernel.org/stable/c/07be8b8adf91b7ada4c3dacce064d572a6066421"
},
{
"url": "https://git.kernel.org/stable/c/1624aa100c0b218181aa74e3696a389b509298cb"
},
{
"url": "https://git.kernel.org/stable/c/0bf78df2d3ecb1f4964ff42a7327d25845955153"
},
{
"url": "https://git.kernel.org/stable/c/814a5edac8c9fc04051808d5faaa93768e989281"
},
{
"url": "https://git.kernel.org/stable/c/b066420e57f3402a52c998678b4678252ac9bb63"
},
{
"url": "https://git.kernel.org/stable/c/982d6d6bc059c5dff37a2201c2f08c14bcfcbd20"
},
{
"url": "https://git.kernel.org/stable/c/a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f"
}
],
"title": "qede: fix off-by-one in BD ring consumption on build_skb failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72339",
"datePublished": "2026-08-15T05:55:46.480Z",
"dateReserved": "2026-08-09T03:40:39.920Z",
"dateUpdated": "2026-10-16T18:55:18.961Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43416 (GCVE-0-2026-43416)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
powerpc, perf: Check that current->mm is alive before getting user callchain
It may happen that mm is already released, which leads to kernel panic.
This adds the NULL check for current->mm, similarly to
commit 20afc60f892d ("x86, perf: Check that current->mm is alive before getting user callchain").
I was getting this panic when running a profiling BPF program
(profile.py from bcc-tools):
[26215.051935] Kernel attempted to read user page (588) - exploit attempt? (uid: 0)
[26215.051950] BUG: Kernel NULL pointer dereference on read at 0x00000588
[26215.051952] Faulting instruction address: 0xc00000000020fac0
[26215.051957] Oops: Kernel access of bad area, sig: 11 [#1]
[...]
[26215.052049] Call Trace:
[26215.052050] [c000000061da6d30] [c00000000020fc10] perf_callchain_user_64+0x2d0/0x490 (unreliable)
[26215.052054] [c000000061da6dc0] [c00000000020f92c] perf_callchain_user+0x1c/0x30
[26215.052057] [c000000061da6de0] [c0000000005ab2a0] get_perf_callchain+0x100/0x360
[26215.052063] [c000000061da6e70] [c000000000573bc8] bpf_get_stackid+0x88/0xf0
[26215.052067] [c000000061da6ea0] [c008000000042258] bpf_prog_16d4ab9ab662f669_do_perf_event+0xf8/0x274
[...]
In addition, move storing the top-level stack entry to generic
perf_callchain_user to make sure the top-evel entry is always captured,
even if current->mm is NULL.
[Maddy: fixed message to avoid checkpatch format style error]
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/powerpc/perf/callchain.c",
"arch/powerpc/perf/callchain_32.c",
"arch/powerpc/perf/callchain_64.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "98074e16742ae87fb82e234b419783c5ffc9baea",
"status": "affected",
"version": "20002ded4d937ca87aca6253b874920a96a763c4",
"versionType": "git"
},
{
"lessThan": "7e5f60b8cfc02a2b23a40a5f5fd2fa81d010e737",
"status": "affected",
"version": "20002ded4d937ca87aca6253b874920a96a763c4",
"versionType": "git"
},
{
"lessThan": "e9bbfb4bfa86c6b5515b868d6982ac60505d7e39",
"status": "affected",
"version": "20002ded4d937ca87aca6253b874920a96a763c4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/powerpc/perf/callchain.c",
"arch/powerpc/perf/callchain_32.c",
"arch/powerpc/perf/callchain_64.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"lessThan": "2.6.32",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc, perf: Check that current-\u003emm is alive before getting user callchain\n\nIt may happen that mm is already released, which leads to kernel panic.\nThis adds the NULL check for current-\u003emm, similarly to\ncommit 20afc60f892d (\"x86, perf: Check that current-\u003emm is alive before getting user callchain\").\n\nI was getting this panic when running a profiling BPF program\n(profile.py from bcc-tools):\n\n [26215.051935] Kernel attempted to read user page (588) - exploit attempt? (uid: 0)\n [26215.051950] BUG: Kernel NULL pointer dereference on read at 0x00000588\n [26215.051952] Faulting instruction address: 0xc00000000020fac0\n [26215.051957] Oops: Kernel access of bad area, sig: 11 [#1]\n [...]\n [26215.052049] Call Trace:\n [26215.052050] [c000000061da6d30] [c00000000020fc10] perf_callchain_user_64+0x2d0/0x490 (unreliable)\n [26215.052054] [c000000061da6dc0] [c00000000020f92c] perf_callchain_user+0x1c/0x30\n [26215.052057] [c000000061da6de0] [c0000000005ab2a0] get_perf_callchain+0x100/0x360\n [26215.052063] [c000000061da6e70] [c000000000573bc8] bpf_get_stackid+0x88/0xf0\n [26215.052067] [c000000061da6ea0] [c008000000042258] bpf_prog_16d4ab9ab662f669_do_perf_event+0xf8/0x274\n [...]\n\nIn addition, move storing the top-level stack entry to generic\nperf_callchain_user to make sure the top-evel entry is always captured,\neven if current-\u003emm is NULL.\n\n[Maddy: fixed message to avoid checkpatch format style error]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:10.050Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/98074e16742ae87fb82e234b419783c5ffc9baea"
},
{
"url": "https://git.kernel.org/stable/c/7e5f60b8cfc02a2b23a40a5f5fd2fa81d010e737"
},
{
"url": "https://git.kernel.org/stable/c/e9bbfb4bfa86c6b5515b868d6982ac60505d7e39"
}
],
"title": "powerpc, perf: Check that current-\u003emm is alive before getting user callchain",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43416",
"datePublished": "2026-05-08T14:21:52.954Z",
"dateReserved": "2026-05-01T14:12:56.008Z",
"dateUpdated": "2026-05-11T22:24:10.050Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68277 (GCVE-0-2026-68277)
Vulnerability from cvelistv5
Published
2026-08-10 12:01
Modified
2026-08-23 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers
Three sideband reply parsers read 16-bit fields as:
val = (raw->msg[idx] << 8) | (raw->msg[idx+1]);
and check bounds only after the fact. When idx == raw->curlen,
raw->msg[idx+1] reads one byte past the received message data into
the following struct fields (curchunk_len, curchunk_idx, curlen).
Affected functions:
- drm_dp_sideband_parse_enum_path_resources_ack()
full_payload_bw_number and avail_payload_bw_number fields
- drm_dp_sideband_parse_allocate_payload_ack()
allocated_pbn field
- drm_dp_sideband_parse_query_payload_ack()
allocated_pbn field
Fix by using a single combined check (idx + 2 > curlen) before each
2-byte read. Since the check is strictly tighter than idx > curlen,
no separate step is needed.
[added fixes tag]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/display/drm_dp_mst_topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c1f72a13d54ffd16647d3fa540d961f5deba8790",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "192e146c2d57ad033b0d418ec64ee390f8dc074e",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "6e3107e6522109a07fc9bb0fc4ec463f1982e113",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "bdf0508b1e6785d4a8982c637e97e68d60b47d7b",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "0bcd7675c69a2462a8531fcd9e4d096e9c7ec5df",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "d5c70523cafa26ad2c7a37b612849abe2683baa8",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "68a624416d1dd481b3e5b7ea0e8a070a9b8a2c73",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "6b89ba3dba2f583626fb693e47e951ffb8bf591f",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/display/drm_dp_mst_topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers\n\nThree sideband reply parsers read 16-bit fields as:\n\n val = (raw-\u003emsg[idx] \u003c\u003c 8) | (raw-\u003emsg[idx+1]);\n\nand check bounds only after the fact. When idx == raw-\u003ecurlen,\nraw-\u003emsg[idx+1] reads one byte past the received message data into\nthe following struct fields (curchunk_len, curchunk_idx, curlen).\n\nAffected functions:\n - drm_dp_sideband_parse_enum_path_resources_ack()\n full_payload_bw_number and avail_payload_bw_number fields\n - drm_dp_sideband_parse_allocate_payload_ack()\n allocated_pbn field\n - drm_dp_sideband_parse_query_payload_ack()\n allocated_pbn field\n\nFix by using a single combined check (idx + 2 \u003e curlen) before each\n2-byte read. Since the check is strictly tighter than idx \u003e curlen,\nno separate step is needed.\n\n[added fixes tag]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:14.372Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c1f72a13d54ffd16647d3fa540d961f5deba8790"
},
{
"url": "https://git.kernel.org/stable/c/192e146c2d57ad033b0d418ec64ee390f8dc074e"
},
{
"url": "https://git.kernel.org/stable/c/6e3107e6522109a07fc9bb0fc4ec463f1982e113"
},
{
"url": "https://git.kernel.org/stable/c/bdf0508b1e6785d4a8982c637e97e68d60b47d7b"
},
{
"url": "https://git.kernel.org/stable/c/0bcd7675c69a2462a8531fcd9e4d096e9c7ec5df"
},
{
"url": "https://git.kernel.org/stable/c/d5c70523cafa26ad2c7a37b612849abe2683baa8"
},
{
"url": "https://git.kernel.org/stable/c/68a624416d1dd481b3e5b7ea0e8a070a9b8a2c73"
},
{
"url": "https://git.kernel.org/stable/c/6b89ba3dba2f583626fb693e47e951ffb8bf591f"
}
],
"title": "drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68277",
"datePublished": "2026-08-10T12:01:53.085Z",
"dateReserved": "2026-07-30T09:28:09.379Z",
"dateUpdated": "2026-08-23T12:46:14.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64306 (GCVE-0-2026-64306)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-08-17 04:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: drbg - Fix returning success on failure in CTR_DRBG
drbg_ctr_generate() sometimes returns success when it fails, leaving the
output buffer uninitialized. Fix it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cde001e4c3c3625c60b68a83eb1f1c2572dee07a Version: cde001e4c3c3625c60b68a83eb1f1c2572dee07a Version: cde001e4c3c3625c60b68a83eb1f1c2572dee07a Version: cde001e4c3c3625c60b68a83eb1f1c2572dee07a Version: cde001e4c3c3625c60b68a83eb1f1c2572dee07a Version: cde001e4c3c3625c60b68a83eb1f1c2572dee07a Version: cde001e4c3c3625c60b68a83eb1f1c2572dee07a Version: cde001e4c3c3625c60b68a83eb1f1c2572dee07a Version: f60b0fa8bbddde66f1d197be07120264b555c84a Version: 3.12.44 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/drbg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "074db6db03a0aaa78f05ca9d4838053713796665",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "7b03312491f9fe6ba4d60c4023e7e61d2d1fed96",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "75597e8774f319152744d24e0683d9393540a951",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "cc42fb40171c249bb859071d81b4eb007398a0bc",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "bbbac12083eff489b35d848332f0dff311131344",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "23b8b188cb32e5531d0f8d3af9506f8959cb369e",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "a9e886f73dd717027028bb7e3bbca93601ecdfc7",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"lessThan": "39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b",
"status": "affected",
"version": "cde001e4c3c3625c60b68a83eb1f1c2572dee07a",
"versionType": "git"
},
{
"status": "affected",
"version": "f60b0fa8bbddde66f1d197be07120264b555c84a",
"versionType": "git"
},
{
"lessThan": "3.13",
"status": "affected",
"version": "3.12.44",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/drbg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.12.44",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: drbg - Fix returning success on failure in CTR_DRBG\n\ndrbg_ctr_generate() sometimes returns success when it fails, leaving the\noutput buffer uninitialized. Fix it."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:05.476Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/074db6db03a0aaa78f05ca9d4838053713796665"
},
{
"url": "https://git.kernel.org/stable/c/7b03312491f9fe6ba4d60c4023e7e61d2d1fed96"
},
{
"url": "https://git.kernel.org/stable/c/75597e8774f319152744d24e0683d9393540a951"
},
{
"url": "https://git.kernel.org/stable/c/cc42fb40171c249bb859071d81b4eb007398a0bc"
},
{
"url": "https://git.kernel.org/stable/c/bbbac12083eff489b35d848332f0dff311131344"
},
{
"url": "https://git.kernel.org/stable/c/23b8b188cb32e5531d0f8d3af9506f8959cb369e"
},
{
"url": "https://git.kernel.org/stable/c/a9e886f73dd717027028bb7e3bbca93601ecdfc7"
},
{
"url": "https://git.kernel.org/stable/c/39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b"
}
],
"title": "crypto: drbg - Fix returning success on failure in CTR_DRBG",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64306",
"datePublished": "2026-07-25T08:49:40.153Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-08-17T04:53:05.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-57841 (GCVE-0-2024-57841)
Vulnerability from cvelistv5
Published
2025-01-15 13:10
Modified
2026-05-23 15:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: fix memory leak in tcp_conn_request()
If inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will
return without free the dst memory, which allocated in af_ops->route_req.
Here is the kmemleak stack:
unreferenced object 0xffff8881198631c0 (size 240):
comm "softirq", pid 0, jiffies 4299266571 (age 1802.392s)
hex dump (first 32 bytes):
00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ................
81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00 .U..............
backtrace:
[<ffffffffb93e8d4c>] kmem_cache_alloc+0x60c/0xa80
[<ffffffffba11b4c5>] dst_alloc+0x55/0x250
[<ffffffffba227bf6>] rt_dst_alloc+0x46/0x1d0
[<ffffffffba23050a>] __mkroute_output+0x29a/0xa50
[<ffffffffba23456b>] ip_route_output_key_hash+0x10b/0x240
[<ffffffffba2346bd>] ip_route_output_flow+0x1d/0x90
[<ffffffffba254855>] inet_csk_route_req+0x2c5/0x500
[<ffffffffba26b331>] tcp_conn_request+0x691/0x12c0
[<ffffffffba27bd08>] tcp_rcv_state_process+0x3c8/0x11b0
[<ffffffffba2965c6>] tcp_v4_do_rcv+0x156/0x3b0
[<ffffffffba299c98>] tcp_v4_rcv+0x1cf8/0x1d80
[<ffffffffba239656>] ip_protocol_deliver_rcu+0xf6/0x360
[<ffffffffba2399a6>] ip_local_deliver_finish+0xe6/0x1e0
[<ffffffffba239b8e>] ip_local_deliver+0xee/0x360
[<ffffffffba239ead>] ip_rcv+0xad/0x2f0
[<ffffffffba110943>] __netif_receive_skb_one_core+0x123/0x140
Call dst_release() to free the dst memory when
inet_csk_reqsk_queue_hash_add() return false in tcp_conn_request().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 527bec1f56ac7a2fceb8eb77eb0fc2678ecba394 Version: c14f3c3793f7a785763e353df7fc40426187f832 Version: fdae4d139f4778b20a40c60705c53f5f146459b5 Version: ff46e3b4421923937b7f6e44ffcd3549a074f321 Version: ff46e3b4421923937b7f6e44ffcd3549a074f321 Version: 360892e60710427229fc1f7bb2218cf4d578229b Version: 5.15.162 ≤ Version: 6.1.97 ≤ Version: 6.6.37 ≤ Version: 6.9.8 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-57841",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-01T19:54:23.329434Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401 Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-01T19:57:18.572Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:54:41.406Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9d38959677291552d1b0ed2689a540af279b5bf8",
"status": "affected",
"version": "527bec1f56ac7a2fceb8eb77eb0fc2678ecba394",
"versionType": "git"
},
{
"lessThan": "de3f999bf8aee16e9da1c1224191abdc69e97c9d",
"status": "affected",
"version": "c14f3c3793f7a785763e353df7fc40426187f832",
"versionType": "git"
},
{
"lessThan": "2af69905180b3fea12f9c1db374b153a06977021",
"status": "affected",
"version": "fdae4d139f4778b20a40c60705c53f5f146459b5",
"versionType": "git"
},
{
"lessThan": "b0b190218c78d8aeecfba36ea3a90063b3ede52d",
"status": "affected",
"version": "ff46e3b4421923937b7f6e44ffcd3549a074f321",
"versionType": "git"
},
{
"lessThan": "4f4aa4aa28142d53f8b06585c478476cfe325cfc",
"status": "affected",
"version": "ff46e3b4421923937b7f6e44ffcd3549a074f321",
"versionType": "git"
},
{
"status": "affected",
"version": "360892e60710427229fc1f7bb2218cf4d578229b",
"versionType": "git"
},
{
"lessThan": "5.15.176",
"status": "affected",
"version": "5.15.162",
"versionType": "semver"
},
{
"lessThan": "6.1.124",
"status": "affected",
"version": "6.1.97",
"versionType": "semver"
},
{
"lessThan": "6.6.70",
"status": "affected",
"version": "6.6.37",
"versionType": "semver"
},
{
"lessThan": "6.10",
"status": "affected",
"version": "6.9.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.124",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.70",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.176",
"versionStartIncluding": "5.15.162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.124",
"versionStartIncluding": "6.1.97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.70",
"versionStartIncluding": "6.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.9",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix memory leak in tcp_conn_request()\n\nIf inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will\nreturn without free the dst memory, which allocated in af_ops-\u003eroute_req.\n\nHere is the kmemleak stack:\n\nunreferenced object 0xffff8881198631c0 (size 240):\n comm \"softirq\", pid 0, jiffies 4299266571 (age 1802.392s)\n hex dump (first 32 bytes):\n 00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ................\n 81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00 .U..............\n backtrace:\n [\u003cffffffffb93e8d4c\u003e] kmem_cache_alloc+0x60c/0xa80\n [\u003cffffffffba11b4c5\u003e] dst_alloc+0x55/0x250\n [\u003cffffffffba227bf6\u003e] rt_dst_alloc+0x46/0x1d0\n [\u003cffffffffba23050a\u003e] __mkroute_output+0x29a/0xa50\n [\u003cffffffffba23456b\u003e] ip_route_output_key_hash+0x10b/0x240\n [\u003cffffffffba2346bd\u003e] ip_route_output_flow+0x1d/0x90\n [\u003cffffffffba254855\u003e] inet_csk_route_req+0x2c5/0x500\n [\u003cffffffffba26b331\u003e] tcp_conn_request+0x691/0x12c0\n [\u003cffffffffba27bd08\u003e] tcp_rcv_state_process+0x3c8/0x11b0\n [\u003cffffffffba2965c6\u003e] tcp_v4_do_rcv+0x156/0x3b0\n [\u003cffffffffba299c98\u003e] tcp_v4_rcv+0x1cf8/0x1d80\n [\u003cffffffffba239656\u003e] ip_protocol_deliver_rcu+0xf6/0x360\n [\u003cffffffffba2399a6\u003e] ip_local_deliver_finish+0xe6/0x1e0\n [\u003cffffffffba239b8e\u003e] ip_local_deliver+0xee/0x360\n [\u003cffffffffba239ead\u003e] ip_rcv+0xad/0x2f0\n [\u003cffffffffba110943\u003e] __netif_receive_skb_one_core+0x123/0x140\n\nCall dst_release() to free the dst memory when\ninet_csk_reqsk_queue_hash_add() return false in tcp_conn_request()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T15:56:09.585Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9d38959677291552d1b0ed2689a540af279b5bf8"
},
{
"url": "https://git.kernel.org/stable/c/de3f999bf8aee16e9da1c1224191abdc69e97c9d"
},
{
"url": "https://git.kernel.org/stable/c/2af69905180b3fea12f9c1db374b153a06977021"
},
{
"url": "https://git.kernel.org/stable/c/b0b190218c78d8aeecfba36ea3a90063b3ede52d"
},
{
"url": "https://git.kernel.org/stable/c/4f4aa4aa28142d53f8b06585c478476cfe325cfc"
}
],
"title": "net: fix memory leak in tcp_conn_request()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-57841",
"datePublished": "2025-01-15T13:10:26.842Z",
"dateReserved": "2025-01-15T13:08:59.716Z",
"dateUpdated": "2026-05-23T15:56:09.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68417 (GCVE-0-2026-68417)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: publish QP after initialization
siw_create_qp() currently calls siw_qp_add() before the queues, CQ
pointers, state, completion, and device list entry are ready. A QPN
lookup can therefore reach a QP that is still being constructed.
