Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1334
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Power, little endian 8 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for IBM z Systems 8 s390x | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8 aarch64 | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 8 x86_64 | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x | ||
| Red Hat | Red Hat Enterprise Linux Server | Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 10 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Real Time 8 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux Server | Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for ARM 64 9 aarch64 | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for x86_64 10 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8 x86_64 | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux Server | Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64 | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for ARM 64 9 aarch64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64 | ||
| Red Hat | Red Hat Enterprise Linux Server | Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Real Time for x86_64 - Extended Life Cycle Support 7 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for ARM 64 8 aarch64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for ARM 64 10 aarch64 | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for ARM 64 8 aarch64 | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Real Time for NFV 8 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux Server | Red Hat Enterprise Linux Server - AUS 9.4 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for x86_64 8 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for IBM z Systems 9 s390x | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8 s390x | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for ARM 64 10 aarch64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x | ||
| Red Hat | Red Hat Enterprise Linux Server | Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Power, little endian 9 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux Server | Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux Hidden Content for x86_64 10 x86_64 | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.2 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for IBM z Systems 10 s390x | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for x86_64 9 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for x86_64 9 x86_64 | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for Power, little endian 10 ppc64le | ||
| Red Hat | Red Hat CodeReady Linux Builder | Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le | ||
| Red Hat | Red Hat Enterprise Linux | Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian 8 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems 8 s390x",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.8 aarch64",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 8 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x",
"product": {
"name": "Red Hat Enterprise Linux Server",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 10 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Real Time 8 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux Server",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 9 aarch64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for x86_64 10 x86_64",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.8 x86_64",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.8 ppc64le",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64",
"product": {
"name": "Red Hat Enterprise Linux Server",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for ARM 64 9 aarch64",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux Server",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Real Time for x86_64 - Extended Life Cycle Support 7 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 8 aarch64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 10 aarch64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for ARM 64 8 aarch64",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Real Time for NFV 8 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server - AUS 9.4 x86_64",
"product": {
"name": "Red Hat Enterprise Linux Server",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for x86_64 8 x86_64",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems 9 s390x",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.8 s390x",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for ARM 64 10 aarch64",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64",
"product": {
"name": "Red Hat Enterprise Linux Server",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian 9 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux Server",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux Hidden Content for x86_64 10 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.2 x86_64",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for IBM z Systems 10 s390x",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for x86_64 9 x86_64",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for x86_64 9 x86_64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for Power, little endian 10 ppc64le",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le",
"product": {
"name": "Red Hat CodeReady Linux Builder",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
},
{
"description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64",
"product": {
"name": "Red Hat Enterprise Linux",
"vendor": {
"name": "Red Hat",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-80887",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80887"
},
{
"name": "CVE-2026-63974",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63974"
},
{
"name": "CVE-2026-53002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53002"
},
{
"name": "CVE-2026-63921",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63921"
},
{
"name": "CVE-2026-68245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68245"
},
{
"name": "CVE-2026-64385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64385"
},
{
"name": "CVE-2026-72130",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72130"
},
{
"name": "CVE-2026-46319",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46319"
},
{
"name": "CVE-2026-68404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68404"
},
{
"name": "CVE-2026-89526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89526"
},
{
"name": "CVE-2026-72320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72320"
},
{
"name": "CVE-2026-93207",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93207"
},
{
"name": "CVE-2026-53239",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53239"
},
{
"name": "CVE-2026-93228",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93228"
},
{
"name": "CVE-2026-64162",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64162"
},
{
"name": "CVE-2026-89689",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89689"
},
{
"name": "CVE-2026-89811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89811"
},
{
"name": "CVE-2026-64508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64508"
},
{
"name": "CVE-2026-90036",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90036"
},
{
"name": "CVE-2026-63925",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63925"
},
{
"name": "CVE-2026-72262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72262"
},
{
"name": "CVE-2026-45859",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45859"
},
{
"name": "CVE-2026-74580",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74580"
},
{
"name": "CVE-2026-68278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68278"
},
{
"name": "CVE-2026-74583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74583"
},
{
"name": "CVE-2026-31663",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31663"
},
{
"name": "CVE-2026-68426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68426"
},
{
"name": "CVE-2026-63917",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63917"
},
{
"name": "CVE-2026-80985",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80985"
},
{
"name": "CVE-2026-81003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-81003"
},
{
"name": "CVE-2026-89970",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89970"
},
{
"name": "CVE-2026-68377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68377"
},
{
"name": "CVE-2026-89894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89894"
},
{
"name": "CVE-2026-74641",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74641"
},
{
"name": "CVE-2026-63920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63920"
},
{
"name": "CVE-2026-64191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64191"
},
{
"name": "CVE-2026-93262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93262"
},
{
"name": "CVE-2026-72318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72318"
},
{
"name": "CVE-2026-74574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74574"
},
{
"name": "CVE-2026-46309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46309"
},
{
"name": "CVE-2026-53011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53011"
},
{
"name": "CVE-2026-68140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68140"
},
{
"name": "CVE-2026-63919",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63919"
},
{
"name": "CVE-2026-74705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74705"
},
{
"name": "CVE-2026-72289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72289"
},
{
"name": "CVE-2026-64032",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64032"
},
{
"name": "CVE-2026-68409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68409"
},
{
"name": "CVE-2026-68108",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68108"
},
{
"name": "CVE-2026-63899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63899"
},
{
"name": "CVE-2026-31678",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31678"
},
{
"name": "CVE-2026-64030",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64030"
},
{
"name": "CVE-2026-80521",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80521"
},
{
"name": "CVE-2026-68123",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68123"
},
{
"name": "CVE-2026-64507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64507"
},
{
"name": "CVE-2026-43332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43332"
},
{
"name": "CVE-2026-64007",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64007"
},
{
"name": "CVE-2026-68236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68236"
},
{
"name": "CVE-2026-72288",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72288"
}
],
"initial_release_date": "2026-10-16T00:00:00",
"last_revision_date": "2026-10-16T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1334",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-16T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Red Hat. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Red Hat",
"vendor_advisories": [
{
"published_at": "2026-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:83156",
"url": "https://access.redhat.com/errata/RHSA-2026:83156"
},
{
"published_at": "2026-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:83157",
"url": "https://access.redhat.com/errata/RHSA-2026:83157"
},
{
"published_at": "2026-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:83159",
"url": "https://access.redhat.com/errata/RHSA-2026:83159"
},
{
"published_at": "2026-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:83207",
"url": "https://access.redhat.com/errata/RHSA-2026:83207"
},
{
"published_at": "2026-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:82860",
"url": "https://access.redhat.com/errata/RHSA-2026:82860"
},
{
"published_at": "2026-10-09",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:79786",
"url": "https://access.redhat.com/errata/RHSA-2026:79786"
},
{
"published_at": "2026-10-12",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:81552",
"url": "https://access.redhat.com/errata/RHSA-2026:81552"
},
{
"published_at": "2026-10-12",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:81371",
"url": "https://access.redhat.com/errata/RHSA-2026:81371"
},
{
"published_at": "2026-10-12",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:81406",
"url": "https://access.redhat.com/errata/RHSA-2026:81406"
},
{
"published_at": "2026-10-12",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:81349",
"url": "https://access.redhat.com/errata/RHSA-2026:81349"
},
{
"published_at": "2026-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:82807",
"url": "https://access.redhat.com/errata/RHSA-2026:82807"
},
{
"published_at": "2026-10-14",
"title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:82806",
"url": "https://access.redhat.com/errata/RHSA-2026:82806"
}
]
}
CVE-2026-31678 (GCVE-0-2026-31678)
Vulnerability from cvelistv5
Published
2026-04-25 08:46
Modified
2026-10-19 18:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: defer tunnel netdev_put to RCU release
ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already
detached the device. Dropping the netdev reference in destroy can race
with concurrent readers that still observe vport->dev.
Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let
vport_netdev_free() drop the reference from the RCU callback, matching
the non-tunnel destroy path and avoiding additional synchronization
under RTNL.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a9020fde67a6eb77f8130feff633189f99264db1 Version: a9020fde67a6eb77f8130feff633189f99264db1 Version: a9020fde67a6eb77f8130feff633189f99264db1 Version: a9020fde67a6eb77f8130feff633189f99264db1 Version: a9020fde67a6eb77f8130feff633189f99264db1 Version: a9020fde67a6eb77f8130feff633189f99264db1 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31678",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:12:17.787623Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:56:04.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/vport-netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9d56aced21fb9c104e8a3f3be9b21fbafe448ffc",
"status": "affected",
"version": "a9020fde67a6eb77f8130feff633189f99264db1",
"versionType": "git"
},
{
"lessThan": "42f0d3d81209654c08ffdde5a34b9b92d2645896",
"status": "affected",
"version": "a9020fde67a6eb77f8130feff633189f99264db1",
"versionType": "git"
},
{
"lessThan": "bbe7bd722bfaea36aab3da6cc60fb4a05c644643",
"status": "affected",
"version": "a9020fde67a6eb77f8130feff633189f99264db1",
"versionType": "git"
},
{
"lessThan": "98b726ab5e2a4811e27c28e4d041f75bba147eab",
"status": "affected",
"version": "a9020fde67a6eb77f8130feff633189f99264db1",
"versionType": "git"
},
{
"lessThan": "b8c56a3fc5d879c0928f207a756b0f067f06c6a8",
"status": "affected",
"version": "a9020fde67a6eb77f8130feff633189f99264db1",
"versionType": "git"
},
{
"lessThan": "6931d21f87bc6d657f145798fad0bf077b82486c",
"status": "affected",
"version": "a9020fde67a6eb77f8130feff633189f99264db1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/vport-netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: defer tunnel netdev_put to RCU release\n\novs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already\ndetached the device. Dropping the netdev reference in destroy can race\nwith concurrent readers that still observe vport-\u003edev.\n\nDo not release vport-\u003edev in ovs_netdev_tunnel_destroy(). Instead, let\nvport_netdev_free() drop the reference from the RCU callback, matching\nthe non-tunnel destroy path and avoiding additional synchronization\nunder RTNL."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable destroy path is reached through local Generic Netlink/rtnetlink control operations that create or delete Open vSwitch tunnel vports. Remote tunnel packets alone do not invoke `ovs_netdev_tunnel_destroy()`.\nAC:L - This is a race/lifetime bug, but the attacker can control both sides by repeatedly deleting tunnel vports while concurrently driving RCU readers such as vport get/dump, packet execute, or datapath traffic. No rare external condition is required.\nPR:L - Creating and deleting OVS datapaths/vports requires `CAP_NET_ADMIN`, but the OVS Generic Netlink families are netns-aware and use `GENL_UNS_ADMIN_PERM`, making this reachable with CAP_NET_ADMIN in an unprivileged user namespace. This is Low privileges rather than High.\nUI:N - No victim user action is needed once the local attacker can issue the relevant netlink operations. The attacker can trigger creation, deletion, and racing reader activity directly.\nS:U - The vulnerability is a kernel memory lifetime error within the same host kernel security authority. It is a standard local kernel privilege-escalation/DoS class issue, not a VM or hardware boundary escape.\nC:H - The early `netdev_put()` can free the `net_device` while RCU readers still dereference `vport-\u003edev`, creating a use-after-free. Per kernel CVSS guidance, UAFs are scored as High confidentiality impact because they can be developed into kernel memory disclosure primitives.\nI:H - The stale `net_device` pointer can be reused after free by kernel readers/writers and may reach function-pointer-bearing netdev paths. Per guidance, a use-after-free is scored as High integrity impact because heap reuse can enable arbitrary write or code execution.\nA:H - The bug can at minimum crash or oops the kernel through NULL/stale `vport-\u003edev` dereferences and has related observed OVS netdev lifetime splats. A kernel UAF also warrants High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:24.631Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9d56aced21fb9c104e8a3f3be9b21fbafe448ffc"
},
{
"url": "https://git.kernel.org/stable/c/42f0d3d81209654c08ffdde5a34b9b92d2645896"
},
{
"url": "https://git.kernel.org/stable/c/bbe7bd722bfaea36aab3da6cc60fb4a05c644643"
},
{
"url": "https://git.kernel.org/stable/c/98b726ab5e2a4811e27c28e4d041f75bba147eab"
},
{
"url": "https://git.kernel.org/stable/c/b8c56a3fc5d879c0928f207a756b0f067f06c6a8"
},
{
"url": "https://git.kernel.org/stable/c/6931d21f87bc6d657f145798fad0bf077b82486c"
}
],
"title": "openvswitch: defer tunnel netdev_put to RCU release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31678",
"datePublished": "2026-04-25T08:46:54.476Z",
"dateReserved": "2026-03-09T15:48:24.130Z",
"dateUpdated": "2026-10-19T18:56:04.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63974 (GCVE-0-2026-63974)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-21 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close
Since hci_dev_close_sync() can now be called during the reset path, we
should also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts
while the hdev workqueue is being drained.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 877afadad2dce8aae1f2aad8ce47e072d4f6165e Version: 877afadad2dce8aae1f2aad8ce47e072d4f6165e Version: 877afadad2dce8aae1f2aad8ce47e072d4f6165e Version: 877afadad2dce8aae1f2aad8ce47e072d4f6165e Version: 877afadad2dce8aae1f2aad8ce47e072d4f6165e Version: 4bf367fa1fefabdf14938d0ac9ed60020389112e Version: 3b382555706558f5c0587862b6dc03e96a252bba Version: 5.18.18 ≤ Version: 5.19.2 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63974",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:34:21.021938Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:59.582Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21",
"status": "affected",
"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
"versionType": "git"
},
{
"lessThan": "9cebe4680bb9a72f80c6541eb24af06db7a1fbc9",
"status": "affected",
"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
"versionType": "git"
},
{
"lessThan": "47330cc875b36a1cf7b3543cb2cf90a7c603ce0e",
"status": "affected",
"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
"versionType": "git"
},
{
"lessThan": "60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff",
"status": "affected",
"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
"versionType": "git"
},
{
"lessThan": "525daaea459fc215f432de1b8debbd9144bf97b0",
"status": "affected",
"version": "877afadad2dce8aae1f2aad8ce47e072d4f6165e",
"versionType": "git"
},
{
"status": "affected",
"version": "4bf367fa1fefabdf14938d0ac9ed60020389112e",
"versionType": "git"
},
{
"status": "affected",
"version": "3b382555706558f5c0587862b6dc03e96a252bba",
"versionType": "git"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.18",
"versionType": "semver"
},
{
"lessThan": "5.20",
"status": "affected",
"version": "5.19.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close\n\nSince hci_dev_close_sync() can now be called during the reset path, we\nshould also set HCI_CMD_DRAIN_WORKQUEUE. This avoids queuing timeouts\nwhile the hdev workqueue is being drained."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - This is a Bluetooth HCI subsystem bug where exploitation requires concurrent HCI controller events from the radio during adapter close/reset; on phones and laptops with Bluetooth enabled in public spaces, a nearby attacker can supply that traffic while the kernel tears down the adapter.\nAC:L - The attacker controls both sides of the race by timing Bluetooth traffic against adapter reset/close or error-recovery teardown, and syzbot reliably reproduced the original workqueue-drain class of this bug.\nPR:N - No local credentials are required on the remote path: a nearby Bluetooth attacker can drive ncmd/cmd timeout recovery that calls hci_dev_do_close() \u2192 hci_dev_close_sync(); local CAP_NET_ADMIN ioctl reset is an additional reachable path via user namespaces.\nUI:N - Exploitation does not require the victim to perform a specific action beyond having Bluetooth enabled, which is the default on most mobile and laptop deployments.\nS:U - Impact is confined to kernel Bluetooth/HCI state and does not cross a security boundary such as a VM escape or sandbox breakout.\nC:H - Queueing work onto a draining workqueue corrupts kernel workqueue metadata for cmd_timer/ncmd_timer delayed-work structures, which is memory corruption that could be leveraged for information disclosure during the close/open reset cycle.\nI:H - The workqueue invariant violation leaves delayed-work items in inconsistent states on a persistent hdev-\u003eworkqueue that is reused after reset, creating a plausible path to control-flow hijack via corrupted work callbacks.\nA:H - Triggering this bug produces a kernel WARNING in __queue_work() (kernel panic on panic_on_warn systems) and can cause drain_workqueue() to spin with repeated reflush attempts, denying Bluetooth availability and potentially hanging the adapter teardown path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:42:48.103Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21"
},
{
"url": "https://git.kernel.org/stable/c/9cebe4680bb9a72f80c6541eb24af06db7a1fbc9"
},
{
"url": "https://git.kernel.org/stable/c/47330cc875b36a1cf7b3543cb2cf90a7c603ce0e"
},
{
"url": "https://git.kernel.org/stable/c/60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff"
},
{
"url": "https://git.kernel.org/stable/c/525daaea459fc215f432de1b8debbd9144bf97b0"
}
],
"title": "Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63974",
"datePublished": "2026-07-19T14:55:59.994Z",
"dateReserved": "2026-07-19T07:54:57.024Z",
"dateUpdated": "2026-10-21T12:42:48.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64507 (GCVE-0-2026-64507)
Vulnerability from cvelistv5
Published
2026-07-25 08:52
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/bugs: Enable IBPB flush on BPF JIT allocation
Enable hardening against JIT spraying when Spectre-v2 mitigations are in
use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip
enabling the IBPB flush if the BPF dispatcher is already using a retpoline
sequence.