Move siw_qp_add() to the end of siw_create_qp(), after QP
initialization and before adding the QP to the siw device list.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f29dd55b0236f7a26a4b9dd69186e3c04266797b Version: f29dd55b0236f7a26a4b9dd69186e3c04266797b Version: f29dd55b0236f7a26a4b9dd69186e3c04266797b Version: f29dd55b0236f7a26a4b9dd69186e3c04266797b Version: f29dd55b0236f7a26a4b9dd69186e3c04266797b Version: f29dd55b0236f7a26a4b9dd69186e3c04266797b Version: f29dd55b0236f7a26a4b9dd69186e3c04266797b |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68417",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:32.516478Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:09.356Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c9d128219964dcea897bf6139b88242e987be8f",
"status": "affected",
"version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
"versionType": "git"
},
{
"lessThan": "3ff82e3841ecab1ff38d5817c969a019d266c83c",
"status": "affected",
"version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
"versionType": "git"
},
{
"lessThan": "36e91a58397ca8c978e38a0bf389f0c6113fa8ca",
"status": "affected",
"version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
"versionType": "git"
},
{
"lessThan": "74912ad168f87d6b2b670a87987bb302d6e64aa1",
"status": "affected",
"version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
"versionType": "git"
},
{
"lessThan": "fcc9d50022bcdb1f9f7ed04955c72b4a7355af3d",
"status": "affected",
"version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
"versionType": "git"
},
{
"lessThan": "52f9fcb191143448df55fd215ff09c5207fed43e",
"status": "affected",
"version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
"versionType": "git"
},
{
"lessThan": "bb27fcc67c429d97f785c92c35a6c5adebb05d7f",
"status": "affected",
"version": "f29dd55b0236f7a26a4b9dd69186e3c04266797b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: publish QP after initialization\n\nsiw_create_qp() currently calls siw_qp_add() before the queues, CQ\npointers, state, completion, and device list entry are ready. A QPN\nlookup can therefore reach a QP that is still being constructed.\n\nMove siw_qp_add() to the end of siw_create_qp(), after QP\ninitialization and before adding the QP to the siw device list."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local access to the RDMA character devices (/dev/infiniband/uverbsN for create_qp and /dev/infiniband/rdma_cm for the QPN lookup); no network packet reaches the racing code path without a local trigger first.\nAC:L - The attacker controls both sides of the race: one thread issues create_qp while another issues rdma_connect/rdma_accept with an attacker-supplied qp_num, and QPNs from xa_alloc(XA_FLAGS_ALLOC1) are predictable. The post-publish failure can be made deterministic by passing a short udata-\u003eoutlen, so the window is wide and repeatable at will.\nPR:L - Any unprivileged local user with access to the siw uverbs and rdma_cm character devices can create QPs and issue rdma_connect/rdma_accept with an arbitrary qp_num; no capability check gates siw_create_qp, siw_connect or siw_accept.\nUI:N - The attacker drives both the QP creation and the concurrent QPN lookup from its own threads; no action by any other user or administrator is needed.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU or sandbox boundary.\nC:H - The siw_qp object can be kfree\u0027d by the ib core error path while the CM thread still holds a reference, giving a use-after-free on a slab object the attacker can groom and read back through QP/CM state, enabling disclosure of arbitrary kernel memory.\nI:H - After the free, siw_free_qp() performs list_del(\u0026qp-\u003edevq), vfree() of four pointer fields and siw_put_tx_cpu(qp-\u003etx_cpu) using values read from reallocated attacker-controlled memory, yielding arbitrary-pointer free, list-unlink writes and out-of-range per-CPU decrements suitable for control-flow hijacking.\nA:H - Even without exploitation the race reliably causes kernel crashes: NULL sendq/recvq/scq/rcq dereferences, list_del on an uninitialized devq head, waits on an uninitialized qp_free completion, and use-after-free oopses."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:35:15.087Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c9d128219964dcea897bf6139b88242e987be8f"
},
{
"url": "https://git.kernel.org/stable/c/3ff82e3841ecab1ff38d5817c969a019d266c83c"
},
{
"url": "https://git.kernel.org/stable/c/36e91a58397ca8c978e38a0bf389f0c6113fa8ca"
},
{
"url": "https://git.kernel.org/stable/c/74912ad168f87d6b2b670a87987bb302d6e64aa1"
},
{
"url": "https://git.kernel.org/stable/c/fcc9d50022bcdb1f9f7ed04955c72b4a7355af3d"
},
{
"url": "https://git.kernel.org/stable/c/52f9fcb191143448df55fd215ff09c5207fed43e"
},
{
"url": "https://git.kernel.org/stable/c/bb27fcc67c429d97f785c92c35a6c5adebb05d7f"
}
],
"title": "RDMA/siw: publish QP after initialization",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68417",
"datePublished": "2026-08-10T12:04:37.936Z",
"dateReserved": "2026-07-30T09:28:09.391Z",
"dateUpdated": "2026-10-19T21:09:09.356Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72083 (GCVE-0-2026-72083)
Vulnerability from cvelistv5
Published
2026-08-15 05:52
Modified
2026-10-19 21:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT
parameter list with transport_kmap_data_sg() and parses the destination
TransportID with target_parse_pr_out_transport_id(). For an iSCSI
TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns
the ISID in iport_ptr as a raw pointer into that mapped buffer.
The function then unmaps the buffer with transport_kunmap_data_sg() before
dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and
core_scsi3_alloc_registration(). When the parameter list spans more than
one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses
vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual
address backing iport_ptr is torn down and every subsequent dereference is
a use-after-free read of the unmapped region.
Keep the parameter list mapped until iport_ptr is no longer needed: drop
the early transport_kunmap_data_sg() and unmap once on the success path,
right before returning. The error paths already unmap through the existing
"if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs
on every post-map error exit because buf is no longer cleared early. Only
reads of the mapping happen while spinlocks are held; the map and unmap
calls remain outside any lock. The sibling caller
core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it
and is left unchanged.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: 4949314c7283ea4f9ade182ca599583b89f7edd6 Version: d2227f84ba0e97906153ac83db13213fb2e3938d Version: 3.2.9 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72083",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:51:39.405960Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:26.910Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_pr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7d56f5c868d92c9d504a34a3ea450bce481c7f63",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "59a2a5a37dc49a641ad6bc64aee34e5a61025ffd",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "9f8076cc73dfa6b10155978c160587e986b22169",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "a040004846f1fbe687f6ec76d9ccc27b4ead42e4",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "05b3e37433cf2eaf8867f1c16528aa347bb212ab",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "cb7bdae7fba404852ade34b0c1445fbaf3e54fbb",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "ef2ee18fec92088c7d8877baf7674e89389ccd66",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"lessThan": "fda6a1f3c3d7047b5ce5654487649c2daa738bfc",
"status": "affected",
"version": "4949314c7283ea4f9ade182ca599583b89f7edd6",
"versionType": "git"
},
{
"status": "affected",
"version": "d2227f84ba0e97906153ac83db13213fb2e3938d",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_pr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE\n\ncore_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT\nparameter list with transport_kmap_data_sg() and parses the destination\nTransportID with target_parse_pr_out_transport_id(). For an iSCSI\nTransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns\nthe ISID in iport_ptr as a raw pointer into that mapped buffer.\n\nThe function then unmaps the buffer with transport_kunmap_data_sg() before\ndereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and\ncore_scsi3_alloc_registration(). When the parameter list spans more than\none page (PARAMETER LIST LENGTH \u003e 4096), transport_kmap_data_sg() uses\nvmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual\naddress backing iport_ptr is torn down and every subsequent dereference is\na use-after-free read of the unmapped region.\n\nKeep the parameter list mapped until iport_ptr is no longer needed: drop\nthe early transport_kunmap_data_sg() and unmap once on the success path,\nright before returning. The error paths already unmap through the existing\n\"if (buf) transport_kunmap_data_sg(cmd)\" at the out: label, which now runs\non every post-map error exit because buf is no longer cleared early. Only\nreads of the mapping happen while spinlocks are held; the map and unmap\ncalls remain outside any lock. The sibling caller\ncore_scsi3_decode_spec_i_port() already uses the buffer before unmapping it\nand is left unchanged."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On LIO/iSCSI storage servers and appliances, a remote initiator sends PERSISTENT_RESERVE_OUT with REGISTER AND MOVE over TCP (port 3260); iscsit_process_scsi_cmd()\u2192target_execute_cmd()\u2192target_scsi3_emulate_pr_out()\u2192core_scsi3_emulate_pro_register_and_move() with no local access required.\nAC:L - The attacker fully controls the PR-OUT parameter list length (\u003e4096 to force vmap/vunmap), iSCSI TransportID format 01b with ISID, and can establish prerequisite PR registration and reservation via prior SCSI commands on the same session; no uncontrollable race or layout dependency exists.\nPR:N - Exploitation requires only the ability to act as a network SCSI/iSCSI client with LUN access to an exported target; no Linux UID, capability, or init-namespace root on the storage server is needed\u2014only standard iSCSI initiator connectivity (CHAP/ACL when configured).\nUI:N - Triggering is fully automated once an iSCSI session exists: the attacker issues scripted REGISTER, RESERVE, then REGISTER AND MOVE commands with a crafted \u003e4 KiB parameter list; no victim mount, click, or other interactive action is required.\nS:U - The UAF corrupts kernel heap state inside the target-core PR handler on the storage host; impact stays within that kernel security domain and does not inherently cross VM, container, or IOMMU boundaries (standard host compromise, not escape).\nC:H - After vunmap(), iport_ptr aliases freed kernel virtual address space and is dereferenced in strcmp(), __core_scsi3_locate_pr_reg(), and snprintf() into pr_reg_isid; per kernel CVSS guidance, UAF reads enable arbitrary kernel memory disclosure when uncertain.\nI:H - UAF reads of attacker-influenced unmapped PR-OUT data drive strcmp-based registration matching and snprintf copies into persistent kernel pr_reg structures; memory corruption/UAF is scored High for integrity because it can be leveraged for control-flow or state manipulation.\nA:H - Dereferencing iport_ptr after transport_kunmap_data_sg() vunmap() on multi-page buffers causes immediate invalid kernel virtual address accesses (oops/panic) on every qualifying REGISTER AND MOVE; UAF availability impact is High per kernel guidance even before full exploit development."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:40:05.325Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7d56f5c868d92c9d504a34a3ea450bce481c7f63"
},
{
"url": "https://git.kernel.org/stable/c/59a2a5a37dc49a641ad6bc64aee34e5a61025ffd"
},
{
"url": "https://git.kernel.org/stable/c/9f8076cc73dfa6b10155978c160587e986b22169"
},
{
"url": "https://git.kernel.org/stable/c/a040004846f1fbe687f6ec76d9ccc27b4ead42e4"
},
{
"url": "https://git.kernel.org/stable/c/05b3e37433cf2eaf8867f1c16528aa347bb212ab"
},
{
"url": "https://git.kernel.org/stable/c/cb7bdae7fba404852ade34b0c1445fbaf3e54fbb"
},
{
"url": "https://git.kernel.org/stable/c/ef2ee18fec92088c7d8877baf7674e89389ccd66"
},
{
"url": "https://git.kernel.org/stable/c/fda6a1f3c3d7047b5ce5654487649c2daa738bfc"
}
],
"title": "scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72083",
"datePublished": "2026-08-15T05:52:32.045Z",
"dateReserved": "2026-08-09T03:40:39.904Z",
"dateUpdated": "2026-10-19T21:19:26.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43277 (GCVE-0-2026-43277)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
APEI/GHES: ensure that won't go past CPER allocated record
The logic at ghes_new() prevents allocating too large records, by
checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
Yet, the allocation is done with the actual number of pages from the
CPER bios table location, which can be smaller.
Yet, a bad firmware could send data with a different size, which might
be bigger than the allocated memory, causing an OOPS:
Unable to handle kernel paging request at virtual address fff00000f9b40000
Mem abort info:
ESR = 0x0000000096000007
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
Data abort info:
ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000
[fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000
Internal error: Oops: 0000000096000007 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT
Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
Workqueue: kacpi_notify acpi_os_execute_deferred
pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : hex_dump_to_buffer+0x30c/0x4a0
lr : hex_dump_to_buffer+0x328/0x4a0
sp : ffff800080e13880
x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083
x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004
x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083
x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010
x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020
x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008
x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020
x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000
x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008
Call trace:
hex_dump_to_buffer+0x30c/0x4a0 (P)
print_hex_dump+0xac/0x170
cper_estatus_print_section+0x90c/0x968
cper_estatus_print+0xf0/0x158
__ghes_print_estatus+0xa0/0x148
ghes_proc+0x1bc/0x220
ghes_notify_hed+0x5c/0xb8
notifier_call_chain+0x78/0x148
blocking_notifier_call_chain+0x4c/0x80
acpi_hed_notify+0x28/0x40
acpi_ev_notify_dispatch+0x50/0x80
acpi_os_execute_deferred+0x24/0x48
process_one_work+0x15c/0x3b0
worker_thread+0x2d0/0x400
kthread+0x148/0x228
ret_from_fork+0x10/0x20
Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)
---[ end trace 0000000000000000 ]---
Prevent that by taking the actual allocated are into account when
checking for CPER length.
[ rjw: Subject tweaks ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/apei/ghes.c",
"include/acpi/ghes.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "92ba79074c58e65a6e32713758c5a9aecd33c2ea",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "616c120dcdf1ce96edcd818e38bce49667f80689",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "f3740a1562445f36f08afab8af59e37117b3acdc",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "e0ec99115e135dbb58e11a0df007c7d4771d4a17",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "b6be51a12441136fdf8c49b2525689fbea1856e1",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "6f5d41984ad896736c23e2fff7c80e15c1319132",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "98bd9b28d4d11e6739ad86524b4be4ada9025e60",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "fa2408a24f8f0db14d9cfc613ef162dc267d7ad4",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/apei/ghes.c",
"include/acpi/ghes.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nAPEI/GHES: ensure that won\u0027t go past CPER allocated record\n\nThe logic at ghes_new() prevents allocating too large records, by\nchecking if they\u0027re bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).\nYet, the allocation is done with the actual number of pages from the\nCPER bios table location, which can be smaller.\n\nYet, a bad firmware could send data with a different size, which might\nbe bigger than the allocated memory, causing an OOPS:\n\n Unable to handle kernel paging request at virtual address fff00000f9b40000\n Mem abort info:\n ESR = 0x0000000096000007\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x07: level 3 translation fault\n Data abort info:\n ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000\n CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000\n [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000\n Internal error: Oops: 0000000096000007 [#1] SMP\n Modules linked in:\n CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT\n Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022\n Workqueue: kacpi_notify acpi_os_execute_deferred\n pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n pc : hex_dump_to_buffer+0x30c/0x4a0\n lr : hex_dump_to_buffer+0x328/0x4a0\n sp : ffff800080e13880\n x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083\n x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004\n x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083\n x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010\n x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020\n x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008\n x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000\n x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020\n x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000\n x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008\n Call trace:\n hex_dump_to_buffer+0x30c/0x4a0 (P)\n print_hex_dump+0xac/0x170\n cper_estatus_print_section+0x90c/0x968\n cper_estatus_print+0xf0/0x158\n __ghes_print_estatus+0xa0/0x148\n ghes_proc+0x1bc/0x220\n ghes_notify_hed+0x5c/0xb8\n notifier_call_chain+0x78/0x148\n blocking_notifier_call_chain+0x4c/0x80\n acpi_hed_notify+0x28/0x40\n acpi_ev_notify_dispatch+0x50/0x80\n acpi_os_execute_deferred+0x24/0x48\n process_one_work+0x15c/0x3b0\n worker_thread+0x2d0/0x400\n kthread+0x148/0x228\n ret_from_fork+0x10/0x20\n Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)\n ---[ end trace 0000000000000000 ]---\n\nPrevent that by taking the actual allocated are into account when\nchecking for CPER length.\n\n[ rjw: Subject tweaks ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:26.865Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/92ba79074c58e65a6e32713758c5a9aecd33c2ea"
},
{
"url": "https://git.kernel.org/stable/c/616c120dcdf1ce96edcd818e38bce49667f80689"
},
{
"url": "https://git.kernel.org/stable/c/f3740a1562445f36f08afab8af59e37117b3acdc"
},
{
"url": "https://git.kernel.org/stable/c/e0ec99115e135dbb58e11a0df007c7d4771d4a17"
},
{
"url": "https://git.kernel.org/stable/c/b6be51a12441136fdf8c49b2525689fbea1856e1"
},
{
"url": "https://git.kernel.org/stable/c/6f5d41984ad896736c23e2fff7c80e15c1319132"
},
{
"url": "https://git.kernel.org/stable/c/98bd9b28d4d11e6739ad86524b4be4ada9025e60"
},
{
"url": "https://git.kernel.org/stable/c/fa2408a24f8f0db14d9cfc613ef162dc267d7ad4"
}
],
"title": "APEI/GHES: ensure that won\u0027t go past CPER allocated record",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43277",
"datePublished": "2026-05-06T11:28:59.486Z",
"dateReserved": "2026-05-01T14:12:55.998Z",
"dateUpdated": "2026-05-11T22:21:26.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74510 (GCVE-0-2026-74510)
Vulnerability from cvelistv5
Published
2026-08-15 12:27
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: mgmt: fix UAF in pair command cancellation
The pairing completion and authentication failure callbacks look up the
pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending. The
lookup returned a command that was still linked on the shared pending list,
without keeping mgmt_pending_lock held for the later dereference and
removal.
A concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the
same pending command before the callback uses it. The reverse race is also
possible when cancel_pair_device() gets a command from pending_find() and a
callback removes it before the cancel path dereferences it. This can lead
to a use-after-free and a second list_del().
Make the pairing lookup helpers transfer ownership of the pending command
by removing it from hdev->mgmt_pending while holding mgmt_pending_lock.