This hardening applies only when BPF-JIT is in use. Guard the enabling
under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/nospec-branch.h",
"arch/x86/kernel/cpu/bugs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "25dbcd31781e2bc3cd63d873af1fcd06f863a126",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "cb27f3bf915cc0f20fc0c48da9059304e39ebd35",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "9354248fc1c33a844ca1872761f6668b393e8c37",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "52440e15d9628f8f239373c0f2e5e8f92feea2df",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "a3af84b0fa00ead01fcd0e28b5d773ff25990a0d",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/nospec-branch.h",
"arch/x86/kernel/cpu/bugs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Enable IBPB flush on BPF JIT allocation\n\nEnable hardening against JIT spraying when Spectre-v2 mitigations are in\nuse. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip\nenabling the IBPB flush if the BPF dispatcher is already using a retpoline\nsequence.\n\nThis hardening applies only when BPF-JIT is in use. Guard the enabling\nunder CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:18.513Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/25dbcd31781e2bc3cd63d873af1fcd06f863a126"
},
{
"url": "https://git.kernel.org/stable/c/cb27f3bf915cc0f20fc0c48da9059304e39ebd35"
},
{
"url": "https://git.kernel.org/stable/c/9354248fc1c33a844ca1872761f6668b393e8c37"
},
{
"url": "https://git.kernel.org/stable/c/8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1"
},
{
"url": "https://git.kernel.org/stable/c/52440e15d9628f8f239373c0f2e5e8f92feea2df"
},
{
"url": "https://git.kernel.org/stable/c/a3af84b0fa00ead01fcd0e28b5d773ff25990a0d"
}
],
"title": "x86/bugs: Enable IBPB flush on BPF JIT allocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64507",
"datePublished": "2026-07-25T08:52:01.008Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-08-19T16:28:18.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74583 (GCVE-0-2026-74583)
Vulnerability from cvelistv5
Published
2026-08-21 16:31
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_route: fix fastmap use-after-free on filter
The route4 classifier maintains a 16-slot fastmap cache that stores raw
struct route4_filter pointers indexed by (id, iif). The reader
(route4_classify) populates this cache via route4_set_fastmap() for every
classified packet that hits a filter. The writer (route4_delete,
route4_change) clears the cache via route4_reset_fastmap() before
RCU-deferred kfree of the filter.
This creates a UAF race:
1. Reader walks the RCU-protected bucket chain, finds filter f
2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()
3. Reader calls route4_set_fastmap() and writes f into the cache
*after* the writer's reset, caching a pointer about to be freed
4. After the RCU grace period, kfree(f) executes
5. Next classified packet on the same (id, iif) tuple hits the stale
fastmap entry and reads f->res from freed memory
Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a
concurrent add/delete stress test (provided by both zdi and Santosh).
Both triggered KASAN slab-use-after-free reports in the route4 fastmap
paths.
Fix:
Introduce a per-filter boolean dying flag to suppress stale fastmap
republishing by in-flight readers.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1109c00547fc66df45b9ff923544be4c1e1bec13 Version: 1109c00547fc66df45b9ff923544be4c1e1bec13 Version: 1109c00547fc66df45b9ff923544be4c1e1bec13 Version: 1109c00547fc66df45b9ff923544be4c1e1bec13 Version: 1109c00547fc66df45b9ff923544be4c1e1bec13 Version: 1109c00547fc66df45b9ff923544be4c1e1bec13 Version: 1109c00547fc66df45b9ff923544be4c1e1bec13 Version: 1109c00547fc66df45b9ff923544be4c1e1bec13 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74583",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:01:17.964713Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:58.388Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/cls_route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7897198b26445b4009a057bda1986b94a99e5d5f",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "820f083c294ad6d319c02a7d43294f2ed2565139",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "5ec9001be6d0eb527251125632ec8fe88278897f",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "b969984b2bdc85d721ce4047cd270cd37ec705a2",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "a17f636c9330eac879822ce29f998e5abd1b72c1",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "0e7a8cf8895b06d07c7311f028eba16ad742b9bc",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "ae9aff87025219005a2d16b4fe83d6f24643e50d",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
},
{
"lessThan": "47d7f7051253bdc02b1d245d87e38f16d31a74df",
"status": "affected",
"version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/cls_route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_route: fix fastmap use-after-free on filter\n\nThe route4 classifier maintains a 16-slot fastmap cache that stores raw\nstruct route4_filter pointers indexed by (id, iif). The reader\n(route4_classify) populates this cache via route4_set_fastmap() for every\nclassified packet that hits a filter. The writer (route4_delete,\nroute4_change) clears the cache via route4_reset_fastmap() before\nRCU-deferred kfree of the filter.\n\nThis creates a UAF race:\n 1. Reader walks the RCU-protected bucket chain, finds filter f\n 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()\n 3. Reader calls route4_set_fastmap() and writes f into the cache\n *after* the writer\u0027s reset, caching a pointer about to be freed\n 4. After the RCU grace period, kfree(f) executes\n 5. Next classified packet on the same (id, iif) tuple hits the stale\n fastmap entry and reads f-\u003eres from freed memory\n\nReproduced with an mdelay(100) accelerator in route4_set_fastmap() and a\nconcurrent add/delete stress test (provided by both zdi and Santosh).\nBoth triggered KASAN slab-use-after-free reports in the route4 fastmap\npaths.\n\nFix:\nIntroduce a per-filter boolean dying flag to suppress stale fastmap\nrepublishing by in-flight readers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local rtnetlink RTM_NEWTFILTER/RTM_DELTFILTER (tc filter add/change/del route) through sendmsg\u2192rtnetlink_rcv_msg\u2192tc_new_tfilter/tc_del_tfilter\u2192route4_change/route4_delete; remote packets alone cannot trigger the filter-deletion side of the race.\nAC:L - The attacker controls both race sides\u2014concurrent route filter add/change/delete via netlink plus traffic through route4_classify on clsact/ingress/egress qdiscs; ZDI and independent reporter stress tests reproduced KASAN slab-use-after-free without uncontrollable prerequisites.\nPR:L - Non-GET rtnetlink handlers require netlink_net_capable(CAP_NET_ADMIN), evaluated against the target network namespace user_ns; an unprivileged local user obtains CAP_NET_ADMIN via user+network namespaces (unshare -Urn) and configures clsact with route filters.\nUI:N - No victim interaction is needed; the attacker configures the route classifier, drives concurrent filter churn, and generates matching traffic from their own processes.\nS:U - Impact is kernel memory corruption within the same kernel security boundary (local privilege escalation/DoS); it does not cross VM, hypervisor, or IOMMU boundaries.\nC:H - Slab use-after-free: a stale fastmap entry retains a freed route4_filter pointer and route4_classify dereferences f-\u003eres from freed kmalloc memory; KASAN confirmed slab-use-after-free, enabling arbitrary kernel read via heap reclaim/spray.\nI:H - UAF of the kmalloc route4_filter object allows attacker-controlled heap spraying to reclaim the freed slot and obtain write/control-flow hijacking primitives; memory corruption is exploitable beyond a simple crash.\nA:H - UAF on the fastmap hot path causes kernel oops/panic under concurrent filter churn; KASAN slab-use-after-free was confirmed during add/delete stress testing, providing reliable denial of service even without full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:10.077Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f"
},
{
"url": "https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139"
},
{
"url": "https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f"
},
{
"url": "https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2"
},
{
"url": "https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1"
},
{
"url": "https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc"
},
{
"url": "https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d"
},
{
"url": "https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df"
}
],
"title": "net/sched: cls_route: fix fastmap use-after-free on filter",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74583",
"datePublished": "2026-08-21T16:31:55.886Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-10-16T19:05:58.388Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46319 (GCVE-0-2026-46319)
Vulnerability from cvelistv5
Published
2026-06-09 12:11
Modified
2026-10-19 19:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_ct: Only release RCU read lock after ct_ft
When looking up a flow table in act_ct in tcf_ct_flow_table_get(),
rhashtable_lookup_fast() internally opens and closes an RCU read critical
section before returning ct_ft.