The callbacks and cancel path then complete the command and free it
directly, so racing paths cannot find or free the same command again. Take
a temporary hci_conn reference in cancel_pair_device() because the command
completion drops the reference stored in the pending command.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 Version: e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 Version: e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 Version: e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 Version: e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 Version: e9a416b5ce0c0f93819f55d34cf6882196e9c3b2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74510",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:58:39.693080Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:51.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "50af4280a587c9971b5388cbc438f1324e626b7b",
"status": "affected",
"version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
"versionType": "git"
},
{
"lessThan": "86ed4dd6548ccf277bc691bc912ca06e76b9d80c",
"status": "affected",
"version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
"versionType": "git"
},
{
"lessThan": "7c2a152a897cd1c184b2051484d4f74d803e7f4a",
"status": "affected",
"version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
"versionType": "git"
},
{
"lessThan": "c569def320aa8b1fde89227e2ea96606790fd86d",
"status": "affected",
"version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
"versionType": "git"
},
{
"lessThan": "51be7280980fddc90ebe874a69c2fe8ab02bb46a",
"status": "affected",
"version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
"versionType": "git"
},
{
"lessThan": "d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd",
"status": "affected",
"version": "e9a416b5ce0c0f93819f55d34cf6882196e9c3b2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.39"
},
{
"lessThan": "2.6.39",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.39",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix UAF in pair command cancellation\n\nThe pairing completion and authentication failure callbacks look up the\npending MGMT_OP_PAIR_DEVICE command by walking hdev-\u003emgmt_pending. The\nlookup returned a command that was still linked on the shared pending list,\nwithout keeping mgmt_pending_lock held for the later dereference and\nremoval.\n\nA concurrent MGMT_OP_CANCEL_PAIR_DEVICE request can remove and free the\nsame pending command before the callback uses it. The reverse race is also\npossible when cancel_pair_device() gets a command from pending_find() and a\ncallback removes it before the cancel path dereferences it. This can lead\nto a use-after-free and a second list_del().\n\nMake the pairing lookup helpers transfer ownership of the pending command\nby removing it from hdev-\u003emgmt_pending while holding mgmt_pending_lock.\nThe callbacks and cancel path then complete the command and free it\ndirectly, so racing paths cannot find or free the same command again. Take\na temporary hci_conn reference in cancel_pair_device() because the command\ncompletion drops the reference stored in the pending command."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is triggered through local AF_BLUETOOTH HCI_CHANNEL_CONTROL management commands (hci_sock_bind/sendmsg -\u003e hci_mgmt_cmd -\u003e pair_device/cancel_pair_device); remote Bluetooth peers cannot issue MGMT_OP_PAIR_DEVICE or MGMT_OP_CANCEL_PAIR_DEVICE over the air.\nAC:L - An attacker controls the race by concurrently issuing MGMT_OP_PAIR_DEVICE and MGMT_OP_CANCEL_PAIR_DEVICE from threads or sockets they own while pairing HCI callbacks fire, and can retry until cancel and completion/auth/SMP paths interleave on the same pending command.\nPR:L - pair_device and cancel_pair_device lack HCI_MGMT_UNTRUSTED and require HCI_SOCK_TRUSTED (CAP_NET_ADMIN at bind); per kernel CNA guidance CAP_NET_ADMIN reachable via unprivileged user namespaces (unshare -Urn) maps to PR:L, consistent with similar Bluetooth mgmt UAF scores.\nUI:N - No victim interaction is required beyond a powered Bluetooth controller; the attacker directly sends the conflicting PAIR_DEVICE and CANCEL_PAIR_DEVICE management commands that create the pending entry and race the unlocked find_pairing/pending_find paths against completion callbacks.\nS:U - Exploitation corrupts kernel Bluetooth MGMT heap objects (mgmt_pending_cmd) within the same host kernel security authority; this is standard local kernel memory corruption, not a VM, IOMMU, or cross-authority boundary escape.\nC:H - Use-after-free of mgmt_pending_cmd when find_pairing or pending_find returns a still-linked command without holding mgmt_pending_lock through later dereference and mgmt_pending_remove, enabling arbitrary kernel memory disclosure via slab reuse of the freed object.\nI:H - Slab UAF and double list_del on mgmt_pending_cmd during concurrent cancel_pair_device and pairing/auth/SMP completion callbacks provide attacker-influenced heap corruption primitives exploitable for arbitrary kernel writes and control-flow hijacking per kernel UAF guidance.\nA:H - Dereferencing or list_del on a freed mgmt_pending_cmd during the cancel versus callback race causes kernel oops or panic; repeated concurrent PAIR_DEVICE and CANCEL_PAIR_DEVICE commands during active pairing can reliably crash or hang the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:47:31.049Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/50af4280a587c9971b5388cbc438f1324e626b7b"
},
{
"url": "https://git.kernel.org/stable/c/86ed4dd6548ccf277bc691bc912ca06e76b9d80c"
},
{
"url": "https://git.kernel.org/stable/c/7c2a152a897cd1c184b2051484d4f74d803e7f4a"
},
{
"url": "https://git.kernel.org/stable/c/c569def320aa8b1fde89227e2ea96606790fd86d"
},
{
"url": "https://git.kernel.org/stable/c/51be7280980fddc90ebe874a69c2fe8ab02bb46a"
},
{
"url": "https://git.kernel.org/stable/c/d0a7b48ad0921bd88effaee10bf970ab1d5d0ddd"
}
],
"title": "Bluetooth: mgmt: fix UAF in pair command cancellation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74510",
"datePublished": "2026-08-15T12:27:32.503Z",
"dateReserved": "2026-08-15T05:44:03.909Z",
"dateUpdated": "2026-10-16T19:05:51.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52920 (GCVE-0-2026-52920)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-10-19 19:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_policy: fix strict mode inbound policy matching
match_policy_in() walks sec_path entries from the last transform to the
first one, but strict policy matching needs to consume info->pol[] in
the same forward order as the rule layout.
Derive the strict-match policy position from the number of transforms
already consumed so that multi-element inbound rules are matched
consistently.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52920",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:22:43.940602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-682",
"description": "CWE-682 Incorrect Calculation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:37:00.676Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eb323f7b82d2e2f638de0cc2a177803eb20e0707",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "fc1c518bb1f054831ecabb32da9b8e1dff9699c6",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "f98b7f85e04b40e28b08c461ded0cc79f14f5509",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "82664d0f1ba25e4f9a71994954abae24c60f4067",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "938867e870fb5471bb16f442aeac81326e05bf65",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "392cc1d8408b5665215c1e9290bbf0f92339b043",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "4b2b4d7d4e203c92db8966b163edfacb1f0e1e29",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.17"
},
{
"lessThan": "2.6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_policy: fix strict mode inbound policy matching\n\nmatch_policy_in() walks sec_path entries from the last transform to the\nfirst one, but strict policy matching needs to consume info-\u003epol[] in\nthe same forward order as the rule layout.\n\nDerive the strict-match policy position from the number of transforms\nalready consumed so that multi-element inbound rules are matched\nconsistently."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable matcher is executed while processing inbound IPv4/IPv6 packets through x_tables after XFRM/IPsec has populated the packet sec_path. A remote IPsec peer can trigger the affected strict inbound policy rule by sending network packets in a realistic VPN/gateway deployment.\nAC:L - Exploitation requires a strict inbound xt_policy rule with multiple policy elements and a packet with the same number of transforms, but those are normal affected configurations rather than attacker-uncontrolled races. Once present, triggering is repeatable by sending matching packets.\nPR:L - Unauthenticated packets generally fail XFRM state/authentication before reaching this sec_path-based match, so the network scenario requires an authorized IPsec peer or equivalent low privilege. Locally, the rule/XFRM setup is gated by CAP_NET_ADMIN in the network namespace, which is reachable through user namespaces.\nUI:N - No victim user action is needed after the vulnerable rule/state configuration exists. Packet delivery or local namespace traffic is sufficient to invoke the matcher.\nS:U - The bug is in kernel netfilter/XFRM policy evaluation and impacts the same kernel/network security authority. It does not cross a VM, IOMMU, or separate sandbox security scope.\nC:H - The old strict inbound index calculation can make pos negative and read before info-\u003epol[], including x_tables rule metadata or adjacent kernel allocation contents. Although exposed through match behavior rather than a direct copy_to_user, this is an out-of-bounds kernel read larger than a few bytes, so the higher confidentiality impact is warranted.\nI:L - The bug does not provide a direct write primitive or code execution path, but it can make strict IPsec policy matching produce incorrect firewall decisions. That can bypass or misapply intended packet filtering for affected multi-element inbound rules.\nA:H - The negative-index read can reach outside the intended match data and, for larger strict transform counts or unlucky layout, may fault/oops in kernel packet processing. The condition can be triggered repeatedly with packets once the affected rule path is reachable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:42.384Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707"
},
{
"url": "https://git.kernel.org/stable/c/fc1c518bb1f054831ecabb32da9b8e1dff9699c6"
},
{
"url": "https://git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509"
},
{
"url": "https://git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067"
},
{
"url": "https://git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9"
},
{
"url": "https://git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65"
},
{
"url": "https://git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043"
},
{
"url": "https://git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29"
}
],
"title": "netfilter: xt_policy: fix strict mode inbound policy matching",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52920",
"datePublished": "2026-06-24T07:14:15.866Z",
"dateReserved": "2026-06-09T07:44:35.367Z",
"dateUpdated": "2026-10-19T19:37:00.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72017 (GCVE-0-2026-72017)
Vulnerability from cvelistv5
Published
2026-08-15 05:51
Modified
2026-08-23 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: macb: drop in-flight Tx SKBs on close
The MACB driver has since forever leaked the outgoing SKBs that
have not yet been marked as completed. They live in queue->tx_skb
which gets freed without remorse nor checking.
macb_free_consistent() gets called in a few codepaths, but only close will
trigger the added expressions. In macb_open() and macb_alloc_consistent()
failure cases, queues' tx_skb just got allocated and are empty.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 89e5785fc8a6b9eafd37f2318a9a76d479c796be Version: 89e5785fc8a6b9eafd37f2318a9a76d479c796be Version: 89e5785fc8a6b9eafd37f2318a9a76d479c796be Version: 89e5785fc8a6b9eafd37f2318a9a76d479c796be Version: 89e5785fc8a6b9eafd37f2318a9a76d479c796be Version: 89e5785fc8a6b9eafd37f2318a9a76d479c796be |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cadence/macb_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0e9797dc4ebdefe1b7f931b1f92d5e98e5dbf655",
"status": "affected",
"version": "89e5785fc8a6b9eafd37f2318a9a76d479c796be",
"versionType": "git"
},
{
"lessThan": "6124bd785073659c99385094657b77382ebce11b",
"status": "affected",
"version": "89e5785fc8a6b9eafd37f2318a9a76d479c796be",
"versionType": "git"
},
{
"lessThan": "2143fdc0ce27adbb1caaa1a97e0bfb9f3750aef4",
"status": "affected",
"version": "89e5785fc8a6b9eafd37f2318a9a76d479c796be",
"versionType": "git"
},
{
"lessThan": "26b131b2d5b55a81ef6182769d28105a870c0eb2",
"status": "affected",
"version": "89e5785fc8a6b9eafd37f2318a9a76d479c796be",
"versionType": "git"
},
{
"lessThan": "109241d9880488aafd8e104832b4d4859ad57244",
"status": "affected",
"version": "89e5785fc8a6b9eafd37f2318a9a76d479c796be",
"versionType": "git"
},
{
"lessThan": "27f575836cfebbf872dec020428742b10650a955",
"status": "affected",
"version": "89e5785fc8a6b9eafd37f2318a9a76d479c796be",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cadence/macb_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.20"
},
{
"lessThan": "2.6.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: drop in-flight Tx SKBs on close\n\nThe MACB driver has since forever leaked the outgoing SKBs that\nhave not yet been marked as completed. They live in queue-\u003etx_skb\nwhich gets freed without remorse nor checking.\n\nmacb_free_consistent() gets called in a few codepaths, but only close will\ntrigger the added expressions. In macb_open() and macb_alloc_consistent()\nfailure cases, queues\u0027 tx_skb just got allocated and are empty."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:26.593Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0e9797dc4ebdefe1b7f931b1f92d5e98e5dbf655"
},
{
"url": "https://git.kernel.org/stable/c/6124bd785073659c99385094657b77382ebce11b"
},
{
"url": "https://git.kernel.org/stable/c/2143fdc0ce27adbb1caaa1a97e0bfb9f3750aef4"
},
{
"url": "https://git.kernel.org/stable/c/26b131b2d5b55a81ef6182769d28105a870c0eb2"
},
{
"url": "https://git.kernel.org/stable/c/109241d9880488aafd8e104832b4d4859ad57244"
},
{
"url": "https://git.kernel.org/stable/c/27f575836cfebbf872dec020428742b10650a955"
}
],
"title": "net: macb: drop in-flight Tx SKBs on close",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72017",
"datePublished": "2026-08-15T05:51:44.698Z",
"dateReserved": "2026-08-09T03:40:39.900Z",
"dateUpdated": "2026-08-23T12:46:26.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53163 (GCVE-0-2026-53163)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-07-24 14:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
syzbot triggered the following splat in remove_waiter() via
FUTEX_CMP_REQUEUE_PI:
KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f]
class_raw_spinlock_constructor
remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561
rt_mutex_start_proxy_lock+0x103/0x120
futex_requeue+0x10e4/0x20d0
__x64_sys_futex+0x34f/0x4d0
task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection,
leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead
of current in remove_waiter()") made this fatal.
Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter()
upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock
return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock()
(where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to
account for try_to_take_rt_mutex().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f3fa3424bceb128d2be4b3745506b22844b87db7 Version: 838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd Version: d8cce4773c2b23d819baf5abedc62f7b430e8745 Version: 8a1fc8d698ac5e5916e3082a0f74450d71f9611f Version: 6d52dfcb2a5db86e346cf51f8fcf2071b8085166 Version: 3fb7394a837740770f0d6b4b30567e60786a63f2 Version: 88614876370aac8ad1050ad785a4c095ba17ac11 Version: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/locking/rtmutex.c",
"kernel/locking/rtmutex_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bfbc047ceb42c0e1fac8f3a155d4548a8bbe76b1",
"status": "affected",
"version": "f3fa3424bceb128d2be4b3745506b22844b87db7",
"versionType": "git"
},
{
"lessThan": "4ffacf76a457b7ca8ac05f5df8740b0d8f53574a",
"status": "affected",
"version": "838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd",
"versionType": "git"
},
{
"lessThan": "4afda3a1da02129568a3a2f1898aa13e6763bcba",
"status": "affected",
"version": "d8cce4773c2b23d819baf5abedc62f7b430e8745",
"versionType": "git"
},
{
"lessThan": "6707d7e0b71748cb3cd95bad81dae5fe1b3c8f48",
"status": "affected",
"version": "8a1fc8d698ac5e5916e3082a0f74450d71f9611f",
"versionType": "git"
},
{
"lessThan": "5799f9bd7fee40370b93ab1ddf001cdc7017c14d",
"status": "affected",
"version": "6d52dfcb2a5db86e346cf51f8fcf2071b8085166",
"versionType": "git"
},
{
"lessThan": "a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53",
"status": "affected",
"version": "3fb7394a837740770f0d6b4b30567e60786a63f2",
"versionType": "git"
},
{
"lessThan": "55363fa0a04524d11efeaadee734d2db1756ed27",
"status": "affected",
"version": "88614876370aac8ad1050ad785a4c095ba17ac11",
"versionType": "git"
},
{
"lessThan": "40a25d59e85b3c8709ac2424d44f65610467871e",
"status": "affected",
"version": "3bfdc63936dd4773109b7b8c280c0f3b5ae7d349",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/locking/rtmutex.c",
"kernel/locking/rtmutex_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.1.177",
"status": "affected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThan": "6.6.144",
"status": "affected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThan": "6.12.95",
"status": "affected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThan": "6.18.36",
"status": "affected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThan": "7.0.13",
"status": "affected",
"version": "7.0.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "6.1.175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.6.140",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.12.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.18.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "7.0.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/rtmutex: Skip remove_waiter() when waiter is not enqueued\n\nsyzbot triggered the following splat in remove_waiter() via\nFUTEX_CMP_REQUEUE_PI:\n\n KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f]\n class_raw_spinlock_constructor\n remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561\n rt_mutex_start_proxy_lock+0x103/0x120\n futex_requeue+0x10e4/0x20d0\n __x64_sys_futex+0x34f/0x4d0\n\ntask_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection,\nleaving waiter-\u003etask nil, where 3bfdc63936dd (\"rtmutex: Use waiter::task instead\nof current in remove_waiter()\") made this fatal.\n\nFurthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter()\nupon a successfully grabbing the rtmutex. 1a1fb985f2e2 (\"futex: Handle early deadlock\nreturn correctly\"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock()\n(where \u0027ret\u0027 was only ever 0 or \u003c 0) into the wrapper. Tighten this check to\naccount for try_to_take_rt_mutex()."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:33:48.972Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bfbc047ceb42c0e1fac8f3a155d4548a8bbe76b1"
},
{
"url": "https://git.kernel.org/stable/c/4ffacf76a457b7ca8ac05f5df8740b0d8f53574a"
},
{
"url": "https://git.kernel.org/stable/c/4afda3a1da02129568a3a2f1898aa13e6763bcba"
},
{
"url": "https://git.kernel.org/stable/c/6707d7e0b71748cb3cd95bad81dae5fe1b3c8f48"
},
{
"url": "https://git.kernel.org/stable/c/5799f9bd7fee40370b93ab1ddf001cdc7017c14d"
},
{
"url": "https://git.kernel.org/stable/c/a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53"
},
{
"url": "https://git.kernel.org/stable/c/55363fa0a04524d11efeaadee734d2db1756ed27"
},
{
"url": "https://git.kernel.org/stable/c/40a25d59e85b3c8709ac2424d44f65610467871e"
}
],
"title": "locking/rtmutex: Skip remove_waiter() when waiter is not enqueued",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53163",
"datePublished": "2026-06-25T08:38:44.108Z",
"dateReserved": "2026-06-09T07:44:35.388Z",
"dateUpdated": "2026-07-24T14:33:48.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64593 (GCVE-0-2026-64593)
Vulnerability from cvelistv5
Published
2026-08-06 07:13
Modified
2026-08-17 04:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: do not trim a device which is not writeable
[BUG]
There is a bug report that btrfs/242 can randomly fail with the
following NULL pointer dereference:
run fstests btrfs/242 at 2026-06-01 10:25:08
BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1 transid 9 /dev/sdc (8:32) scanned by mount (122609)
BTRFS info (device sdc): first mount of filesystem d4d7f234-487c-4787-88e4-47a8b68c9874
BTRFS info (device sdc): using crc32c checksum algorithm
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS info (device sdc): allowing degraded mounts
BTRFS info (device sdc): turning on async discard
BTRFS info (device sdc): enabling free space tree
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000
CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed e9a5f6b24978fba3bf015a992f865837fdfff3dd
Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025
pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : btrfs_trim_fs+0x34c/0xa00 [btrfs]
lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs]
Call trace:
btrfs_trim_fs+0x34c/0xa00 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] (P)
btrfs_ioctl_fitrim+0xe8/0x178 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
btrfs_ioctl+0xdd4/0x2bd8 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
__arm64_sys_ioctl+0xac/0x108
invoke_syscall.constprop.0+0x5c/0xd0
el0_svc_common.constprop.0+0x40/0xf0
do_el0_svc+0x24/0x40
el0_svc+0x40/0x1d0
el0t_64_sync_handler+0xa0/0xe8
el0t_64_sync+0x1b0/0x1b8
Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00)
---[ end trace 0000000000000000 ]---
Also the reporter is very kind to test the following ASSERT() added to
btrfs_trim_free_extents_throttle():
ASSERT(device->bdev,
"devid=%llu path=%s dev_state=0x%lx\n",
device->devid, btrfs_dev_name(device), device->dev_state);
And it shows the following output:
assertion failed: device->bdev, in extent-tree.c:6630 (devid=2 path=/dev/sdd dev_state=0x82)
Which means the device->bdev is NULL, and the dev_state is
BTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND, without
BTRFS_DEV_STATE_WRITEABLE flag set.