The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()
is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft
object. This vulnerability can lead to privilege escalation.
Analysis from zdi-disclosures@trendmicro.com:
When initializing act_ct, tcf_ct_init() is called, which internally triggers
tcf_ct_flow_table_get().
static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)
{
struct zones_ht_key key = { .net = net, .zone = params->zone };
struct tcf_ct_flow_table *ct_ft;
int err = -ENOMEM;
mutex_lock(&zones_mutex);
ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params); // [1]
if (ct_ft && refcount_inc_not_zero(&ct_ft->ref)) // [2]
goto out_unlock;
...
}
static __always_inline void *rhashtable_lookup_fast(
struct rhashtable *ht, const void *key,
const struct rhashtable_params params)
{
void *obj;
rcu_read_lock();
obj = rhashtable_lookup(ht, key, params);
rcu_read_unlock();
return obj;
}
At [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft
from zones_ht . The lookup is performed within an RCU read critical section
through rcu_read_lock() / rcu_read_unlock(), which prevents the object from
being freed. However, at the point of function return, rcu_read_unlock() has
already been called, and there is nothing preventing ct_ft from being freed
before reaching refcount_inc_not_zero(&ct_ft->ref) at [2]. This interval becomes
the race window, during which ct_ft can be freed.
Free Process:
tcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu()
tcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().
static void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft)
{
if (refcount_dec_and_test(&ct_ft->ref)) {
rhashtable_remove_fast(&zones_ht, &ct_ft->node, zones_params);
INIT_RCU_WORK(&ct_ft->rwork, tcf_ct_flow_table_cleanup_work); // [3]
queue_rcu_work(act_ct_wq, &ct_ft->rwork);
}
}
At [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work
static void tcf_ct_flow_table_cleanup_work(struct work_struct *work)
{
struct tcf_ct_flow_table *ct_ft;
struct flow_block *block;
ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,
rwork);
nf_flow_table_free(&ct_ft->nf_ft);
block = &ct_ft->nf_ft.flow_block;
down_write(&ct_ft->nf_ft.flow_block_lock);
WARN_ON(!list_empty(&block->cb_list));
up_write(&ct_ft->nf_ft.flow_block_lock);
kfree(ct_ft); // [4]
module_put(THIS_MODULE);
}
tcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes
between [1] and [2], UAF occurs.
This race condition has a very short race window, making it generally
difficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was
inserted after[1]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46319",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:21:58.359342Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:36:58.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/act_ct.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ece578ca61e572df96cfc80456357ebfae0b4b9e",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "a2e0c045c87aa252eb61412e67dd91f2c2b19f81",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "67c9ecc9f2575273ed1323e312881fc98ac83d6d",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "f23424a0ddadb494d4bd57056a7ca703312d3a7b",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "17dfb67cb399b660105d9a8c6100851c0d0cdc70",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "4c727c6967a41b37efe0f26332ca9ec5b74785a3",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "3e20e1b3058e0b94638e7b931c138e840e266724",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "f462dca0c8415bf0058d0ffa476354c4476d0f09",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/act_ct.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: Only release RCU read lock after ct_ft\n\nWhen looking up a flow table in act_ct in tcf_ct_flow_table_get(),\nrhashtable_lookup_fast() internally opens and closes an RCU read critical\nsection before returning ct_ft.\nThe tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()\nis invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft\nobject. This vulnerability can lead to privilege escalation.\n\nAnalysis from zdi-disclosures@trendmicro.com:\nWhen initializing act_ct, tcf_ct_init() is called, which internally triggers\ntcf_ct_flow_table_get().\n\nstatic int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)\n\n{\n struct zones_ht_key key = { .net = net, .zone = params-\u003ezone };\n struct tcf_ct_flow_table *ct_ft;\n int err = -ENOMEM;\n\n mutex_lock(\u0026zones_mutex);\n ct_ft = rhashtable_lookup_fast(\u0026zones_ht, \u0026key, zones_params); // [1]\n if (ct_ft \u0026\u0026 refcount_inc_not_zero(\u0026ct_ft-\u003eref)) // [2]\n goto out_unlock;\n ...\n}\n\nstatic __always_inline void *rhashtable_lookup_fast(\n struct rhashtable *ht, const void *key,\n const struct rhashtable_params params)\n{\n void *obj;\n\n rcu_read_lock();\n obj = rhashtable_lookup(ht, key, params);\n rcu_read_unlock();\n\n return obj;\n}\n\nAt [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft\nfrom zones_ht . The lookup is performed within an RCU read critical section\nthrough rcu_read_lock() / rcu_read_unlock(), which prevents the object from\nbeing freed. However, at the point of function return, rcu_read_unlock() has\nalready been called, and there is nothing preventing ct_ft from being freed\nbefore reaching refcount_inc_not_zero(\u0026ct_ft-\u003eref) at [2]. This interval becomes\nthe race window, during which ct_ft can be freed.\n\nFree Process:\n\ntcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu()\ntcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().\n\nstatic void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft)\n{\n if (refcount_dec_and_test(\u0026ct_ft-\u003eref)) {\n rhashtable_remove_fast(\u0026zones_ht, \u0026ct_ft-\u003enode, zones_params);\n INIT_RCU_WORK(\u0026ct_ft-\u003erwork, tcf_ct_flow_table_cleanup_work); // [3]\n queue_rcu_work(act_ct_wq, \u0026ct_ft-\u003erwork);\n }\n}\n\nAt [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work\n\nstatic void tcf_ct_flow_table_cleanup_work(struct work_struct *work)\n\n{\n struct tcf_ct_flow_table *ct_ft;\n struct flow_block *block;\n\n ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,\n rwork);\n nf_flow_table_free(\u0026ct_ft-\u003enf_ft);\n block = \u0026ct_ft-\u003enf_ft.flow_block;\n down_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\n WARN_ON(!list_empty(\u0026block-\u003ecb_list));\n up_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\n kfree(ct_ft); // [4]\n\n module_put(THIS_MODULE);\n}\n\ntcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes\nbetween [1] and [2], UAF occurs.\n\nThis race condition has a very short race window, making it generally\ndifficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was\ninserted after[1]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is triggered only during act_ct TC action configuration via RTM_NEWACTION/RTM_DELACTION or RTM_NEWTFILTER netlink messages, not by processing remote network packets. Per kernel guidance, tc/netlink qdisc paths are Local attack vector.\nAC:L - The race is between flow-table lookup and refcount increment during concurrent create/delete/replace of ct actions, and an attacker with CAP_NET_ADMIN controls both sides by issuing parallel netlink operations on actions sharing the same zone. UAF races where the attacker controls timing are scored AC:L.\nPR:L - All non-GET rtnetlink TC operations require CAP_NET_ADMIN, checked in rtnetlink_rcv_msg() and tc_ctl_action(). CAP_NET_ADMIN is obtainable by an unprivileged user inside a user+network namespace (unshare -Urn), which per kernel guidance is PR:L not PR:H.\nUI:N - Exploitation requires only the attacker\u0027s own netlink configuration traffic; no victim user action such as opening a file or mounting a filesystem is needed.\nS:U - A successful exploit yields kernel-level privilege escalation within the same kernel security domain. This is standard local kernel compromise, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - The bug is a heap use-after-free on struct tcf_ct_flow_table during refcount_inc_not_zero() on memory that tcf_ct_flow_table_cleanup_work() may have already kfree()\u0027d. UAF on kernel heap objects enables arbitrary memory read primitives and is scored C:H.\nI:H - Freed tcf_ct_flow_table slabs can be reallocated and corrupted via the dangling refcount operation, providing heap manipulation primitives that ZDI and the fix commit describe as leading to privilege escalation. Memory corruption UAF is scored I:H.\nA:H - Hitting the UAF during refcount manipulation on freed memory can cause kernel oops/panic or deliberate denial of service, and UAF bugs inherently threaten availability even when exploitation is attempted. Any kernel crash or UAF is scored A:H."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:14.097Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ece578ca61e572df96cfc80456357ebfae0b4b9e"
},
{
"url": "https://git.kernel.org/stable/c/a2e0c045c87aa252eb61412e67dd91f2c2b19f81"
},
{
"url": "https://git.kernel.org/stable/c/67c9ecc9f2575273ed1323e312881fc98ac83d6d"
},
{
"url": "https://git.kernel.org/stable/c/f23424a0ddadb494d4bd57056a7ca703312d3a7b"
},
{
"url": "https://git.kernel.org/stable/c/17dfb67cb399b660105d9a8c6100851c0d0cdc70"
},
{
"url": "https://git.kernel.org/stable/c/4c727c6967a41b37efe0f26332ca9ec5b74785a3"
},
{
"url": "https://git.kernel.org/stable/c/3e20e1b3058e0b94638e7b931c138e840e266724"
},
{
"url": "https://git.kernel.org/stable/c/f462dca0c8415bf0058d0ffa476354c4476d0f09"
}
],
"title": "net/sched: act_ct: Only release RCU read lock after ct_ft",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46319",
"datePublished": "2026-06-09T12:11:12.128Z",
"dateReserved": "2026-05-13T15:03:33.112Z",
"dateUpdated": "2026-10-19T19:36:58.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68404 (GCVE-0-2026-68404)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: use wiphy work for socket owner autodisconnect
nl80211_netlink_notify() walks the cfg80211 wireless device list when a
NETLINK_GENERIC socket is released. If the socket owns a connection, the
notifier queues the embedded wdev->disconnect_wk work item.
That work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a
NETLINK_URELEASE notifier that already observed conn_owner_nlportid can
queue it after that cancel returns. _cfg80211_unregister_wdev() then
removes the wdev from the list and waits for RCU readers, but
synchronize_net() does not drain work queued by such a reader.
Make the autodisconnect work a wiphy_work instead. The callback already
needs the wiphy mutex, and wiphy_work runs under that mutex. This lets
teardown cancel pending autodisconnect work while holding the mutex,
without a cancel_work_sync() vs. worker locking concern.
Also cancel the wiphy work after list_del_rcu() and synchronize_net(). Any
NETLINK_URELEASE notifier that had already reached the wdev list has then
either queued the work and it is removed, or can no longer find the wdev.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:20.936552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-662",
"description": "CWE-662 Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:08.902Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/cfg80211.h",
"net/wireless/core.c",
"net/wireless/core.h",
"net/wireless/nl80211.c",
"net/wireless/sme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c55590e4c69e0fd194df6d20bc35381c201d99e1",
"status": "affected",
"version": "bd2522b168847106c1885f0319a2833bdf88bf9a",
"versionType": "git"
},
{
"lessThan": "4087a9ba4ece70297a4174afaa41c0b700302b65",
"status": "affected",
"version": "bd2522b168847106c1885f0319a2833bdf88bf9a",
"versionType": "git"
},
{
"lessThan": "c2ddd180bbee766cf7359473d623423ea9485d93",
"status": "affected",
"version": "bd2522b168847106c1885f0319a2833bdf88bf9a",
"versionType": "git"
},
{
"lessThan": "6d6123fef5a4af175cc6b6b12a03dd0f3c240b79",
"status": "affected",
"version": "bd2522b168847106c1885f0319a2833bdf88bf9a",
"versionType": "git"
},
{
"lessThan": "0c2ed186bbe14304415476d6707b747dddcd8583",
"status": "affected",
"version": "bd2522b168847106c1885f0319a2833bdf88bf9a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/cfg80211.h",
"net/wireless/core.c",
"net/wireless/core.h",
"net/wireless/nl80211.c",
"net/wireless/sme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: use wiphy work for socket owner autodisconnect\n\nnl80211_netlink_notify() walks the cfg80211 wireless device list when a\nNETLINK_GENERIC socket is released. If the socket owns a connection, the\nnotifier queues the embedded wdev-\u003edisconnect_wk work item.\n\nThat work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a\nNETLINK_URELEASE notifier that already observed conn_owner_nlportid can\nqueue it after that cancel returns. _cfg80211_unregister_wdev() then\nremoves the wdev from the list and waits for RCU readers, but\nsynchronize_net() does not drain work queued by such a reader.\n\nMake the autodisconnect work a wiphy_work instead. The callback already\nneeds the wiphy mutex, and wiphy_work runs under that mutex. This lets\nteardown cancel pending autodisconnect work while holding the mutex,\nwithout a cancel_work_sync() vs. worker locking concern.\n\nAlso cancel the wiphy work after list_del_rcu() and synchronize_net(). Any\nNETLINK_URELEASE notifier that had already reached the wdev list has then\neither queued the work and it is removed, or can no longer find the wdev."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached through local nl80211/generic-netlink operations: setting NL80211_ATTR_SOCKET_OWNER on a connect/join command, closing the owning netlink socket, and tearing down the wireless interface. No network or radio traffic is required, so the attack vector is Local.\nAC:L - The attacker controls both sides of the race \u2014 the NETLINK_URELEASE notification (by closing its own socket) and the wdev teardown (by downing/deleting the interface) \u2014 and can repeat the sequence in a tight loop until the work is queued after the cancel window.\nPR:L - The relevant nl80211 commands use GENL_UNS_ADMIN_PERM and the family is netnsok, and mac80211_hwsim\u0027s HWSIM_CMD_NEW_RADIO likewise creates a wiphy in the caller\u0027s netns (wiphy_net_set(genl_info_net(info))), so an unprivileged user in a user+net namespace (unshare -Urn) obtains the required CAP_NET_ADMIN.\nUI:N - The entire sequence \u2014 creating/owning the connection, closing the socket, and removing the interface \u2014 is performed by the attacker\u0027s own process with no victim action required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed wireless_dev lives in the net_device private allocation; a use-after-free on that slab lets an attacker reclaim and inspect kernel heap contents, and cfg80211_autodisconnect_wk dereferences the stale object, enabling disclosure of arbitrary kernel memory.\nI:H - Queueing writes work list pointers into freed memory, and process_one_work() later loads work-\u003efunc from the reclaimed allocation, giving an attacker who sprays the slab a controlled kernel function pointer call and thus arbitrary write/code execution.\nA:H - Running cfg80211_autodisconnect_wk against a freed wireless_dev dereferences stale pointers and drives disconnect paths on destroyed state, reliably producing an oops or panic even without successful exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:01.037Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c55590e4c69e0fd194df6d20bc35381c201d99e1"
},
{
"url": "https://git.kernel.org/stable/c/4087a9ba4ece70297a4174afaa41c0b700302b65"
},
{
"url": "https://git.kernel.org/stable/c/c2ddd180bbee766cf7359473d623423ea9485d93"
},
{
"url": "https://git.kernel.org/stable/c/6d6123fef5a4af175cc6b6b12a03dd0f3c240b79"
},
{
"url": "https://git.kernel.org/stable/c/0c2ed186bbe14304415476d6707b747dddcd8583"
}
],
"title": "wifi: cfg80211: use wiphy work for socket owner autodisconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68404",
"datePublished": "2026-08-10T12:04:24.241Z",
"dateReserved": "2026-07-30T09:28:09.390Z",
"dateUpdated": "2026-10-21T12:44:01.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64385 (GCVE-0-2026-64385)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-10-19 20:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix double-free in SMB2_ioctl() replay