[CAUSE]
The pc points to the following call chain:
btrfs_trim_fs()
|- btrfs_trim_free_extents()
|- btrfs_trim_free_extents_throttle()
|- bdev_max_discard_sectors(device->bdev)
So the NULL pointer dereference is caused by device->bdev being NULL.
This looks impossible by a quick glance, as just before calling
btrfs_trim_free_extents_throttle(), we have skipped any device that has
BTRFS_DEV_STATE_MISSING flag set.
However in this particular case, there is a window where the missing
device is later re-scanned, causing btrfs to remove the
BTRFS_DEV_STATE_MISSING flag:
btrfs_control_ioctl()
|- btrfs_scan_one_device()
|- device_list_add()
|- rcu_assign_pointer(device->name, name);
| This updates the missing device's path to the new good path.
|
|- clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)
This removes the BTRFS_DEV_STATE_MISSING flag.
This allows the missing device to re-appear and clear the
BTRFS_DEV_STATE_MISSING flag. However the device still does not have
the BTRFS_DEV_STATE_WRITEABLE flag set, nor is its bdev pointer updated.
The bdev pointer remains NULL, triggering the crash later.
[FIX]
This is a big de-synchronization between BTRFS_DEV_STATE_MISSING and
device->bdev pointer, and shows a gap in btrfs's re-appearing-device
handling.
The proper handling of re-appearing device will need quite some extra
work, which is out of the context of this small
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 499f377f49f085ee4aa214c738e948e88626f39b Version: 499f377f49f085ee4aa214c738e948e88626f39b Version: 499f377f49f085ee4aa214c738e948e88626f39b Version: 499f377f49f085ee4aa214c738e948e88626f39b Version: 499f377f49f085ee4aa214c738e948e88626f39b Version: 499f377f49f085ee4aa214c738e948e88626f39b Version: 499f377f49f085ee4aa214c738e948e88626f39b Version: 499f377f49f085ee4aa214c738e948e88626f39b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/extent-tree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f41ae7e6664f3c4361129728f2c4d5f3ed995251",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "210af872eafa0cf572a84cb303c0f9d2914c1226",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "3d8fa4b828a86b33c60858e58aaab6df273ede05",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "9c894159c5b8adc84072e3af0e55b0473a69564e",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "02c903fc6fc7e16c5d1f22d18784f1208acf43e3",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "7a64521802997257b144e6edfb4e278dbeb972dd",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "b4af31b898a948e29861cb0bae734058f9a49d9b",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
},
{
"lessThan": "1b1937eb08f51319bf71575484cde2b8c517aedc",
"status": "affected",
"version": "499f377f49f085ee4aa214c738e948e88626f39b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/extent-tree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not trim a device which is not writeable\n\n[BUG]\nThere is a bug report that btrfs/242 can randomly fail with the\nfollowing NULL pointer dereference:\n\n run fstests btrfs/242 at 2026-06-01 10:25:08\n BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1 transid 9 /dev/sdc (8:32) scanned by mount (122609)\n BTRFS info (device sdc): first mount of filesystem d4d7f234-487c-4787-88e4-47a8b68c9874\n BTRFS info (device sdc): using crc32c checksum algorithm\n BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing\n BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing\n BTRFS info (device sdc): allowing degraded mounts\n BTRFS info (device sdc): turning on async discard\n BTRFS info (device sdc): enabling free space tree\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\n user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000\n CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed e9a5f6b24978fba3bf015a992f865837fdfff3dd\n Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025\n pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n pc : btrfs_trim_fs+0x34c/0xa00 [btrfs]\n lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs]\n Call trace:\n btrfs_trim_fs+0x34c/0xa00 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] (P)\n btrfs_ioctl_fitrim+0xe8/0x178 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]\n btrfs_ioctl+0xdd4/0x2bd8 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]\n __arm64_sys_ioctl+0xac/0x108\n invoke_syscall.constprop.0+0x5c/0xd0\n el0_svc_common.constprop.0+0x40/0xf0\n do_el0_svc+0x24/0x40\n el0_svc+0x40/0x1d0\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1b0/0x1b8\n Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00)\n ---[ end trace 0000000000000000 ]---\n\nAlso the reporter is very kind to test the following ASSERT() added to\nbtrfs_trim_free_extents_throttle():\n\n\tASSERT(device-\u003ebdev,\n\t \"devid=%llu path=%s dev_state=0x%lx\\n\",\n\t device-\u003edevid, btrfs_dev_name(device), device-\u003edev_state);\n\nAnd it shows the following output:\n\n assertion failed: device-\u003ebdev, in extent-tree.c:6630 (devid=2 path=/dev/sdd dev_state=0x82)\n\nWhich means the device-\u003ebdev is NULL, and the dev_state is\nBTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND, without\nBTRFS_DEV_STATE_WRITEABLE flag set.\n\n[CAUSE]\nThe pc points to the following call chain:\n\n btrfs_trim_fs()\n |- btrfs_trim_free_extents()\n |- btrfs_trim_free_extents_throttle()\n |- bdev_max_discard_sectors(device-\u003ebdev)\n\nSo the NULL pointer dereference is caused by device-\u003ebdev being NULL.\n\nThis looks impossible by a quick glance, as just before calling\nbtrfs_trim_free_extents_throttle(), we have skipped any device that has\nBTRFS_DEV_STATE_MISSING flag set.\n\nHowever in this particular case, there is a window where the missing\ndevice is later re-scanned, causing btrfs to remove the\nBTRFS_DEV_STATE_MISSING flag:\n\n btrfs_control_ioctl()\n |- btrfs_scan_one_device()\n |- device_list_add()\n |- rcu_assign_pointer(device-\u003ename, name);\n | This updates the missing device\u0027s path to the new good path.\n |\n |- clear_bit(BTRFS_DEV_STATE_MISSING, \u0026device-\u003edev_state)\n This removes the BTRFS_DEV_STATE_MISSING flag.\n\nThis allows the missing device to re-appear and clear the\nBTRFS_DEV_STATE_MISSING flag. However the device still does not have\nthe BTRFS_DEV_STATE_WRITEABLE flag set, nor is its bdev pointer updated.\n\nThe bdev pointer remains NULL, triggering the crash later.\n\n[FIX]\nThis is a big de-synchronization between BTRFS_DEV_STATE_MISSING and\ndevice-\u003ebdev pointer, and shows a gap in btrfs\u0027s re-appearing-device\nhandling.\n\nThe proper handling of re-appearing device will need quite some extra\nwork, which is out of the context of this small\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:58:15.319Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f41ae7e6664f3c4361129728f2c4d5f3ed995251"
},
{
"url": "https://git.kernel.org/stable/c/210af872eafa0cf572a84cb303c0f9d2914c1226"
},
{
"url": "https://git.kernel.org/stable/c/3d8fa4b828a86b33c60858e58aaab6df273ede05"
},
{
"url": "https://git.kernel.org/stable/c/9c894159c5b8adc84072e3af0e55b0473a69564e"
},
{
"url": "https://git.kernel.org/stable/c/02c903fc6fc7e16c5d1f22d18784f1208acf43e3"
},
{
"url": "https://git.kernel.org/stable/c/7a64521802997257b144e6edfb4e278dbeb972dd"
},
{
"url": "https://git.kernel.org/stable/c/b4af31b898a948e29861cb0bae734058f9a49d9b"
},
{
"url": "https://git.kernel.org/stable/c/1b1937eb08f51319bf71575484cde2b8c517aedc"
}
],
"title": "btrfs: do not trim a device which is not writeable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64593",
"datePublished": "2026-08-06T07:13:49.700Z",
"dateReserved": "2026-07-19T15:36:31.799Z",
"dateUpdated": "2026-08-17T04:58:15.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64408 (GCVE-0-2026-64408)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: bnep: pin L2CAP connection during netdev registration
bnep_add_connection() reads the L2CAP connection without holding the
channel lock, then passes its HCI device to register_netdev(). Controller
teardown can clear and release that connection concurrently, leaving the
network device registration path to dereference a freed parent device.
Take a reference to the L2CAP connection while holding the channel lock.
Retain it until register_netdev() has taken the parent device reference.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 65f53e9802dbfae0e5758a91793c3f5f8bece49b Version: 65f53e9802dbfae0e5758a91793c3f5f8bece49b Version: 65f53e9802dbfae0e5758a91793c3f5f8bece49b Version: 65f53e9802dbfae0e5758a91793c3f5f8bece49b Version: 65f53e9802dbfae0e5758a91793c3f5f8bece49b Version: 65f53e9802dbfae0e5758a91793c3f5f8bece49b Version: 65f53e9802dbfae0e5758a91793c3f5f8bece49b Version: 65f53e9802dbfae0e5758a91793c3f5f8bece49b |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64408",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:40:17.231928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:27.425Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/bnep/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "390b5db3ff8745187f094c4e915663b7b1f98944",
"status": "affected",
"version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
"versionType": "git"
},
{
"lessThan": "46a88784c4c9b96954dd86f747ce93f65efa1302",
"status": "affected",
"version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
"versionType": "git"
},
{
"lessThan": "551ae773ec64045b4e72099132654887e0270bcc",
"status": "affected",
"version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
"versionType": "git"
},
{
"lessThan": "ae215c5b6422d8eda443b861b124bd1be6969c31",
"status": "affected",
"version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
"versionType": "git"
},
{
"lessThan": "df22adc7eafc22e651561813c11dc51a796b12ee",
"status": "affected",
"version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
"versionType": "git"
},
{
"lessThan": "a6b22dbd80926556290ad2243be25218d6956a19",
"status": "affected",
"version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
"versionType": "git"
},
{
"lessThan": "563a8573047182f550b1e1e030615755cd8c41da",
"status": "affected",
"version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
"versionType": "git"
},
{
"lessThan": "bb067a99a0356196c0b89a95721985485ebce5a5",
"status": "affected",
"version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/bnep/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: pin L2CAP connection during netdev registration\n\nbnep_add_connection() reads the L2CAP connection without holding the\nchannel lock, then passes its HCI device to register_netdev(). Controller\nteardown can clear and release that connection concurrently, leaving the\nnetwork device registration path to dereference a freed parent device.\n\nTake a reference to the L2CAP connection while holding the channel lock.\nRetain it until register_netdev() has taken the parent device reference."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - An adjacent Bluetooth peer can initiate a BNEP/PAN connection that causes privileged bluetoothd to issue BNEPCONNADD, then tear down the ACL link during netdev registration. Exploitation therefore requires Bluetooth radio adjacency.\nAC:L - The peer controls both the connection setup that triggers the ioctl and the competing disconnect, and can repeat attempts until the lifetime window is hit. No condition beyond the attacker\u0027s practical control is required.\nPR:N - The adjacent peer needs no Linux credentials or capabilities because root bluetoothd performs the CAP_NET_ADMIN ioctl on its behalf in an enabled, auto-authorized PAN deployment. The direct ioctl requires CAP_NET_ADMIN in the initial user namespace, but the adjacent path does not.\nUI:N - An enabled PAN service can automatically accept or pre-authorize connections, after which setup and teardown require no victim action. Prior service configuration is not user interaction during exploitation.\nS:U - The memory corruption occurs in the host kernel and compromises resources governed by that same kernel security authority. It does not cross a VM, IOMMU, or comparable security boundary.\nC:H - The stale parent points into a freed hci_conn allocation, and reclaiming that use-after-free object can enable disclosure of arbitrary kernel memory. Confidentiality impact is therefore High.\nI:H - device_add() calls get_device() on the freed parent, producing a refcount write into reclaimed memory and potentially further device-list corruption. The use-after-free can support arbitrary kernel-memory corruption or control-flow hijacking.\nA:H - The use-after-free can cause a kernel oops, panic, or corrupted device hierarchy during netdev registration. An adjacent peer can repeatedly initiate and terminate connections to crash the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:06.785Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944"
},
{
"url": "https://git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302"
},
{
"url": "https://git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc"
},
{
"url": "https://git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31"
},
{
"url": "https://git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee"
},
{
"url": "https://git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19"
},
{
"url": "https://git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da"
},
{
"url": "https://git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5"
}
],
"title": "Bluetooth: bnep: pin L2CAP connection during netdev registration",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64408",
"datePublished": "2026-07-25T08:50:49.807Z",
"dateReserved": "2026-07-19T15:36:31.786Z",
"dateUpdated": "2026-10-19T20:38:27.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72502 (GCVE-0-2026-72502)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535).
This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535.
However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel.
If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will
be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer
dereference because local TCP packets do not use frag_list.
Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from
ip6_default_advmss() when MTU is large.
Also update the stale comment in ip6_default_advmss() which suggested
that IPV6_MAXPLEN is returned to mean "any MSS".
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3953c46c3ac7eef31a9935427371c6f54a22f1ba Version: 3953c46c3ac7eef31a9935427371c6f54a22f1ba Version: 3953c46c3ac7eef31a9935427371c6f54a22f1ba Version: 3953c46c3ac7eef31a9935427371c6f54a22f1ba Version: 3953c46c3ac7eef31a9935427371c6f54a22f1ba Version: 3953c46c3ac7eef31a9935427371c6f54a22f1ba Version: 3953c46c3ac7eef31a9935427371c6f54a22f1ba Version: 3953c46c3ac7eef31a9935427371c6f54a22f1ba |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72502",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:51:17.494885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:27.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "560b33b434e922ef97f9ff23aa2e909ef7aacd5c",
"status": "affected",
"version": "3953c46c3ac7eef31a9935427371c6f54a22f1ba",
"versionType": "git"
},
{
"lessThan": "21f69ac1879bb970588d5e7c12a96e6542f7c1a7",
"status": "affected",
"version": "3953c46c3ac7eef31a9935427371c6f54a22f1ba",
"versionType": "git"
},
{
"lessThan": "c0db3dc2ac323b6c4b76adede3b355a9daa6dea8",
"status": "affected",
"version": "3953c46c3ac7eef31a9935427371c6f54a22f1ba",
"versionType": "git"
},
{
"lessThan": "572fff10819dfc359298d1f774839e76a4d96f93",
"status": "affected",
"version": "3953c46c3ac7eef31a9935427371c6f54a22f1ba",
"versionType": "git"
},
{
"lessThan": "8e6214a530c03e341dc1b0a846c8f2b716b3551a",
"status": "affected",
"version": "3953c46c3ac7eef31a9935427371c6f54a22f1ba",
"versionType": "git"
},
{
"lessThan": "d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e",
"status": "affected",
"version": "3953c46c3ac7eef31a9935427371c6f54a22f1ba",
"versionType": "git"
},
{
"lessThan": "a210791f33345aa87187f7d7a9f3b9b7f4a28e6d",
"status": "affected",
"version": "3953c46c3ac7eef31a9935427371c6f54a22f1ba",
"versionType": "git"
},
{
"lessThan": "2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22",
"status": "affected",
"version": "3953c46c3ac7eef31a9935427371c6f54a22f1ba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)\n\nWhen MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535).\nThis is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535.\n\nHowever, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel.\nIf a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will\nbe mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer\ndereference because local TCP packets do not use frag_list.\n\nFix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from\nip6_default_advmss() when MTU is large.\n\nAlso update the stale comment in ip6_default_advmss() which suggested\nthat IPV6_MAXPLEN is returned to mean \"any MSS\"."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Reachable from the network via IPv6 TCP: a remote peer sends a crafted SYN (MSS=65535) or connects over a large-MTU IPv6 route, causing outbound TCP GSO skbs with gso_size=0xFFFF to be software-segmented in skb_segment() during normal packet transmit.\nAC:L - The attacker controls the TCP handshake MSS option and can induce \u003e64KB outbound segments; syzbot reproduced this reliably, and software GSO paths (loopback, veth, NETIF_F_GSO_SOFTWARE) are common in cloud/container deployments where skb_segment() is invoked.\nPR:N - No privileges are required; exploitation occurs on the pre-authentication passive-open path where the kernel accepts a remote TCP SYN and MSS option before any application-level authentication.\nUI:N - No victim user interaction is needed beyond the target system normally accepting IPv6 TCP connections and transmitting response data to the attacker-controlled peer.\nS:U - The vulnerability causes a kernel crash on the attacked host itself; it does not cross a security boundary such as a VM escape, container sandbox breakout, or IOMMU/DMA isolation bypass.\nC:N - Impact is a NULL pointer dereference in skb_segment() when gso_size equals GSO_BY_FRAGS; there is no out-of-bounds read, use-after-free, or other memory disclosure primitive.\nI:N - The bug does not corrupt or modify attacker-controlled memory; it dereferences a NULL frag_list pointer during segmentation, yielding a crash rather than a write or code-execution primitive.\nA:H - The NULL pointer dereference in skb_segment() triggers a kernel oops/panic, causing complete loss of availability for the affected system when the malicious IPv6 TCP traffic path is exercised."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:45:02.121Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/560b33b434e922ef97f9ff23aa2e909ef7aacd5c"
},
{
"url": "https://git.kernel.org/stable/c/21f69ac1879bb970588d5e7c12a96e6542f7c1a7"
},
{
"url": "https://git.kernel.org/stable/c/c0db3dc2ac323b6c4b76adede3b355a9daa6dea8"
},
{
"url": "https://git.kernel.org/stable/c/572fff10819dfc359298d1f774839e76a4d96f93"
},
{
"url": "https://git.kernel.org/stable/c/8e6214a530c03e341dc1b0a846c8f2b716b3551a"
},
{
"url": "https://git.kernel.org/stable/c/d774cdbda6634a78d0f2baf201ee5a8c57f3bc0e"
},
{
"url": "https://git.kernel.org/stable/c/a210791f33345aa87187f7d7a9f3b9b7f4a28e6d"
},
{
"url": "https://git.kernel.org/stable/c/2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22"
}
],
"title": "tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72502",
"datePublished": "2026-08-15T05:57:33.647Z",
"dateReserved": "2026-08-09T03:40:39.938Z",
"dateUpdated": "2026-10-16T18:55:27.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74417 (GCVE-0-2026-74417)
Vulnerability from cvelistv5
Published
2026-08-15 05:59
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/radeon: fix integer overflow in radeon_align_pitch()
radeon_align_pitch() has the same kind of overflow issue as the old
amdgpu helper: both the alignment round-up add and the final
'aligned * cpp' calculation can overflow signed int.
If that wraps, radeon_mode_dumb_create() can end up returning an
invalid pitch or creating a zero-sized dumb buffer.
Fix this by using check_add_overflow() for the alignment round-up and
check_mul_overflow() for the final pitch calculation, returning 0 on
overflow. Also reject zero pitch and size in
radeon_mode_dumb_create().
Found via AST-based call-graph analysis using sqry.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74417",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:56:15.722090Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:44.717Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/radeon/radeon_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7b44937c548c2c987fcdd129f8896741004bed6",
"status": "affected",
"version": "ff72145badb834e8051719ea66e024784d000cb4",
"versionType": "git"
},
{
"lessThan": "415bb9893e249e46aa5159f7363a11512cf06fa9",
"status": "affected",
"version": "ff72145badb834e8051719ea66e024784d000cb4",
"versionType": "git"
},
{
"lessThan": "d9dfa176899d488e48bb7342d2c43ddd36e66318",
"status": "affected",
"version": "ff72145badb834e8051719ea66e024784d000cb4",
"versionType": "git"
},
{
"lessThan": "dfc7b5b5599472277e71e5bd2712740651c7c5be",
"status": "affected",
"version": "ff72145badb834e8051719ea66e024784d000cb4",
"versionType": "git"
},
{
"lessThan": "ce3b24eb3ee8f82de851535f516bf21f83e82259",
"status": "affected",
"version": "ff72145badb834e8051719ea66e024784d000cb4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/radeon/radeon_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.39"
},
{
"lessThan": "2.6.39",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.39",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix integer overflow in radeon_align_pitch()\n\nradeon_align_pitch() has the same kind of overflow issue as the old\namdgpu helper: both the alignment round-up add and the final\n\u0027aligned * cpp\u0027 calculation can overflow signed int.\n\nIf that wraps, radeon_mode_dumb_create() can end up returning an\ninvalid pitch or creating a zero-sized dumb buffer.\n\nFix this by using check_add_overflow() for the alignment round-up and\ncheck_mul_overflow() for the final pitch calculation, returning 0 on\noverflow. Also reject zero pitch and size in\nradeon_mode_dumb_create().\n\nFound via AST-based call-graph analysis using sqry."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via DRM_IOCTL_MODE_CREATE_DUMB on a local primary DRM device node (/dev/dri/card*); radeon_drm_ioctl() dispatches to radeon_mode_dumb_create() -\u003e radeon_align_pitch(), with no network, Bluetooth, or remote packet path to this legacy radeon KMS driver.\nAC:L - An attacker fully controls width, height, and bpp in the ioctl and can pick values (e.g. width=0x3FFFFFC0, bpp=32) that pass generic drm_mode_create_dumb() checks yet wrap signed-int pitch math, deterministically yielding zero or invalid pitch without races or uncontrollable layout.\nPR:L - Exploitation requires opening the primary DRM node (render clients are blocked because CREATE_DUMB lacks DRM_RENDER_ALLOW); typical access is via the video group or logind session ACLs, i.e. a low-privileged local account, not root/CAP_SYS_ADMIN in the init namespace.\nUI:N - The attacker triggers the overflow from their own process by issuing CREATE_DUMB with crafted dimensions; no victim must mount filesystems, click links, or perform any separate action.\nS:U - Impact is in-kernel GEM/TTM memory corruption and privilege escalation within the host kernel security boundary, not a KVM guest-to-host escape, IOMMU bypass, or other cross-authority scope change.\nC:H - Signed-int overflow can return pitch 0 or a bogus u32 pitch while drm_mode_create_dumb() already validated a much larger stride, creating undersized VRAM/GTT GEM objects whose metadata mismatches actual backing, enabling out-of-bounds kernel reads of adjacent allocations.\nI:H - A zero-sized or undersized dumb buffer paired with attacker-chosen width/height lets subsequent mmap, map_dumb, and GPU scanout paths treat the object as larger than allocated, corrupting adjacent kernel heap/VRAM objects and enabling control-flow hijack primitives.\nA:H - Pre-fix code allocates zero-byte GEM objects on overflow instead of failing cleanly, and malformed pitch/size metadata can provoke kernel oopses, GPU faults, or repeatable denial of service when the BO is mapped or used for display."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:46:58.637Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7b44937c548c2c987fcdd129f8896741004bed6"
},
{
"url": "https://git.kernel.org/stable/c/415bb9893e249e46aa5159f7363a11512cf06fa9"
},
{
"url": "https://git.kernel.org/stable/c/d9dfa176899d488e48bb7342d2c43ddd36e66318"
},
{
"url": "https://git.kernel.org/stable/c/dfc7b5b5599472277e71e5bd2712740651c7c5be"
},
{
"url": "https://git.kernel.org/stable/c/ce3b24eb3ee8f82de851535f516bf21f83e82259"
}
],
"title": "drm/radeon: fix integer overflow in radeon_align_pitch()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74417",
"datePublished": "2026-08-15T05:59:22.731Z",
"dateReserved": "2026-08-15T05:44:03.893Z",
"dateUpdated": "2026-10-16T19:05:44.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68349 (GCVE-0-2026-68349)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-08-19 16:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: carl9170: fix buffer overflow in rx_stream failover path
The failover continuation in carl9170_rx_stream() copies the full tlen
from the second USB transfer instead of capping at rx_failover_missing
bytes. When both transfers are near maximum size, the total exceeds the
65535-byte failover SKB, triggering skb_over_panic.
Limit the copy size to the missing byte count.
[Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c Version: a84fab3cbfdc427e7d366f1cc844f27b2084c26c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/carl9170/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5fb00a09e9b0375e1ad9d4fefc4a62a67e7ea658",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "48c81fb523ecdc6a4b8654944ff32e499f21e6d0",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "a1ce01764a812c22a47d30aea78e347aebd3eea1",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "5acfa18de66b6089b81c1c0bf1a3ae3c940ec39e",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "b9dfee5e63ee9b5c47be9e344ebc5bd3f43fca78",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "4503829843353dbb18b879c35be1cdfc9af677b7",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "21f59906ea75618fdd46a7e32754d54fbee083ea",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
},
{
"lessThan": "a1a21995c2e1cc2ca6b2226cfe4f5f018370182a",
"status": "affected",
"version": "a84fab3cbfdc427e7d366f1cc844f27b2084c26c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/carl9170/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: carl9170: fix buffer overflow in rx_stream failover path\n\nThe failover continuation in carl9170_rx_stream() copies the full tlen\nfrom the second USB transfer instead of capping at rx_failover_missing\nbytes. When both transfers are near maximum size, the total exceeds the\n65535-byte failover SKB, triggering skb_over_panic.\n\nLimit the copy size to the missing byte count.\n\n[Fix checkpatch CHECK:PARENTHESIS_ALIGNMENT]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:33:47.832Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5fb00a09e9b0375e1ad9d4fefc4a62a67e7ea658"
},
{
"url": "https://git.kernel.org/stable/c/48c81fb523ecdc6a4b8654944ff32e499f21e6d0"
},
{
"url": "https://git.kernel.org/stable/c/a1ce01764a812c22a47d30aea78e347aebd3eea1"
},
{
"url": "https://git.kernel.org/stable/c/5acfa18de66b6089b81c1c0bf1a3ae3c940ec39e"
},
{
"url": "https://git.kernel.org/stable/c/b9dfee5e63ee9b5c47be9e344ebc5bd3f43fca78"
},
{
"url": "https://git.kernel.org/stable/c/4503829843353dbb18b879c35be1cdfc9af677b7"
},
{
"url": "https://git.kernel.org/stable/c/21f59906ea75618fdd46a7e32754d54fbee083ea"
},
{
"url": "https://git.kernel.org/stable/c/a1a21995c2e1cc2ca6b2226cfe4f5f018370182a"
}
],
"title": "wifi: carl9170: fix buffer overflow in rx_stream failover path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68349",
"datePublished": "2026-08-10T12:03:26.166Z",
"dateReserved": "2026-07-30T09:28:09.384Z",
"dateUpdated": "2026-08-19T16:33:47.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74345 (GCVE-0-2026-74345)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix endpoint/socket association handling
Disassociating a socket from an endpoint via siw_socket_disassoc() may
release the last reference on that endpoint and free it. Therefore, don't
clear the endpoints socket pointer after calling that function, but
within.
This fixes a:
BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
which occurred after processing a malformed MPA request during connection
establishment, causing the new endpoint to be closed.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74345",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:54:06.183772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:34.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff584d3735b13a1d7f8cd072f98fea40b6062518",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "b28d513393f81e2de00f82970487a9d001557e4e",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "f6183983ce1ff254d629a333739082b39d7c5eb6",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "b6cf763eee0a932792bef64ceaca568d324192fc",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "ea4f6f6c53577fb3f05dbd78b15e586772d49831",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix endpoint/socket association handling\n\nDisassociating a socket from an endpoint via siw_socket_disassoc() may\nrelease the last reference on that endpoint and free it. Therefore, don\u0027t\nclear the endpoints socket pointer after calling that function, but\nwithin.\n\nThis fixes a:\n\n BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)\n\nwhich occurred after processing a malformed MPA request during connection\nestablishment, causing the new endpoint to be closed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is hit while processing attacker-supplied MPA/TCP data on an inbound SIW listener socket during connection establishment, which is a standard network protocol path analogous to other in-kernel TCP service handlers.\nAC:L - An attacker fully controls the TCP connection and malformed MPA request bytes that deterministically fail parsing and drive the endpoint teardown path where the refcount bug frees the cep before it is accessed again.\nPR:N - Exploitation requires only the ability to open a TCP connection to a host running an SIW RDMA listener; the MPA handshake is unauthenticated and occurs before any RDMA credentials or local privileges are established.\nUI:N - No end-user action is required at exploit time; the kernel processes the malicious inbound connection automatically once an administrator has started an RDMA listener service.\nS:U - Impact is confined to kernel memory corruption and potential host privilege escalation within the same kernel security authority, not a VM escape or cross-authority boundary such as guest-to-hypervisor.\nC:H - The vulnerability is a slab use-after-free on a freed siw_cep object; UAF on attacker-influenced connection teardown enables heap grooming and arbitrary kernel memory read primitives beyond a simple crash.\nI:H - Use-after-free of the connection endpoint structure in kernel heap can be leveraged for controlled writes and code execution via object reuse and function pointer/callback corruption, not merely data integrity of a single field.\nA:H - The bug was reproduced as a KASAN slab-use-after-free in siw_cm_work_handler during malformed MPA processing, which can cause kernel oops/panic and denial of service on the target host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:24.765Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff584d3735b13a1d7f8cd072f98fea40b6062518"
},
{
"url": "https://git.kernel.org/stable/c/b28d513393f81e2de00f82970487a9d001557e4e"
},
{
"url": "https://git.kernel.org/stable/c/f6183983ce1ff254d629a333739082b39d7c5eb6"
},
{
"url": "https://git.kernel.org/stable/c/b6cf763eee0a932792bef64ceaca568d324192fc"
},
{
"url": "https://git.kernel.org/stable/c/ea4f6f6c53577fb3f05dbd78b15e586772d49831"
}
],
"title": "RDMA/siw: Fix endpoint/socket association handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74345",
"datePublished": "2026-08-15T05:58:33.906Z",
"dateReserved": "2026-08-15T05:44:03.886Z",
"dateUpdated": "2026-10-21T12:45:24.765Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64544 (GCVE-0-2026-64544)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
pefile_digest_pe_contents() computes the trailing-data hash length as
pelen - (hashed_bytes + certs_size). A crafted PE can make the addition
exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB.
This is passed to crypto_shash_update() which reads out of bounds and
panics on unmapped vmalloc guard pages.
BUG: unable to handle page fault for address: ffffc900038d8000
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152)
Call Trace:
<TASK>
__sha256_update (lib/crypto/sha256.c:208)
crypto_sha256_update (crypto/sha256.c:142)
verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436)
kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151)
__do_sys_kexec_file_load (kernel/kexec_file.c:406)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
</TASK>
Kernel panic - not syncing: Fatal exception
Validate that the addition does not overflow and the result does not
exceed pelen before the subtraction. Return -ELIBBAD on failure.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/asymmetric_keys/verify_pefile.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89efd998470a93284b7ad5a20d4e0e3c6858ae8e",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "b798ada5a5d1cb4cc4cfa72074b1b463eca6c506",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "627938383761fb4334b41ebe7ef438d6b8b19d60",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "e162bc386e71b5412425a38ee048e8d2185491b9",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "6acd2fbd00f9c72aebefce63fc2e73e8f3d79061",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "803591785d33cf13b6f73ce2796e8b9e6d5e6526",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "f7dd32c5179d7755de18e21d5674b08f9e5cb180",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/asymmetric_keys/verify_pefile.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents\n\npefile_digest_pe_contents() computes the trailing-data hash length as\npelen - (hashed_bytes + certs_size). A crafted PE can make the addition\nexceed pelen, causing the unsigned subtraction to underflow to ~4 GiB.\nThis is passed to crypto_shash_update() which reads out of bounds and\npanics on unmapped vmalloc guard pages.\n\n BUG: unable to handle page fault for address: ffffc900038d8000\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152)\n Call Trace:\n \u003cTASK\u003e\n __sha256_update (lib/crypto/sha256.c:208)\n crypto_sha256_update (crypto/sha256.c:142)\n verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436)\n kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151)\n __do_sys_kexec_file_load (kernel/kexec_file.c:406)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception\n\nValidate that the addition does not overflow and the result does not\nexceed pelen before the subtraction. Return -ELIBBAD on failure."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:21.054Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/89efd998470a93284b7ad5a20d4e0e3c6858ae8e"
},
{
"url": "https://git.kernel.org/stable/c/7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c"
},
{
"url": "https://git.kernel.org/stable/c/b798ada5a5d1cb4cc4cfa72074b1b463eca6c506"
},
{
"url": "https://git.kernel.org/stable/c/627938383761fb4334b41ebe7ef438d6b8b19d60"
},
{
"url": "https://git.kernel.org/stable/c/e162bc386e71b5412425a38ee048e8d2185491b9"
},
{
"url": "https://git.kernel.org/stable/c/6acd2fbd00f9c72aebefce63fc2e73e8f3d79061"
},
{
"url": "https://git.kernel.org/stable/c/803591785d33cf13b6f73ce2796e8b9e6d5e6526"
},
{
"url": "https://git.kernel.org/stable/c/f7dd32c5179d7755de18e21d5674b08f9e5cb180"
}
],
"title": "crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64544",
"datePublished": "2026-07-27T20:10:36.101Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:21.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64048 (GCVE-0-2026-64048)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is
reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt()
populates V2 entries starting at index 1, so when no V1 device is
selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] ==
NULL and ism_chid[0] == 0.
smc_v2_determine_accepted_chid() then matches the peer's CHID against
the array starting from index 0 using the CHID alone. A malicious
peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches
the empty slot, ini->ism_selected becomes 0, and the subsequent
ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at
offsetof(struct smcd_dev, lgr_lock) == 0x68:
BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0
Write of size 4 at addr 0000000000000068 by task exploit/144
Call Trace:
_raw_spin_lock_bh
smc_conn_create (net/smc/smc_core.c:1997)
__smc_connect (net/smc/af_smc.c:1447)
smc_connect (net/smc/af_smc.c:1720)
__sys_connect
__x64_sys_connect
do_syscall_64
Require ism_dev[i] to be non-NULL before accepting a CHID match.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a7c9c5f4af7f6098da68705fc5d86565d0728ef7 Version: a7c9c5f4af7f6098da68705fc5d86565d0728ef7 Version: a7c9c5f4af7f6098da68705fc5d86565d0728ef7 Version: a7c9c5f4af7f6098da68705fc5d86565d0728ef7 Version: a7c9c5f4af7f6098da68705fc5d86565d0728ef7 Version: a7c9c5f4af7f6098da68705fc5d86565d0728ef7 Version: a7c9c5f4af7f6098da68705fc5d86565d0728ef7 Version: a7c9c5f4af7f6098da68705fc5d86565d0728ef7 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64048",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:56.958231Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:10.855Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/af_smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "903f7688ffeb9b323d70652c01f554bd4ba2a3d6",
"status": "affected",
"version": "a7c9c5f4af7f6098da68705fc5d86565d0728ef7",
"versionType": "git"
},
{
"lessThan": "dd2f9dd83c68abd7ba7ded7075290b016cb7ecd0",
"status": "affected",
"version": "a7c9c5f4af7f6098da68705fc5d86565d0728ef7",
"versionType": "git"
},
{
"lessThan": "6927cacf2b10d4fa80c1a2d407512ef9397c59c6",
"status": "affected",
"version": "a7c9c5f4af7f6098da68705fc5d86565d0728ef7",
"versionType": "git"
},
{
"lessThan": "d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0",
"status": "affected",
"version": "a7c9c5f4af7f6098da68705fc5d86565d0728ef7",
"versionType": "git"
},
{
"lessThan": "53eb7bd09aace72fa17510d80e0caf5ca058c231",
"status": "affected",
"version": "a7c9c5f4af7f6098da68705fc5d86565d0728ef7",
"versionType": "git"
},
{
"lessThan": "afa9036b8c9963947b487c36e332df6a42c96fcb",
"status": "affected",
"version": "a7c9c5f4af7f6098da68705fc5d86565d0728ef7",
"versionType": "git"
},
{
"lessThan": "65edb3b0822cfe5041be8fbabebd57e2e5ad9f4e",
"status": "affected",
"version": "a7c9c5f4af7f6098da68705fc5d86565d0728ef7",
"versionType": "git"
},
{
"lessThan": "277740023def559a4a2ddc3e8e784ee37a0f16a9",
"status": "affected",
"version": "a7c9c5f4af7f6098da68705fc5d86565d0728ef7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/af_smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot\n\nOn the SMC-D client, slot 0 of ini-\u003eism_dev[]/ini-\u003eism_chid[] is\nreserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt()\npopulates V2 entries starting at index 1, so when no V1 device is\nselected slot 0 is left in its kzalloc()\u0027ed state with ism_dev[0] ==\nNULL and ism_chid[0] == 0.\n\nsmc_v2_determine_accepted_chid() then matches the peer\u0027s CHID against\nthe array starting from index 0 using the CHID alone. A malicious\npeer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches\nthe empty slot, ini-\u003eism_selected becomes 0, and the subsequent\nism_dev[0]-\u003elgr_lock dereference in smc_conn_create() faults at\noffsetof(struct smcd_dev, lgr_lock) == 0x68:\n\n BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0\n Write of size 4 at addr 0000000000000068 by task exploit/144\n Call Trace:\n _raw_spin_lock_bh\n smc_conn_create (net/smc/smc_core.c:1997)\n __smc_connect (net/smc/af_smc.c:1447)\n smc_connect (net/smc/af_smc.c:1720)\n __sys_connect\n __x64_sys_connect\n do_syscall_64\n\nRequire ism_dev[i] to be non-NULL before accepting a CHID match."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The fault is triggered while processing a malicious CLC ACCEPT message received from a remote TCP peer during the SMC-D handshake; the attacker controls the server response over the network.\nAC:L - Once a victim with SMC-Dv2 hardware initiates an SMC connection, a malicious peer can reliably send `d1.chid == 0` in the CLC ACCEPT to match the empty reserved slot 0 without races or special timing.\nPR:N - No local privileges are required on the victim host; an unauthenticated remote attacker operating a malicious SMC server can crash connecting clients, and unprivileged users can create SMC sockets without capability checks.\nUI:N - Exploitation requires only that a victim application initiate a normal outbound SMC connection to the attacker\u0027s server, which occurs automatically in enterprise middleware without per-connection user action.\nS:U - The vulnerability causes a kernel crash on the victim host but does not cross a security boundary such as VM escape or sandbox breakout.\nC:N - The bug is a null pointer dereference when taking `ism_dev[0]-\u003elgr_lock`; it causes an immediate kernel fault with no information disclosure.\nI:N - The attempted write at address 0x68 is a spinlock operation on a NULL `smcd_dev` pointer, not a controlled or arbitrary memory modification primitive.\nA:H - A successful trigger causes a kernel null pointer dereference (KASAN-reported oops/panic), crashing the affected system or at minimum the connecting process\u0027s kernel context."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:45:32.597Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/903f7688ffeb9b323d70652c01f554bd4ba2a3d6"
},
{
"url": "https://git.kernel.org/stable/c/dd2f9dd83c68abd7ba7ded7075290b016cb7ecd0"
},
{
"url": "https://git.kernel.org/stable/c/6927cacf2b10d4fa80c1a2d407512ef9397c59c6"
},
{
"url": "https://git.kernel.org/stable/c/d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0"
},
{
"url": "https://git.kernel.org/stable/c/53eb7bd09aace72fa17510d80e0caf5ca058c231"
},
{
"url": "https://git.kernel.org/stable/c/afa9036b8c9963947b487c36e332df6a42c96fcb"
},
{
"url": "https://git.kernel.org/stable/c/65edb3b0822cfe5041be8fbabebd57e2e5ad9f4e"
},
{
"url": "https://git.kernel.org/stable/c/277740023def559a4a2ddc3e8e784ee37a0f16a9"
}
],
"title": "net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64048",
"datePublished": "2026-07-19T15:39:32.664Z",
"dateReserved": "2026-07-19T07:54:57.029Z",
"dateUpdated": "2026-10-19T20:28:10.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64481 (GCVE-0-2026-64481)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/cs35l41: Fix firmware load work teardown
cs35l41_hda creates ALSA controls whose private data points at the
cs35l41_hda object. The firmware load control can also queue
fw_load_work.