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_ioctl_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 433042a91f9373241307725b52de573933ffedbf Version: 4f1fffa2376922f3d1d506e49c0fd445b023a28e Version: 4f1fffa2376922f3d1d506e49c0fd445b023a28e Version: 4f1fffa2376922f3d1d506e49c0fd445b023a28e Version: 4f1fffa2376922f3d1d506e49c0fd445b023a28e Version: 6.6.32 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64385",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:39:57.224081Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:38:26.437Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0be4bc64882edaefaaee8d1e27d083643eb778e6",
"status": "affected",
"version": "433042a91f9373241307725b52de573933ffedbf",
"versionType": "git"
},
{
"lessThan": "96fcfc8ae7359346156e492ca610e830d2649ad6",
"status": "affected",
"version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
"versionType": "git"
},
{
"lessThan": "276c8efbc49f9303ac76d0d4deab7128581b0f3b",
"status": "affected",
"version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
"versionType": "git"
},
{
"lessThan": "fc65ffb4ef1bf540da16b17c225ae51091e07d72",
"status": "affected",
"version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
"versionType": "git"
},
{
"lessThan": "f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9",
"status": "affected",
"version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
"versionType": "git"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.32",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_ioctl() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_ioctl_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An attacker-controlled SMB server can deliver crafted SMB2 IOCTL responses over TCP, including through the kernel\u0027s periodic interface-query FSCTL on an existing SMB3 mount.\nAC:L - On a hard or retrans-enabled mount, the server controls replayable statuses, response contents, disconnects, reconnects, and repeated attempts, allowing it to drive both sides of the triggering sequence.\nPR:N - The malicious SMB server needs no account or privilege on the target; victim mounting authority and client authentication do not grant or require attacker-side target privileges.\nUI:N - Once the share is mounted, kernel delayed work can automatically issue the affected FSCTL when the server advertises multichannel support, requiring no user action during exploitation.\nS:U - The memory corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, container, or IOMMU boundary.\nC:H - The response-buffer double-free can corrupt SLUB or mempool state and create dangling or overlapping live buffers, enabling use-after-free exploitation and kernel-memory disclosure.\nI:H - Attacker-controlled network data can overwrite aliased or freed buffers and poison allocator state, supporting arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can trigger an allocator BUG or corrupt kernel heap state, causing an oops, panic, or complete system crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:37.258Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0be4bc64882edaefaaee8d1e27d083643eb778e6"
},
{
"url": "https://git.kernel.org/stable/c/96fcfc8ae7359346156e492ca610e830d2649ad6"
},
{
"url": "https://git.kernel.org/stable/c/276c8efbc49f9303ac76d0d4deab7128581b0f3b"
},
{
"url": "https://git.kernel.org/stable/c/fc65ffb4ef1bf540da16b17c225ae51091e07d72"
},
{
"url": "https://git.kernel.org/stable/c/f9bbadb6c94583e3b4af1afc449bfceb1d1ddec9"
}
],
"title": "smb: client: fix double-free in SMB2_ioctl() replay",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64385",
"datePublished": "2026-07-25T08:50:33.997Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-10-19T20:38:26.437Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74580 (GCVE-0-2026-74580)
Vulnerability from cvelistv5
Published
2026-08-21 16:31
Modified
2026-10-28 19:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vhost: reset the vring metadata cache on vring reconfiguration
vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring
metadata region, and iotlb_access_ok() returns early on a cache hit,
taking the hit as proof that the region has already been validated:
if (vhost_vq_meta_fetch(vq, addr, len, type))
return true;
The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on
device IOTLB (re)initialisation and on vq reset, but not when
VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when
VHOST_SET_VRING_NUM changes the region sizes.
With a device IOTLB attached both ioctls are accepted while the vq is
live, and neither validates the addresses at ioctl time: vq_access_ok()
and vq_log_used_access_ok() return true early because the addresses are
GIOVAs, deferring validation to prefetch time. Once the cache has been
populated that deferred validation no longer runs -- vq_meta_prefetch()
hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps
translating through the old mapping as
map->addr + addr - map->start
for an address the mapping no longer covers. vhost_copy_to_user() and
vhost_copy_from_user() consume the result with __copy_to_user() and
__copy_from_user(), which do not check it either, so a subsequent used
ring update or descriptor fetch accesses memory outside the region the
IOTLB actually maps.
Reset the metadata cache whenever the vring is reconfigured, so the new
addresses are pushed back through iotlb_access_ok()'s slow path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 Version: f889491380582b4ba2981cf0b0d7d6a40fb30ab7 |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-14T04:09:02.550Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/14/2"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74580",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T19:08:13.521018Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:08:17.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/YounesHfa/CVE-2026-74580"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vhost/vhost.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5224bd37e37d36076a550d99b2aebba33939fd95",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "54617e9119be2eb728ecdd8d977b99c99d4c498a",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "13fa6f32a56a386a82bd7451644c494beed034af",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "6fa3e9b1fe856259555a7e22f3f3082e7827fd9b",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "b70ebe0bba254e093dd5fd4c0c170941ce83eb85",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
},
{
"lessThan": "de845981da67a6b049080c87e605130b0c30adc5",
"status": "affected",
"version": "f889491380582b4ba2981cf0b0d7d6a40fb30ab7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vhost/vhost.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: reset the vring metadata cache on vring reconfiguration\n\nvq-\u003emeta_iotlb[] caches the vhost_iotlb_map that backs each vring\nmetadata region, and iotlb_access_ok() returns early on a cache hit,\ntaking the hit as proof that the region has already been validated:\n\n\tif (vhost_vq_meta_fetch(vq, addr, len, type))\n\t\treturn true;\n\nThe cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on\ndevice IOTLB (re)initialisation and on vq reset, but not when\nVHOST_SET_VRING_ADDR replaces vq-\u003edesc, vq-\u003eavail and vq-\u003eused, nor when\nVHOST_SET_VRING_NUM changes the region sizes.\n\nWith a device IOTLB attached both ioctls are accepted while the vq is\nlive, and neither validates the addresses at ioctl time: vq_access_ok()\nand vq_log_used_access_ok() return true early because the addresses are\nGIOVAs, deferring validation to prefetch time. Once the cache has been\npopulated that deferred validation no longer runs -- vq_meta_prefetch()\nhits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps\ntranslating through the old mapping as\n\n\tmap-\u003eaddr + addr - map-\u003estart\n\nfor an address the mapping no longer covers. vhost_copy_to_user() and\nvhost_copy_from_user() consume the result with __copy_to_user() and\n__copy_from_user(), which do not check it either, so a subsequent used\nring update or descriptor fetch accesses memory outside the region the\nIOTLB actually maps.\n\nReset the metadata cache whenever the vring is reconfigured, so the new\naddresses are pushed back through iotlb_access_ok()\u0027s slow path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires ioctl on /dev/vhost-net or /dev/vhost-vsock (VHOST_SET_OWNER, VHOST_SET_FEATURES with VIRTIO_F_ACCESS_PLATFORM, VHOST_SET_VRING_ADDR, IOTLB updates); although virtio kicks and network I/O trigger the corrupting copies, the stale-cache state is created only through local vhost character-device syscalls, not remote packets.\nAC:L - An attacker who controls the vhost owner process can deterministically populate meta_iotlb via normal virtqueue traffic, issue VHOST_SET_VRING_ADDR with new GIOVAs while the backend is live, then trigger descriptor/used-ring access; no races, special heap layout, or victim timing are required.\nPR:L - No host root is needed: exploitation is performed by the vhost device owner (standard libvirt/QEMU kvm-group account) or, in the highest-impact cloud scenario, an authorized malicious VM tenant whose virtio traffic drives vhost workers after QEMU updates live vring addresses under VIRTIO_F_ACCESS_PLATFORM.\nUI:N - No end-user or administrator action is required beyond routine automated VM operation (virtio I/O, vhost backend attachment, and vring setup) that the attacker or tenant controls directly.\nS:C - Stale IOTLB metadata translation makes the host kernel read/write outside the mapped vring regions in the VMM userspace address space (QEMU), crossing the guest-to-host virtualization boundary\u2014the same escape class as CVE-2025-38074, not mere in-guest kernel impact.\nC:H - vhost_copy_from_user and __vhost_get_user use vhost_vq_meta_fetch\u0027s stale map-\u003eaddr+addr-map-\u003estart translation without bounds checks, enabling out-of-bounds reads of adjacent VMM memory during descriptor and avail-ring fetches (arbitrary misdirected kernel reads from host userspace).\nI:H - vhost_copy_to_user and vhost_put_user write used-ring entries through the same stale translation, giving controlled out-of-bounds writes into the VMM process that can corrupt QEMU heap, IOTLB tables, or migration metadata for code-execution primitives.\nA:H - Misdirected __copy_to_user/__copy_from_user against unmapped or invalid VMM addresses can fault the vhost worker (host kernel oops/panic), and corrupting VMM control structures reliably crashes or kills the hypervisor process, terminating the VM."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:40:06.380Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5224bd37e37d36076a550d99b2aebba33939fd95"
},
{
"url": "https://git.kernel.org/stable/c/54617e9119be2eb728ecdd8d977b99c99d4c498a"
},
{
"url": "https://git.kernel.org/stable/c/13fa6f32a56a386a82bd7451644c494beed034af"
},
{
"url": "https://git.kernel.org/stable/c/cf363a7a02ce132ef1f58084fdb13e1a3b7da7e7"
},
{
"url": "https://git.kernel.org/stable/c/6fa3e9b1fe856259555a7e22f3f3082e7827fd9b"
},
{
"url": "https://git.kernel.org/stable/c/f1e21108e3ddfcce62f6cad4ebd7b5674543c9e6"
},
{
"url": "https://git.kernel.org/stable/c/b70ebe0bba254e093dd5fd4c0c170941ce83eb85"
},
{
"url": "https://git.kernel.org/stable/c/de845981da67a6b049080c87e605130b0c30adc5"
}
],
"title": "vhost: reset the vring metadata cache on vring reconfiguration",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74580",
"datePublished": "2026-08-21T16:31:54.076Z",
"dateReserved": "2026-08-15T05:44:03.918Z",
"dateUpdated": "2026-10-28T19:08:17.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68377 (GCVE-0-2026-68377)
Vulnerability from cvelistv5
Published
2026-08-10 12:03
Modified
2026-10-19 21:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_tunnel_key: Defer dst_release to RCU callback
Fix a race-condition use-after-free in tunnel_key_release_params().
The function releases the metadata_dst of the old params synchronously
via dst_release() while deferring the params struct free with
kfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may
still hold the old params pointer (under rcu_read_lock_bh) and proceed
to call dst_clone(¶ms->tcft_enc_metadata->dst) after the writer's
dst_release has already pushed the dst's rcuref to RCUREF_DEAD.
zdi-disclosures@trendmicro.com produced a poc which i (and Victor) verified
that KASAN reports:
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112
BUG: KASAN: slab-use-after-free in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326
BUG: KASAN: slab-use-after-free in __rcuref_put include/linux/rcuref.h:109
BUG: KASAN: slab-use-after-free in rcuref_put include/linux/rcuref.h:173
BUG: KASAN: slab-use-after-free in dst_release+0x5b/0x370 net/core/dst.c:168
Write of size 4 at addr ffff88806158de40 by task poc/9388
CPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy)
Tainted: [W]=WARN
Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378
print_report+0x139/0x4ad mm/kasan/report.c:482
kasan_report+0xe4/0x1d0 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:186
kasan_check_range+0x125/0x200 mm/kasan/generic.c:200
instrument_atomic_read_write include/linux/instrumented.h:112
atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326
__rcuref_put include/linux/rcuref.h:109
rcuref_put include/linux/rcuref.h:173
dst_release+0x5b/0x370 net/core/dst.c:168
refdst_drop include/net/dst.h:272
skb_dst_drop include/net/dst.h:284
skb_release_head_state+0x293/0x400 net/core/skbuff.c:1163
skb_release_all net/core/skbuff.c:1187
[..]
Allocated by task 9391:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398
__kasan_kmalloc+0x9a/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263
__do_kmalloc_node mm/slub.c:5296
__kmalloc_noprof+0x2f1/0x830 mm/slub.c:5308
kmalloc_noprof include/linux/slab.h:954
kzalloc_noprof include/linux/slab.h:1188
offload_action_alloc+0x2f/0x130 net/core/flow_offload.c:35
tcf_action_offload_add_ex+0x1ba/0x880 net/sched/act_api.c:258
tcf_action_offload_add net/sched/act_api.c:293
tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547
tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101
[..]
Freed by task 9391:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253
__kasan_slab_free+0x6b/0x90 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235
slab_free_hook mm/slub.c:2689
slab_free mm/slub.c:6251
kfree+0x21f/0x6b0 mm/slub.c:6566
tcf_action_offload_add_ex+0x4ad/0x880 net/sched/act_api.c:284
tcf_action_offload_add net/sched/act_api.c:293
tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547
tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101
The buggy address belongs to the object at ffff88806158de00
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 64 bytes inside of
freed 256-byte region [ffff88806158de00, ffff88806158df00)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c
head: order:1 mapcount:0 entire_map
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9174c3df1cd181c14913138d50ccbe539bb08335 Version: 9174c3df1cd181c14913138d50ccbe539bb08335 Version: 9174c3df1cd181c14913138d50ccbe539bb08335 Version: 9174c3df1cd181c14913138d50ccbe539bb08335 Version: 9174c3df1cd181c14913138d50ccbe539bb08335 Version: 9174c3df1cd181c14913138d50ccbe539bb08335 Version: 9174c3df1cd181c14913138d50ccbe539bb08335 Version: 9174c3df1cd181c14913138d50ccbe539bb08335 Version: 02239e797ac75f89a05622a27d04695f08c1ca89 Version: ca9b7a65a2c97579fcdd509d454d48e3a5c49af8 Version: 4.19.19 ≤ Version: 4.20.6 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68377",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:47:38.441696Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:06.777Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/act_tunnel_key.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b5931f020b681fdcb9378262d89b61cb3c7ebbf8",
"status": "affected",
"version": "9174c3df1cd181c14913138d50ccbe539bb08335",
"versionType": "git"
},
{
"lessThan": "389d03992dabb80488228e8119b9dd6d0f58e1a6",
"status": "affected",
"version": "9174c3df1cd181c14913138d50ccbe539bb08335",
"versionType": "git"
},
{
"lessThan": "676ad6aa7cec89a08d2a5ce3cd5959e313f29733",
"status": "affected",
"version": "9174c3df1cd181c14913138d50ccbe539bb08335",