Those controls are not removed on component unbind, and device remove
only cancels fw_load_work through cs35l41_remove_dsp(). That helper is
skipped when halo_initialized is false. With firmware_autostart
disabled, a firmware load can be requested before the DSP has been
initialized. If the component or device is removed before the queued
work runs, the worker can run after teardown and dereference driver
state that is no longer valid.
Track the created controls and remove them on unbind so no new control
callback can reach the driver data or queue more work. Then cancel
fw_load_work to drain any request that was already queued. Also cancel
the work unconditionally during device remove before runtime PM teardown.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64481",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:41:19.470343Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:48:36.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/hda/codecs/side-codecs/cs35l41_hda.c",
"sound/hda/codecs/side-codecs/cs35l41_hda.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e339c88b8c3044919fd1936a8b23124285d0de6",
"status": "affected",
"version": "47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8",
"versionType": "git"
},
{
"lessThan": "8947215c0136c9d905e4a46d824824f8b48a2e5b",
"status": "affected",
"version": "47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8",
"versionType": "git"
},
{
"lessThan": "ce0a903d0591e3e2c790c5b628802b08d1b287cc",
"status": "affected",
"version": "47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8",
"versionType": "git"
},
{
"lessThan": "d6a40a4d083ef74d00c8f9516cb5ff07ac70720b",
"status": "affected",
"version": "47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8",
"versionType": "git"
},
{
"lessThan": "b65020d5398f499c09498c9786dba6d67ae57664",
"status": "affected",
"version": "47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/hda/codecs/side-codecs/cs35l41_hda.c",
"sound/hda/codecs/side-codecs/cs35l41_hda.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda/cs35l41: Fix firmware load work teardown\n\ncs35l41_hda creates ALSA controls whose private data points at the\ncs35l41_hda object. The firmware load control can also queue\nfw_load_work.\n\nThose controls are not removed on component unbind, and device remove\nonly cancels fw_load_work through cs35l41_remove_dsp(). That helper is\nskipped when halo_initialized is false. With firmware_autostart\ndisabled, a firmware load can be requested before the DSP has been\ninitialized. If the component or device is removed before the queued\nwork runs, the worker can run after teardown and dereference driver\nstate that is no longer valid.\n\nTrack the created controls and remove them on unbind so no new control\ncallback can reach the driver data or queue more work. Then cancel\nfw_load_work to drain any request that was already queued. Also cancel\nthe work unconditionally during device remove before runtime PM teardown."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An attacker reaches the vulnerable callbacks through ALSA control ioctls on /dev/snd/controlC*. No network or physical protocol directly exposes this path.\nAC:L - After teardown, stale controls can repeatedly dereference the freed object or queue its embedded work item, so exploitation does not require winning a narrow race. A queued work_struct also remains directly usable after its containing allocation is freed.\nPR:L - An unprivileged user with ordinary audio-device access can invoke the control callbacks. The ioctl path contains no capability, namespace, or administrative privilege check.\nUI:N - Exploitation requires no victim to open content or perform an interactive action.\nS:U - The vulnerable driver and the affected kernel resources are governed by the same kernel security authority.\nC:H - The heap use-after-free permits attacker-influenced reuse and disclosure of freed kernel object contents, potentially supporting arbitrary kernel memory reads.\nI:H - The freed object embeds mutable workqueue list state and a function pointer that is subsequently invoked, making kernel memory corruption and control-flow hijacking defensible.\nA:H - Stale control accesses or corrupted queued work can cause a kernel oops, panic, or workqueue corruption, resulting in complete system unavailability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:23.321Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e339c88b8c3044919fd1936a8b23124285d0de6"
},
{
"url": "https://git.kernel.org/stable/c/8947215c0136c9d905e4a46d824824f8b48a2e5b"
},
{
"url": "https://git.kernel.org/stable/c/ce0a903d0591e3e2c790c5b628802b08d1b287cc"
},
{
"url": "https://git.kernel.org/stable/c/d6a40a4d083ef74d00c8f9516cb5ff07ac70720b"
},
{
"url": "https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664"
}
],
"title": "ALSA: hda/cs35l41: Fix firmware load work teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64481",
"datePublished": "2026-07-25T08:51:42.430Z",
"dateReserved": "2026-07-19T15:36:31.791Z",
"dateUpdated": "2026-10-21T12:43:23.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74556 (GCVE-0-2026-74556)
Vulnerability from cvelistv5
Published
2026-08-15 12:28
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
iscsi_tcp_hdr_dissect() receives the data segment of several PDU types
into the fixed-size conn->data buffer, which is allocated for
ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP,
REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU
whose DataSegmentLength exceeds that buffer.
The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its
data segment (sense/response data) into conn->data via
iscsi_tcp_data_recv_prep(), but it does so without the same check. The
only upstream bound on in.datalen is conn->max_recv_dlength, the
initiator's advertised MaxRecvDataSegmentLength, which is commonly
negotiated well above 8192 (open-iscsi defaults to 262144). A target
that returns a SCSI Response with a DataSegmentLength between 8193 and
max_recv_dlength therefore overflows the 8192-byte conn->data buffer.
Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly
like those responses: bound the data segment, receive it into conn->data
when present, and otherwise complete the PDU with no data. Fold the
opcode into that case group rather than duplicating the check.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff Version: a081c13e39b5c17052a7b46fafa61019c4c110ff |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:00:06.190671Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:55.568Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi_tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a51812842084fd390590ab8dc0431f10c73ddc56",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "a8f94cc9f0e5759252551be3a172960c57f21f54",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "f1a3a51fc5dba0e99532379665069f1700da6b44",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "c97b5265cc47775f77fd2a23d6bde0426997b233",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "084af0253673425ce2ae62e3c7f74f0dd023711b",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "72815741715bd41556dac5eeb068bf0f8af06ee7",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
},
{
"lessThan": "c1dea15f819cded9b3faf58f8bec72323568b6e6",
"status": "affected",
"version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libiscsi_tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer\n\niscsi_tcp_hdr_dissect() receives the data segment of several PDU types\ninto the fixed-size conn-\u003edata buffer, which is allocated for\nISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP,\nREJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU\nwhose DataSegmentLength exceeds that buffer.\n\nThe SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its\ndata segment (sense/response data) into conn-\u003edata via\niscsi_tcp_data_recv_prep(), but it does so without the same check. The\nonly upstream bound on in.datalen is conn-\u003emax_recv_dlength, the\ninitiator\u0027s advertised MaxRecvDataSegmentLength, which is commonly\nnegotiated well above 8192 (open-iscsi defaults to 262144). A target\nthat returns a SCSI Response with a DataSegmentLength between 8193 and\nmax_recv_dlength therefore overflows the 8192-byte conn-\u003edata buffer.\n\nOnce the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly\nlike those responses: bound the data segment, receive it into conn-\u003edata\nwhen present, and otherwise complete the PDU with no data. Fold the\nopcode into that case group rather than duplicating the check."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious or compromised iSCSI target delivers crafted SCSI Command Response PDUs over the established TCP iSCSI session; reception flows through iscsi_sw_tcp_recv/iscsi_tcp_recv_skb into iscsi_tcp_hdr_dissect without local access.\nAC:L - The attacker controls the target and can set DataSegmentLength between 8193 and negotiated max_recv_dlength (open-iscsi commonly 262144) on SCSI_CMD_RSP for any outstanding command ITT; no races or victim-specific heap layout are required.\nPR:N - No privileges on the victim host are needed; a remote attacker acting as or MITMing the iSCSI target sends malicious responses after session login, independent of victim user accounts or capabilities.\nUI:N - On systems with persistent iSCSI sessions (cloud VMs, SAN-boot hosts, Kubernetes iSCSI volumes), exploitation triggers automatically during normal SCSI I/O when command responses are received; no victim action is needed at attack time.\nS:U - Heap corruption is confined to the kernel iSCSI initiator on the affected host; successful exploitation yields kernel compromise or DoS within the same security authority, not a VM escape or cross-boundary scope change.\nC:H - iscsi_tcp_segment_recv memcpy writes up to max_recv_dlength bytes into an 8192-byte conn-\u003edata buffer, causing a large heap overflow whose controlled corruption can be leveraged for arbitrary kernel memory disclosure.\nI:H - Attacker-controlled response data is copied past the fixed conn-\u003edata allocation via iscsi_tcp_data_recv_prep/iscsi_segment_init_linear, enabling heap metadata/object corruption exploitable for arbitrary kernel write and privilege escalation.\nA:H - Overflowing the conn-\u003edata heap buffer can immediately corrupt adjacent kernel allocations and cause oops/panic; a malicious target can repeatedly trigger this on active sessions to deny storage availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:38:57.393Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a51812842084fd390590ab8dc0431f10c73ddc56"
},
{
"url": "https://git.kernel.org/stable/c/a8f94cc9f0e5759252551be3a172960c57f21f54"
},
{
"url": "https://git.kernel.org/stable/c/f1a3a51fc5dba0e99532379665069f1700da6b44"
},
{
"url": "https://git.kernel.org/stable/c/c97b5265cc47775f77fd2a23d6bde0426997b233"
},
{
"url": "https://git.kernel.org/stable/c/084af0253673425ce2ae62e3c7f74f0dd023711b"
},
{
"url": "https://git.kernel.org/stable/c/72815741715bd41556dac5eeb068bf0f8af06ee7"
},
{
"url": "https://git.kernel.org/stable/c/b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676"
},
{
"url": "https://git.kernel.org/stable/c/c1dea15f819cded9b3faf58f8bec72323568b6e6"
}
],
"title": "scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74556",
"datePublished": "2026-08-15T12:28:01.359Z",
"dateReserved": "2026-08-15T05:44:03.916Z",
"dateUpdated": "2026-10-16T19:05:55.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31483 (GCVE-0-2026-31483)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-05-11 22:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/syscalls: Add spectre boundary for syscall dispatch table
The s390 syscall number is directly controlled by userspace, but does
not have an array_index_nospec() boundary to prevent access past the
syscall function pointer tables.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 56e62a73702836017564eaacd5212e4d0fa1c01d Version: 56e62a73702836017564eaacd5212e4d0fa1c01d Version: 56e62a73702836017564eaacd5212e4d0fa1c01d Version: 56e62a73702836017564eaacd5212e4d0fa1c01d Version: 56e62a73702836017564eaacd5212e4d0fa1c01d Version: 56e62a73702836017564eaacd5212e4d0fa1c01d Version: 56e62a73702836017564eaacd5212e4d0fa1c01d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/kernel/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c3b97064764899c39a0abbd35a6caa031e70333",
"status": "affected",
"version": "56e62a73702836017564eaacd5212e4d0fa1c01d",
"versionType": "git"
},
{
"lessThan": "1cb9c7bc9025c637564fabc7fcc3c9343949e310",
"status": "affected",
"version": "56e62a73702836017564eaacd5212e4d0fa1c01d",
"versionType": "git"
},
{
"lessThan": "7a5260fbc6e79a1595328ec5c6aa3f937504a1f0",
"status": "affected",
"version": "56e62a73702836017564eaacd5212e4d0fa1c01d",
"versionType": "git"
},
{
"lessThan": "f8c444b918d639e1f9a621ee20fe481c1d10dfc4",
"status": "affected",
"version": "56e62a73702836017564eaacd5212e4d0fa1c01d",
"versionType": "git"
},
{
"lessThan": "87776f02449e3bded95b2ccbd6b012e9ae64e6f3",
"status": "affected",
"version": "56e62a73702836017564eaacd5212e4d0fa1c01d",
"versionType": "git"
},
{
"lessThan": "4d05dd18d867d58c6952a3bc260d244899da7256",
"status": "affected",
"version": "56e62a73702836017564eaacd5212e4d0fa1c01d",
"versionType": "git"
},
{
"lessThan": "48b8814e25d073dd84daf990a879a820bad2bcbd",
"status": "affected",
"version": "56e62a73702836017564eaacd5212e4d0fa1c01d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/kernel/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/syscalls: Add spectre boundary for syscall dispatch table\n\nThe s390 syscall number is directly controlled by userspace, but does\nnot have an array_index_nospec() boundary to prevent access past the\nsyscall function pointer tables."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:09:36.271Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c3b97064764899c39a0abbd35a6caa031e70333"
},
{
"url": "https://git.kernel.org/stable/c/1cb9c7bc9025c637564fabc7fcc3c9343949e310"
},
{
"url": "https://git.kernel.org/stable/c/7a5260fbc6e79a1595328ec5c6aa3f937504a1f0"
},
{
"url": "https://git.kernel.org/stable/c/f8c444b918d639e1f9a621ee20fe481c1d10dfc4"
},
{
"url": "https://git.kernel.org/stable/c/87776f02449e3bded95b2ccbd6b012e9ae64e6f3"
},
{
"url": "https://git.kernel.org/stable/c/4d05dd18d867d58c6952a3bc260d244899da7256"
},
{
"url": "https://git.kernel.org/stable/c/48b8814e25d073dd84daf990a879a820bad2bcbd"
}
],
"title": "s390/syscalls: Add spectre boundary for syscall dispatch table",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31483",
"datePublished": "2026-04-22T13:54:09.561Z",
"dateReserved": "2026-03-09T15:48:24.101Z",
"dateUpdated": "2026-05-11T22:09:36.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72297 (GCVE-0-2026-72297)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: atm: reject out-of-range traffic classes in QoS validation
Reject ATM traffic classes above ATM_ANYCLASS in check_tp().
SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so
accepting larger values leaves invalid traffic_class values in
vcc->qos.
That bad state later reaches pvc_info(), which indexes class_name[]
with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause
an out-of-bounds read when /proc/net/atm/pvc is read.
Tighten the existing QoS validation so invalid traffic_class values
are rejected at the point where user supplied QoS is accepted.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72297",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:45:57.327476Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:15.534Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/atm/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1a6dda72455b399ce9c1a12695471dc4d5c61add",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2b3e241729e87afed13ac0f666472d5d6ca42e87",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "367acd288bc6255e247cb1a1efbf5c6567cab423",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "513f820b3f0cf4462e17d84c39ed3948d061a6ea",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "15444b57fdc6fc3f3e22a87f791ae5be81e6ecf5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e62adb157c2eaad9ad4867ec6cd9af5b9a51b1c7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "806b7b6edc8446e8b94b706807a7090a14d47b5c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "cdf19f380e46192e7084be559638aab1f6ed86a2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/atm/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atm: reject out-of-range traffic classes in QoS validation\n\nReject ATM traffic classes above ATM_ANYCLASS in check_tp().\nSO_ATMQOS stores the supplied QoS after check_qos() succeeds, so\naccepting larger values leaves invalid traffic_class values in\nvcc-\u003eqos.\n\nThat bad state later reaches pvc_info(), which indexes class_name[]\nwith vcc-\u003eqos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause\nan out-of-bounds read when /proc/net/atm/pvc is read.\n\nTighten the existing QoS validation so invalid traffic_class values\nare rejected at the point where user supplied QoS is accepted."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local setsockopt(SO_ATMQOS) on an AF_ATMPVC socket and reading /proc/net/atm/pvc; no remote network packet or protocol handler reaches check_tp() or pvc_info().\nAC:L - On systems with an existing ATM PVC device, an attacker deterministically sets an out-of-range traffic_class via SO_ATMQOS before connect and triggers the OOB read by reading /proc/net/atm/pvc with no race or special memory layout needed.\nPR:L - No capability check guards SO_ATMQOS on unconnected sockets; any unprivileged local user in init_net can create AF_ATMPVC sockets (module autoloadable) and read world-readable /proc/net/atm/pvc without CAP_NET_ADMIN.\nUI:N - The attacker controls both poisoning vcc-\u003eqos via setsockopt and triggering pvc_info() by reading procfs; no victim action or cooperation is required.\nS:U - Impact is kernel memory disclosure within the host kernel security boundary; no VM escape, IOMMU bypass, or sandbox boundary crossing occurs.\nC:H - Out-of-bounds indexing of class_name[] loads adjacent kernel pointers that seq_printf() dereferences with %s, disclosing kernel memory contents into the procfs read buffer visible to the attacker.\nI:N - The flaw is an out-of-bounds read of static pointer tables with no memory corruption, arbitrary write, or control-flow hijack primitive; kernel or user data integrity is not modified.\nA:H - Dereferencing attacker-influenced out-of-bounds pointers via %s can fault on unmappable addresses and oops the kernel; even without reliable crash, OOB kernel reads carry high availability risk per conservative scoring."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:42:30.264Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1a6dda72455b399ce9c1a12695471dc4d5c61add"
},
{
"url": "https://git.kernel.org/stable/c/2b3e241729e87afed13ac0f666472d5d6ca42e87"
},
{
"url": "https://git.kernel.org/stable/c/367acd288bc6255e247cb1a1efbf5c6567cab423"
},
{
"url": "https://git.kernel.org/stable/c/513f820b3f0cf4462e17d84c39ed3948d061a6ea"
},
{
"url": "https://git.kernel.org/stable/c/15444b57fdc6fc3f3e22a87f791ae5be81e6ecf5"
},
{
"url": "https://git.kernel.org/stable/c/e62adb157c2eaad9ad4867ec6cd9af5b9a51b1c7"
},
{
"url": "https://git.kernel.org/stable/c/806b7b6edc8446e8b94b706807a7090a14d47b5c"
},
{
"url": "https://git.kernel.org/stable/c/cdf19f380e46192e7084be559638aab1f6ed86a2"
}
],
"title": "net: atm: reject out-of-range traffic classes in QoS validation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72297",
"datePublished": "2026-08-15T05:55:17.877Z",
"dateReserved": "2026-08-09T03:40:39.917Z",
"dateUpdated": "2026-10-16T18:55:15.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72135 (GCVE-0-2026-72135)
Vulnerability from cvelistv5
Published
2026-08-15 05:53
Modified
2026-10-16 18:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tpm: Make the TPM character devices non-seekable
The TPM character devices expose a sequential command/response
interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE
enabled.
After a command leaves a response pending, pread(fd, buf, 16, 0x1400)
passes 0x1400 as *off to tpm_common_read(). The transfer length is
bounded by response_length, but the offset is used unchecked when
forming data_buffer + *off. A sufficiently large offset therefore causes
an out-of-bounds heap read through copy_to_user() and, if the copy
succeeds, an out-of-bounds zero-write through the following memset().
Positional I/O does not provide coherent semantics for this interface.
An arbitrary pread offset cannot represent how much of a response has
been consumed sequentially. The write callback always stores a command
at the start of data_buffer, while pwrite() does not update file->f_pos
and can leave the sequential read cursor stale.
Call nonseekable_open() from both open handlers. This removes
FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to
fail with -ESPIPE before reaching the TPM callbacks, and explicitly
marks the files non-seekable. Normal read() and write() continue to use
the existing sequential f_pos cursor, leaving the response state machine
unchanged.
Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:
- sequential partial reads returned the complete response
- pread() and preadv() with offset 0x1400 returned -ESPIPE
- pwrite() and pwritev() with offset zero returned -ESPIPE
- the pending response remained intact after the rejected operations
- a subsequent normal command/response cycle completed normally
- no KASAN report was produced.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9488585b21bef0df1217e510c7134905d1d376a7 Version: 9488585b21bef0df1217e510c7134905d1d376a7 Version: 9488585b21bef0df1217e510c7134905d1d376a7 Version: 9488585b21bef0df1217e510c7134905d1d376a7 Version: 9488585b21bef0df1217e510c7134905d1d376a7 Version: 9488585b21bef0df1217e510c7134905d1d376a7 Version: 9488585b21bef0df1217e510c7134905d1d376a7 Version: 9488585b21bef0df1217e510c7134905d1d376a7 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:42:38.338660Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:44:58.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/tpm/tpm-dev.c",
"drivers/char/tpm/tpmrm-dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed0ffc2c016629e40ba041ed0424a772d8b02e2c",
"status": "affected",
"version": "9488585b21bef0df1217e510c7134905d1d376a7",
"versionType": "git"
},
{
"lessThan": "232dcf908eb7eb9d8046a9597975caf44270966e",
"status": "affected",
"version": "9488585b21bef0df1217e510c7134905d1d376a7",
"versionType": "git"
},
{
"lessThan": "dda695fab5e21f923d29e8cb01df256468ddfbd1",
"status": "affected",
"version": "9488585b21bef0df1217e510c7134905d1d376a7",
"versionType": "git"
},
{
"lessThan": "9c513dabd4540f811585a2087f23069767a284da",
"status": "affected",
"version": "9488585b21bef0df1217e510c7134905d1d376a7",
"versionType": "git"
},
{
"lessThan": "21a13f932972bc9836f58c44fcd47c62abdecd95",
"status": "affected",
"version": "9488585b21bef0df1217e510c7134905d1d376a7",
"versionType": "git"
},
{
"lessThan": "ada4b9a5087ea7f30dd8e4c6411a4fb6547eb1ed",
"status": "affected",
"version": "9488585b21bef0df1217e510c7134905d1d376a7",
"versionType": "git"
},
{
"lessThan": "947b773caaa548672184df025271b29bdc80b0f1",
"status": "affected",
"version": "9488585b21bef0df1217e510c7134905d1d376a7",
"versionType": "git"
},
{
"lessThan": "f20d61c22bcaf172d6790b6500e3838e532e71c8",
"status": "affected",
"version": "9488585b21bef0df1217e510c7134905d1d376a7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/tpm/tpm-dev.c",
"drivers/char/tpm/tpmrm-dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Make the TPM character devices non-seekable\n\nThe TPM character devices expose a sequential command/response\ninterface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE\nenabled.\n\nAfter a command leaves a response pending, pread(fd, buf, 16, 0x1400)\npasses 0x1400 as *off to tpm_common_read(). The transfer length is\nbounded by response_length, but the offset is used unchecked when\nforming data_buffer + *off. A sufficiently large offset therefore causes\nan out-of-bounds heap read through copy_to_user() and, if the copy\nsucceeds, an out-of-bounds zero-write through the following memset().\n\nPositional I/O does not provide coherent semantics for this interface.\nAn arbitrary pread offset cannot represent how much of a response has\nbeen consumed sequentially. The write callback always stores a command\nat the start of data_buffer, while pwrite() does not update file-\u003ef_pos\nand can leave the sequential read cursor stale.\n\nCall nonseekable_open() from both open handlers. This removes\nFMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to\nfail with -ESPIPE before reaching the TPM callbacks, and explicitly\nmarks the files non-seekable. Normal read() and write() continue to use\nthe existing sequential f_pos cursor, leaving the response state machine\nunchanged.\n\nTested on Linux 6.12 with KASAN and a swtpm TPM2 device:\n\n - sequential partial reads returned the complete response\n - pread() and preadv() with offset 0x1400 returned -ESPIPE\n - pwrite() and pwritev() with offset zero returned -ESPIPE\n - the pending response remained intact after the rejected operations\n - a subsequent normal command/response cycle completed normally\n - no KASAN report was produced."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local pread()/write() syscalls on /dev/tpm0 or /dev/tpmrm0 character devices; there is no network, Bluetooth, or physical-bus code path to the vulnerable tpm_common_read() handler.\nAC:L - An attacker who can open the device reliably triggers the bug by writing any TPM command to create a pending response, then calling pread() with a large offset; no races or special memory layout are required.\nPR:L - Upstream tpm2-tss udev rules grant non-root users in the tss group read/write access to /dev/tpmrm0 (mode 0660), which is the standard TPM2 user-space interface on laptops and servers with TPM hardware.\nUI:N - No victim interaction is required; the attacker opens the TPM device, submits a command, and issues the malicious pread() themselves without relying on another user to mount, click, or configure anything.\nS:U - The vulnerability corrupts kernel heap memory in the TPM driver on the same host; it does not by itself cross a VM, container, or IOMMU security boundary to affect a different trust domain.\nC:H - Unchecked pread offsets cause copy_to_user() to read beyond the 4096-byte data_buffer into adjacent kmalloc slab memory (including tpm_space pointers), leaking kernel heap contents to userspace.\nI:H - A successful out-of-bounds pread also executes memset() past data_buffer, zeroing adjacent heap objects such as tpm_space session/context pointers and enabling further memory corruption or control-flow manipulation.\nA:H - KASAN reports slab-out-of-bounds faults on both the copy_to_user read and memset write; corrupting adjacent heap structures can oops or panic the kernel during subsequent TPM operations."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:40:45.521Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed0ffc2c016629e40ba041ed0424a772d8b02e2c"
},
{
"url": "https://git.kernel.org/stable/c/232dcf908eb7eb9d8046a9597975caf44270966e"
},
{
"url": "https://git.kernel.org/stable/c/dda695fab5e21f923d29e8cb01df256468ddfbd1"
},
{
"url": "https://git.kernel.org/stable/c/9c513dabd4540f811585a2087f23069767a284da"
},
{
"url": "https://git.kernel.org/stable/c/21a13f932972bc9836f58c44fcd47c62abdecd95"
},
{
"url": "https://git.kernel.org/stable/c/ada4b9a5087ea7f30dd8e4c6411a4fb6547eb1ed"
},
{
"url": "https://git.kernel.org/stable/c/947b773caaa548672184df025271b29bdc80b0f1"
},
{
"url": "https://git.kernel.org/stable/c/f20d61c22bcaf172d6790b6500e3838e532e71c8"
}
],
"title": "tpm: Make the TPM character devices non-seekable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72135",
"datePublished": "2026-08-15T05:53:10.315Z",
"dateReserved": "2026-08-09T03:40:39.907Z",
"dateUpdated": "2026-10-16T18:44:58.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63890 (GCVE-0-2026-63890)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-07-19 14:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker
drivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the
descriptor cursor by an attacker-supplied fip_dlen without ever
requiring dlen >= sizeof(struct fip_desc) in the default branch. The
named descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked
their per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor
(fip_dtype >= 128, which the standard requires receivers to silently
ignore) skipped that check entirely.
An unauthenticated L2 peer on the FCoE control VLAN could hang
fcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitely
by emitting one FIP CVL frame whose single descriptor had fip_dtype ==
FIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytes
per iteration and the loop condition rlen >= sizeof(*desc) stayed true
forever, blocking every subsequent FIP frame on that controller.
Tighten the outer dlen guard to also reject dlen < sizeof(struct
fip_desc), so a malformed descriptor whose length cannot even cover the
descriptor header is rejected before the switch. This is the same
lower-bound the named cases already apply and is the minimum scope that
closes the loop.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 97c8389d54b9665c38105ea72a428a44b97ff2f6 Version: 97c8389d54b9665c38105ea72a428a44b97ff2f6 Version: 97c8389d54b9665c38105ea72a428a44b97ff2f6 Version: 97c8389d54b9665c38105ea72a428a44b97ff2f6 Version: 97c8389d54b9665c38105ea72a428a44b97ff2f6 Version: 97c8389d54b9665c38105ea72a428a44b97ff2f6 Version: 97c8389d54b9665c38105ea72a428a44b97ff2f6 Version: 97c8389d54b9665c38105ea72a428a44b97ff2f6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/fcoe/fcoe_ctlr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d179949d2175d2857d1c3a275a22bea58bcc5d36",
"status": "affected",
"version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
"versionType": "git"
},
{
"lessThan": "fda976f7390bb5d1e9b84ef11ebb17323038e0c6",
"status": "affected",
"version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
"versionType": "git"
},
{
"lessThan": "80a0cd307205236ca28aa49bc553f58edcb9bf3a",
"status": "affected",
"version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
"versionType": "git"
},
{
"lessThan": "0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a",
"status": "affected",
"version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
"versionType": "git"
},
{
"lessThan": "549859a1131052b07dff11a448e9f3221a40f260",
"status": "affected",
"version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
"versionType": "git"
},
{
"lessThan": "14dd80a20a72ce334adcc2d67402360527065948",
"status": "affected",
"version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
"versionType": "git"
},
{
"lessThan": "d537d29d51c8b808469e5adacf3e5a0092700738",
"status": "affected",
"version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
"versionType": "git"
},
{
"lessThan": "9eed1bd59937e6828b00d2f2dfef631d964f3636",
"status": "affected",
"version": "97c8389d54b9665c38105ea72a428a44b97ff2f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/fcoe/fcoe_ctlr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker\n\ndrivers/scsi/fcoe/fcoe_ctlr.c::fcoe_ctlr_recv_clr_vlink() advanced the\ndescriptor cursor by an attacker-supplied fip_dlen without ever\nrequiring dlen \u003e= sizeof(struct fip_desc) in the default branch. The\nnamed descriptor cases (FIP_DT_MAC, FIP_DT_NAME, FIP_DT_VN_ID) checked\ntheir per-type minimum lengths, but a FIP_DT_NON_CRITICAL descriptor\n(fip_dtype \u003e= 128, which the standard requires receivers to silently\nignore) skipped that check entirely.\n\nAn unauthenticated L2 peer on the FCoE control VLAN could hang\nfcoe_ctlr_recv_work on an fcoe, qedf, or bnx2fc initiator indefinitely\nby emitting one FIP CVL frame whose single descriptor had fip_dtype ==\nFIP_DT_NON_CRITICAL and fip_dlen == 0: the cursor advanced zero bytes\nper iteration and the loop condition rlen \u003e= sizeof(*desc) stayed true\nforever, blocking every subsequent FIP frame on that controller.\n\nTighten the outer dlen guard to also reject dlen \u003c sizeof(struct\nfip_desc), so a malformed descriptor whose length cannot even cover the\ndescriptor header is rejected before the switch. This is the same\nlower-bound the named cases already apply and is the minimum scope that\ncloses the loop."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T14:55:02.195Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d179949d2175d2857d1c3a275a22bea58bcc5d36"
},
{
"url": "https://git.kernel.org/stable/c/fda976f7390bb5d1e9b84ef11ebb17323038e0c6"
},
{
"url": "https://git.kernel.org/stable/c/80a0cd307205236ca28aa49bc553f58edcb9bf3a"
},
{
"url": "https://git.kernel.org/stable/c/0e3c6e5a8fc15a74dfb1e0c1df9f1da73600a81a"
},
{
"url": "https://git.kernel.org/stable/c/549859a1131052b07dff11a448e9f3221a40f260"
},
{
"url": "https://git.kernel.org/stable/c/14dd80a20a72ce334adcc2d67402360527065948"
},
{
"url": "https://git.kernel.org/stable/c/d537d29d51c8b808469e5adacf3e5a0092700738"
},
{
"url": "https://git.kernel.org/stable/c/9eed1bd59937e6828b00d2f2dfef631d964f3636"
}
],
"title": "scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63890",
"datePublished": "2026-07-19T14:55:02.195Z",
"dateReserved": "2026-07-19T07:54:57.018Z",
"dateUpdated": "2026-07-19T14:55:02.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53381 (GCVE-0-2026-53381)
Vulnerability from cvelistv5
Published
2026-07-19 11:59
Modified
2026-10-19 20:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtiofs: fix UAF on submount umount
iput() called from fuse_release_end() can Oops if the super block has
already been destroyed. Normally this is prevented by waiting for
num_waiting to go down to zero before commencing with super block shutdown.
This only works, however, for the last submount instance, as the wait
counter is per connection, not per superblock.
Revert to using synchronous release requests for the auto_submounts case,
which is virtiofs only at this time.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 548e1f2bac1d4df91a6138f26bb4ab00323fd948 Version: cfd1aa3e2b71f3327cb373c45a897c9028c62b35 Version: 83b375c6efef69b1066ad2d79601221e7892745a Version: bfd17b6138df0122a95989457d8e18ce0b86165e Version: b26923512dbe57ae4917bafd31396d22a9d1691a Version: 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 Version: 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 Version: 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 Version: 26e5c67deb2e1f42a951f022fdf5b9f7eb747b01 Version: f19a1390af448d9e193c08e28ea5f727bf3c3049 Version: 5.10.246 ≤ Version: 5.15.196 ≤ Version: 6.1.158 ≤ Version: 6.6.115 ≤ Version: 6.12.54 ≤ Version: 6.17.4 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53381",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:29:49.943123Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:07:45.399Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/fuse/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "607a1d4c42f649e6197567c0448fd9ebb316cd42",
"status": "affected",
"version": "548e1f2bac1d4df91a6138f26bb4ab00323fd948",
"versionType": "git"
},
{
"lessThan": "1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e",
"status": "affected",
"version": "cfd1aa3e2b71f3327cb373c45a897c9028c62b35",
"versionType": "git"
},
{
"lessThan": "0b809199ff87c44487e516a725dd4be2185712ce",
"status": "affected",
"version": "83b375c6efef69b1066ad2d79601221e7892745a",
"versionType": "git"
},
{
"lessThan": "2181a09ba980f142650fb053666350ead4471cfe",
"status": "affected",
"version": "bfd17b6138df0122a95989457d8e18ce0b86165e",
"versionType": "git"
},
{
"lessThan": "97c4691653d145dcc699eca5d3aba3219a520f1f",
"status": "affected",
"version": "b26923512dbe57ae4917bafd31396d22a9d1691a",
"versionType": "git"
},
{
"lessThan": "2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9",
"status": "affected",
"version": "26e5c67deb2e1f42a951f022fdf5b9f7eb747b01",
"versionType": "git"
},
{
"lessThan": "39a2b95e008665c14f84e50ed411d898df7cd11b",
"status": "affected",
"version": "26e5c67deb2e1f42a951f022fdf5b9f7eb747b01",
"versionType": "git"
},
{
"lessThan": "e09412a714bcd49375198427bb4aa005037a9d6f",
"status": "affected",
"version": "26e5c67deb2e1f42a951f022fdf5b9f7eb747b01",
"versionType": "git"
},
{
"lessThan": "06b41351779e9289e8785694ade9042ae85e41ea",
"status": "affected",
"version": "26e5c67deb2e1f42a951f022fdf5b9f7eb747b01",
"versionType": "git"
},
{
"status": "affected",
"version": "f19a1390af448d9e193c08e28ea5f727bf3c3049",
"versionType": "git"
},
{
"lessThan": "5.10.260",
"status": "affected",
"version": "5.10.246",
"versionType": "semver"
},
{
"lessThan": "5.15.211",
"status": "affected",
"version": "5.15.196",
"versionType": "semver"
},
{
"lessThan": "6.1.177",
"status": "affected",
"version": "6.1.158",
"versionType": "semver"
},
{
"lessThan": "6.6.144",
"status": "affected",
"version": "6.6.115",
"versionType": "semver"
},
{
"lessThan": "6.12.95",
"status": "affected",
"version": "6.12.54",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/fuse/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "5.10.246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.15.196",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "6.1.158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.6.115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.12.54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtiofs: fix UAF on submount umount\n\niput() called from fuse_release_end() can Oops if the super block has\nalready been destroyed. Normally this is prevented by waiting for\nnum_waiting to go down to zero before commencing with super block shutdown.\n\nThis only works, however, for the last submount instance, as the wait\ncounter is per connection, not per superblock.\n\nRevert to using synchronous release requests for the auto_submounts case,\nwhich is virtiofs only at this time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached through local VFS operations (open/write/close) on a virtiofs mount with FUSE submounts; exploitation is in the guest FUSE client during file release and submount umount, not via remote network packets.\nAC:L - This is a use-after-free where the attacker controls file close (async FUSE RELEASE) and can drive or coincide with submount umount; Kata Containers reproduces it reliably with virtiofsd --announce-submounts (default).\nPR:L - An unprivileged local process with access to the virtiofs mount can trigger it; virtiofs defaults to allow_other and normal POSIX permissions, and no real root or init-namespace capabilities are required.\nUI:N - Exploitation needs no victim interaction beyond the attacker (or their container workload) performing normal filesystem I/O while submount teardown occurs during pod/container lifecycle.\nS:U - Impact stays within the guest kernel security boundary (crash or guest kernel compromise); it does not by itself cross a VM/host or IOMMU boundary.\nC:H - The flaw is a use-after-free in fuse_release_end() calling iput() on an inode after its superblock is destroyed, which can be turned into arbitrary kernel memory read via heap manipulation.\nI:H - Use-after-free on a struct inode in the kernel heap provides a standard path to controlled memory corruption, heap spraying, and arbitrary write or code execution in kernel context.\nA:H - Confirmed kernel general protection fault/oops in iput() from fuse_release_end during virtio_fs request completion, and UAF bugs inherently threaten kernel stability even without full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:31.586Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/607a1d4c42f649e6197567c0448fd9ebb316cd42"
},
{
"url": "https://git.kernel.org/stable/c/1cc0e3a0c6499aaaa2f21a4fcbba388486afb25e"
},
{
"url": "https://git.kernel.org/stable/c/0b809199ff87c44487e516a725dd4be2185712ce"
},
{
"url": "https://git.kernel.org/stable/c/2181a09ba980f142650fb053666350ead4471cfe"
},
{
"url": "https://git.kernel.org/stable/c/97c4691653d145dcc699eca5d3aba3219a520f1f"
},
{
"url": "https://git.kernel.org/stable/c/2abfd3ffbd9452f72535d96ff3982b3ab1f8f2f9"
},
{
"url": "https://git.kernel.org/stable/c/39a2b95e008665c14f84e50ed411d898df7cd11b"
},
{
"url": "https://git.kernel.org/stable/c/e09412a714bcd49375198427bb4aa005037a9d6f"
},
{
"url": "https://git.kernel.org/stable/c/06b41351779e9289e8785694ade9042ae85e41ea"
}
],
"title": "virtiofs: fix UAF on submount umount",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53381",
"datePublished": "2026-07-19T11:59:30.469Z",
"dateReserved": "2026-06-09T07:44:35.401Z",
"dateUpdated": "2026-10-19T20:07:45.399Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68138 (GCVE-0-2026-68138)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: serialize qdisc_rtab_list against concurrent get/put
qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly
linked list qdisc_rtab_list and a plain non-atomic 'int refcnt' with no
lock. This was only safe because every caller historically held the RTNL
mutex, which serialized all rate-table lookups, inserts and frees.
That invariant no longer holds. cls_flower sets
TCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false
for it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through
tcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() ->
tcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the
RTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each
adding a flower filter with a police action carrying the same rate, then
race on qdisc_rtab_list and on the non-atomic refcnt, leading to a
use-after-free / double-free of the kmalloc-2k struct qdisc_rate_table.
qdisc_rtab_list is a single global (not per-netns), so the corrupted
object is shared system-wide.
BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160
qdisc_put_rtab+0x12f/0x160
tcf_police_init+0xda9/0x1590
tcf_action_init_1+0x460/0x6b0
tcf_action_init+0x439/0xa40
tcf_exts_validate_ex+0x42d/0x550
fl_change+0xddd/0x7da0
tc_new_tfilter+0xaa7/0x2420
rtnetlink_rcv_msg+0x95e/0xe90
which belongs to the cache kmalloc-2k of size 2048
Protect qdisc_rtab_list and the refcount with a dedicated spinlock. The
(sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before
taking the lock; if a concurrent inserter added an identical table in the
meantime the freshly allocated one is freed under the lock, so no
duplicate is leaked. qdisc_put_rtab() now decrements the refcount and
unlinks under the same lock.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 470502de5bdb1ed0def643a4458593a40b8f6b66 Version: 470502de5bdb1ed0def643a4458593a40b8f6b66 Version: 470502de5bdb1ed0def643a4458593a40b8f6b66 Version: 470502de5bdb1ed0def643a4458593a40b8f6b66 Version: 470502de5bdb1ed0def643a4458593a40b8f6b66 Version: 470502de5bdb1ed0def643a4458593a40b8f6b66 Version: 470502de5bdb1ed0def643a4458593a40b8f6b66 Version: 470502de5bdb1ed0def643a4458593a40b8f6b66 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68138",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:44:32.003419Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:52.975Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1b050d09dd1a0ddae83bf012cf4956b7a960235f",
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"versionType": "git"
},
{
"lessThan": "6e0241f6cbb149d926ee8efee2c734fea71452cf",
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"versionType": "git"
},
{
"lessThan": "f93c89392bd3b180b5b7abc6fdae8e3dd667a313",
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"versionType": "git"
},
{
"lessThan": "4131dd0b6f67acddd616ed7c244e1d3eedd46e7b",
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"versionType": "git"
},
{
"lessThan": "d981098b76756ed71666a27518eeb69883657c43",
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"versionType": "git"
},
{
"lessThan": "8ddc2eb0d2da9c83f54f1e5720525b461b8480c4",
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"versionType": "git"
},
{
"lessThan": "fb29e1b41052488ee3f2d115d4a870497ebd7f7d",
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"versionType": "git"
},
{
"lessThan": "f43ee0c0730d6191629b5ee1ceae27b1ebfdc047",
"status": "affected",
"version": "470502de5bdb1ed0def643a4458593a40b8f6b66",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.153",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.105",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: serialize qdisc_rtab_list against concurrent get/put\n\nqdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly\nlinked list qdisc_rtab_list and a plain non-atomic \u0027int refcnt\u0027 with no\nlock. This was only safe because every caller historically held the RTNL\nmutex, which serialized all rate-table lookups, inserts and frees.\n\nThat invariant no longer holds. cls_flower sets\nTCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false\nfor it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through\ntcf_exts_validate_ex() -\u003e tcf_action_init() -\u003e tcf_action_init_1() -\u003e\ntcf_police_init(), which calls qdisc_get_rtab()/qdisc_put_rtab() with the\nRTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each\nadding a flower filter with a police action carrying the same rate, then\nrace on qdisc_rtab_list and on the non-atomic refcnt, leading to a\nuse-after-free / double-free of the kmalloc-2k struct qdisc_rate_table.\nqdisc_rtab_list is a single global (not per-netns), so the corrupted\nobject is shared system-wide.\n\n BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f/0x160\n qdisc_put_rtab+0x12f/0x160\n tcf_police_init+0xda9/0x1590\n tcf_action_init_1+0x460/0x6b0\n tcf_action_init+0x439/0xa40\n tcf_exts_validate_ex+0x42d/0x550\n fl_change+0xddd/0x7da0\n tc_new_tfilter+0xaa7/0x2420\n rtnetlink_rcv_msg+0x95e/0xe90\n which belongs to the cache kmalloc-2k of size 2048\n\nProtect qdisc_rtab_list and the refcount with a dedicated spinlock. The\n(sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before\ntaking the lock; if a concurrent inserter added an identical table in the\nmeantime the freshly allocated one is freed under the lock, so no\nduplicate is leaked. qdisc_put_rtab() now decrements the refcount and\nunlinks under the same lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local RTM_NEWTFILTER rtnetlink messages (tc flower filter with police action) through rtnetlink_rcv_msg\u2192tc_new_tfilter\u2192fl_change\u2192tcf_police_init\u2192qdisc_get_rtab/qdisc_put_rtab; no remote packet or network protocol path exists.\nAC:L - cls_flower is TCF_PROTO_OPS_DOIT_UNLOCKED, so concurrent RTM_NEWTFILTER requests run without RTNL; the attacker controls both racing threads/CPUs and can repeatedly install flower filters with identical police rate tables to deterministically hit the global qdisc_rtab_list/refcnt race.\nPR:L - Non-GET rtnetlink handlers require netlink_net_capable(CAP_NET_ADMIN); this is namespace-scoped, so an unprivileged local user obtains CAP_NET_ADMIN via user namespaces (unshare -Urn), sets up clsact/ingress, and installs flower+police rules without init-namespace root.\nUI:N - Exploitation is fully self-contained: the attacker issues the concurrent tc/netlink commands from its own processes and needs no victim to mount filesystems, click links, or perform any other interactive action.\nS:U - Impact is heap corruption and UAF/double-free in kernel kmalloc-2k slabs within the same kernel security authority; although qdisc_rtab_list is global across netns, this is standard kernel memory corruption/privilege escalation, not a VM, IOMMU, or sandbox boundary escape.\nC:H - Concurrent non-atomic refcnt and list updates cause slab use-after-free/double-free of struct qdisc_rate_table (KASAN-confirmed in qdisc_put_rtab); freed 2KB objects are attacker-influenceable via kmalloc timing and are classically weaponizable for arbitrary kernel memory disclosure.\nI:H - The race corrupts a process-global singly linked list and can double-free a kmalloc-2k qdisc_rate_table, yielding classic heap metadata/object corruption primitives that can be developed into arbitrary kernel writes and local privilege escalation/code execution.\nA:H - Demonstrated KASAN slab-use-after-free in qdisc_put_rtab on the error/teardown path, and concurrent double-free of the same rate table can panic the kernel; the trigger is repeatable at will with concurrent netlink requests and causes task death or system-wide instability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:45:55.796Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1b050d09dd1a0ddae83bf012cf4956b7a960235f"
},
{
"url": "https://git.kernel.org/stable/c/6e0241f6cbb149d926ee8efee2c734fea71452cf"
},
{
"url": "https://git.kernel.org/stable/c/f93c89392bd3b180b5b7abc6fdae8e3dd667a313"
},
{
"url": "https://git.kernel.org/stable/c/4131dd0b6f67acddd616ed7c244e1d3eedd46e7b"
},
{
"url": "https://git.kernel.org/stable/c/d981098b76756ed71666a27518eeb69883657c43"
},
{
"url": "https://git.kernel.org/stable/c/8ddc2eb0d2da9c83f54f1e5720525b461b8480c4"
},
{
"url": "https://git.kernel.org/stable/c/fb29e1b41052488ee3f2d115d4a870497ebd7f7d"
},
{
"url": "https://git.kernel.org/stable/c/f43ee0c0730d6191629b5ee1ceae27b1ebfdc047"
}
],
"title": "net/sched: serialize qdisc_rtab_list against concurrent get/put",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68138",
"datePublished": "2026-08-10T11:59:01.744Z",
"dateReserved": "2026-07-30T09:28:09.370Z",
"dateUpdated": "2026-10-19T20:58:52.975Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53360 (GCVE-0-2026-53360)
Vulnerability from cvelistv5
Published
2026-07-04 11:53
Modified
2026-10-19 20:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
As per the GHCB spec, when using GHCB v2+ require the software scratch area
to reside in the GHCB's shared buffer. Note, things like Page State Change
(PSC) requests _rely_ on this behavior, as the guest can't provide a length
when making the request, i.e. the size of the guest payload is bounded by
the size of the shared buffer.
Failure to force usage of the GHCB, and a slew of other flaws, lets a
malicious SNP guest corrupt host kernel heap memory, and leak host heap
layout information.
setup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2),
where exit_info_2 is guest-controlled. With exit_info_2=24, this yields
a 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer
holds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only
entries[0] and entries[1] are in-bounds.
snp_begin_psc() validates end_entry against VMGEXIT_PSC_MAX_COUNT (253)
but NOT against the actual buffer size:
idx_end = hdr->end_entry;
if (idx_end >= VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer
snp_complete_psc(svm, ...);
return 1;
}
for (idx = idx_start; idx <= idx_end; idx++) {
entry_start = entries[idx]; // OOB when idx >= 2
The guest sets end_entry=10+, causing the host to iterate entries[2+]
which are OOB into adjacent slab objects. For each OOB entry:
- The host reads 8 bytes (OOB READ / info leak oracle)
- If the data passes PSC validation, __snp_complete_one_psc() writes
cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806)
- If validation fails, the error response reveals whether adjacent
memory is zero vs non-zero (information disclosure to guest)
The guest controls allocation size (exit_info_2), entry range
(cur_entry/end_entry), and can fire unlimited VMGEXITs to repeatedly
hit different slab positions.
By exploiting the variety of bugs, a malicious SEV-SNP guest can:
- OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure)
- OOB write cur_page bits into adjacent objects (heap corruption)
- Trigger use-after-free conditions across VMGEXITs
E.g. with KASAN enabled, a single insmod of the PoC guest module
produces 73 KASAN reports:
BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890
Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86/2199
BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890
Write of size 8 at addr ffff888351566648 by task qemu-system-x86/2199
The buggy address belongs to the object at ffff888XXXXXXXXX
which belongs to the cache kmalloc-cg-32 of size 32
The buggy address is located N bytes to the right of
allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX)
Breakdown:
62 slab-out-of-bounds (reads + writes past allocation)
7 slab-use-after-free
4 use-after-free
All credit to Stan for the wonderful description and reproducer!
[sean: write changelog]
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53360",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:29:05.458760Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:07:44.426Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/sev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf9ba093fbb83c0c9a3dedd50efec29424eca2fc",
"status": "affected",
"version": "4af663c2f64a8d252e690c60cf8b8abf22dc2951",
"versionType": "git"
},
{
"lessThan": "c9b4198fbc6ed99a9da4bee9f74bb730f926c9ae",
"status": "affected",
"version": "4af663c2f64a8d252e690c60cf8b8abf22dc2951",
"versionType": "git"
},
{
"lessThan": "b328ede59ac34e7998e1eee5e5f0cc26c2a91846",
"status": "affected",
"version": "4af663c2f64a8d252e690c60cf8b8abf22dc2951",
"versionType": "git"
},
{
"lessThan": "db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7",
"status": "affected",
"version": "4af663c2f64a8d252e690c60cf8b8abf22dc2951",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/sev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use\n\nAs per the GHCB spec, when using GHCB v2+ require the software scratch area\nto reside in the GHCB\u0027s shared buffer. Note, things like Page State Change\n(PSC) requests _rely_ on this behavior, as the guest can\u0027t provide a length\nwhen making the request, i.e. the size of the guest payload is bounded by\nthe size of the shared buffer.\n\nFailure to force usage of the GHCB, and a slew of other flaws, lets a\nmalicious SNP guest corrupt host kernel heap memory, and leak host heap\nlayout information.\n\nsetup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2),\nwhere exit_info_2 is guest-controlled. With exit_info_2=24, this yields\na 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer\nholds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only\nentries[0] and entries[1] are in-bounds.\n\nsnp_begin_psc() validates end_entry against VMGEXIT_PSC_MAX_COUNT (253)\nbut NOT against the actual buffer size:\n\n idx_end = hdr-\u003eend_entry;\n\n if (idx_end \u003e= VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer\n snp_complete_psc(svm, ...);\n return 1;\n }\n\n for (idx = idx_start; idx \u003c= idx_end; idx++) {\n entry_start = entries[idx]; // OOB when idx \u003e= 2\n\nThe guest sets end_entry=10+, causing the host to iterate entries[2+]\nwhich are OOB into adjacent slab objects. For each OOB entry:\n\n - The host reads 8 bytes (OOB READ / info leak oracle)\n - If the data passes PSC validation, __snp_complete_one_psc() writes\n cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806)\n - If validation fails, the error response reveals whether adjacent\n memory is zero vs non-zero (information disclosure to guest)\n\nThe guest controls allocation size (exit_info_2), entry range\n(cur_entry/end_entry), and can fire unlimited VMGEXITs to repeatedly\nhit different slab positions.\n\nBy exploiting the variety of bugs, a malicious SEV-SNP guest can:\n - OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure)\n - OOB write cur_page bits into adjacent objects (heap corruption)\n - Trigger use-after-free conditions across VMGEXITs\n\nE.g. with KASAN enabled, a single insmod of the PoC guest module\nproduces 73 KASAN reports:\n\n BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890\n Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86/2199\n\n BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890\n Write of size 8 at addr ffff888351566648 by task qemu-system-x86/2199\n\n The buggy address belongs to the object at ffff888XXXXXXXXX\n which belongs to the cache kmalloc-cg-32 of size 32\n The buggy address is located N bytes to the right of\n allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX)\n\n Breakdown:\n 62 slab-out-of-bounds (reads + writes past allocation)\n 7 slab-use-after-free\n 4 use-after-free\n\nAll credit to Stan for the wonderful description and reproducer!\n\n[sean: write changelog]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by running a SEV-SNP vCPU through KVM and issuing a guest-controlled VMGEXIT PSC request, not by remote packets or adjacent/physical access.\nAC:L - The guest directly controls the scratch pointer/length and PSC entry bounds, and can repeatedly issue malformed VMGEXITs without needing external races or rare timing conditions.\nPR:L - Exploitation requires the ability to run or control a SEV-SNP guest/KVM vCPU, which is a low-privilege local or tenant capability rather than real host root in the init namespace.\nUI:N - Once the attacker controls the malicious guest or VM process, no additional victim action is required to trigger the VMGEXIT handling path.\nS:C - The bug lets a malicious guest corrupt and disclose host kernel heap memory, crossing the guest-to-host virtualization security boundary.\nC:H - The OOB reads and error oracle leak adjacent host heap contents/layout, and the associated memory corruption/UAF behavior is sufficient to treat confidentiality impact as high.\nI:H - The vulnerable path performs OOB writes into adjacent host slab objects and can trigger UAF conditions, making host kernel memory corruption and potential control-flow compromise defensible.\nA:H - The bug produces host kernel slab OOB writes/reads and UAF reports and can crash or destabilize the host kernel, giving high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:35:09.892Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf9ba093fbb83c0c9a3dedd50efec29424eca2fc"
},
{
"url": "https://git.kernel.org/stable/c/c9b4198fbc6ed99a9da4bee9f74bb730f926c9ae"
},
{
"url": "https://git.kernel.org/stable/c/b328ede59ac34e7998e1eee5e5f0cc26c2a91846"
},
{
"url": "https://git.kernel.org/stable/c/db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7"
}
],
"title": "KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53360",
"datePublished": "2026-07-04T11:53:58.657Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-10-19T20:07:44.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…