"versionType": "git"
},
{
"lessThan": "531dbb5bb98e52ad26be7e90f9f8bec707c5bd0e",
"status": "affected",
"version": "9174c3df1cd181c14913138d50ccbe539bb08335",
"versionType": "git"
},
{
"lessThan": "2200a00ff247f70f5dcdb4e6f14b0d48ddac5467",
"status": "affected",
"version": "9174c3df1cd181c14913138d50ccbe539bb08335",
"versionType": "git"
},
{
"lessThan": "fed1b1ddab41a0e7a462ac690a0c8af6ff793624",
"status": "affected",
"version": "9174c3df1cd181c14913138d50ccbe539bb08335",
"versionType": "git"
},
{
"lessThan": "2791a501da508b704a617b4dba29db54a65bc9f7",
"status": "affected",
"version": "9174c3df1cd181c14913138d50ccbe539bb08335",
"versionType": "git"
},
{
"lessThan": "f1f5c8a3955f8fda3f84ed883ac8daa1847e724c",
"status": "affected",
"version": "9174c3df1cd181c14913138d50ccbe539bb08335",
"versionType": "git"
},
{
"status": "affected",
"version": "02239e797ac75f89a05622a27d04695f08c1ca89",
"versionType": "git"
},
{
"status": "affected",
"version": "ca9b7a65a2c97579fcdd509d454d48e3a5c49af8",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.19",
"versionType": "semver"
},
{
"lessThan": "4.21",
"status": "affected",
"version": "4.20.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/act_tunnel_key.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.20.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_tunnel_key: Defer dst_release to RCU callback\n\nFix a race-condition use-after-free in tunnel_key_release_params().\n\nThe function releases the metadata_dst of the old params synchronously\nvia dst_release() while deferring the params struct free with\nkfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may\nstill hold the old params pointer (under rcu_read_lock_bh) and proceed\nto call dst_clone(\u0026params-\u003etcft_enc_metadata-\u003edst) after the writer\u0027s\ndst_release has already pushed the dst\u0027s rcuref to RCUREF_DEAD.\n\nzdi-disclosures@trendmicro.com produced a poc which i (and Victor) verified\nthat KASAN reports:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112\nBUG: KASAN: slab-use-after-free in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326\nBUG: KASAN: slab-use-after-free in __rcuref_put include/linux/rcuref.h:109\nBUG: KASAN: slab-use-after-free in rcuref_put include/linux/rcuref.h:173\nBUG: KASAN: slab-use-after-free in dst_release+0x5b/0x370 net/core/dst.c:168\nWrite of size 4 at addr ffff88806158de40 by task poc/9388\n\nCPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy)\nTainted: [W]=WARN\nHardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94\n dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378\n print_report+0x139/0x4ad mm/kasan/report.c:482\n kasan_report+0xe4/0x1d0 mm/kasan/report.c:595\n check_region_inline mm/kasan/generic.c:186\n kasan_check_range+0x125/0x200 mm/kasan/generic.c:200\n instrument_atomic_read_write include/linux/instrumented.h:112\n atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326\n __rcuref_put include/linux/rcuref.h:109\n rcuref_put include/linux/rcuref.h:173\n dst_release+0x5b/0x370 net/core/dst.c:168\n refdst_drop include/net/dst.h:272\n skb_dst_drop include/net/dst.h:284\n skb_release_head_state+0x293/0x400 net/core/skbuff.c:1163\n skb_release_all net/core/skbuff.c:1187\n[..]\nAllocated by task 9391:\n kasan_save_stack+0x30/0x50 mm/kasan/common.c:57\n kasan_save_track+0x14/0x30 mm/kasan/common.c:78\n poison_kmalloc_redzone mm/kasan/common.c:398\n __kasan_kmalloc+0x9a/0xb0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263\n __do_kmalloc_node mm/slub.c:5296\n __kmalloc_noprof+0x2f1/0x830 mm/slub.c:5308\n kmalloc_noprof include/linux/slab.h:954\n kzalloc_noprof include/linux/slab.h:1188\n offload_action_alloc+0x2f/0x130 net/core/flow_offload.c:35\n tcf_action_offload_add_ex+0x1ba/0x880 net/sched/act_api.c:258\n tcf_action_offload_add net/sched/act_api.c:293\n tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547\n tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101\n[..]\nFreed by task 9391:\n kasan_save_stack+0x30/0x50 mm/kasan/common.c:57\n kasan_save_track+0x14/0x30 mm/kasan/common.c:78\n kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584\n poison_slab_object mm/kasan/common.c:253\n __kasan_slab_free+0x6b/0x90 mm/kasan/common.c:285\n kasan_slab_free include/linux/kasan.h:235\n slab_free_hook mm/slub.c:2689\n slab_free mm/slub.c:6251\n kfree+0x21f/0x6b0 mm/slub.c:6566\n tcf_action_offload_add_ex+0x4ad/0x880 net/sched/act_api.c:284\n tcf_action_offload_add net/sched/act_api.c:293\n tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547\n tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101\n\nThe buggy address belongs to the object at ffff88806158de00\n which belongs to the cache kmalloc-256 of size 256\nThe buggy address is located 64 bytes inside of\n freed 256-byte region [ffff88806158de00, ffff88806158df00)\n\nThe buggy address belongs to the physical page:\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c\nhead: order:1 mapcount:0 entire_map\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable window is opened via the tc/rtnetlink RTM_NEWACTION path (`tc action replace ... tunnel_key set`) and closed by locally generated traffic through a clsact/ingress filter, both requiring local system access rather than remote packets.\nAC:L - The attacker controls both sides of the race \u2014 one thread repeatedly replaces the tunnel_key action while another pumps packets through the filter \u2014 and can widen the window with qdisc backlog, so the UAF is reliably reproducible (a ZDI PoC reproduced it under KASAN).\nPR:L - The action-add path is gated only by netlink_capable(skb, CAP_NET_ADMIN), which is namespace-relative and obtainable by any unprivileged user via `unshare -Urn`; the packet side runs in the attacker\u0027s own netns.\nUI:N - Both the netlink action replace and the packet transmission that dereferences the stale params are performed entirely by the attacker\u0027s own processes; no victim action is involved.\nS:U - The corruption is confined to kernel heap memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed metadata_dst sits in the general-purpose kmalloc-256 cache and remains attached to an skb, so tx paths read tunnel metadata out of reclaimed memory, giving an attacker who sprays the slab a route to disclose kernel data and defeat KASLR.\nI:H - The stale dst_clone/skb_dst_drop pair performs atomic 4-byte read-modify-write operations on a freed, attacker-reclaimable slab object, yielding a refcount-corruption primitive that is a well-established stepping stone to arbitrary write and privilege escalation.\nA:H - The use-after-free reliably corrupts slab memory and triggers KASAN-reported faults; unmitigated it causes kernel oops or panic, and the race can be repeated at will by an unprivileged user."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:34:38.220Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b5931f020b681fdcb9378262d89b61cb3c7ebbf8"
},
{
"url": "https://git.kernel.org/stable/c/389d03992dabb80488228e8119b9dd6d0f58e1a6"
},
{
"url": "https://git.kernel.org/stable/c/676ad6aa7cec89a08d2a5ce3cd5959e313f29733"
},
{
"url": "https://git.kernel.org/stable/c/531dbb5bb98e52ad26be7e90f9f8bec707c5bd0e"
},
{
"url": "https://git.kernel.org/stable/c/2200a00ff247f70f5dcdb4e6f14b0d48ddac5467"
},
{
"url": "https://git.kernel.org/stable/c/fed1b1ddab41a0e7a462ac690a0c8af6ff793624"
},
{
"url": "https://git.kernel.org/stable/c/2791a501da508b704a617b4dba29db54a65bc9f7"
},
{
"url": "https://git.kernel.org/stable/c/f1f5c8a3955f8fda3f84ed883ac8daa1847e724c"
}
],
"title": "net/sched: act_tunnel_key: Defer dst_release to RCU callback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68377",
"datePublished": "2026-08-10T12:03:55.643Z",
"dateReserved": "2026-07-30T09:28:09.386Z",
"dateUpdated": "2026-10-19T21:09:06.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80521 (GCVE-0-2026-80521)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-10-03 10:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Unlink scc_entry in unix_del_edge().
Kyle Zeng reported that GC could free a dead SCC partially.
The scenario is as follows:
1) Create two SCCs:
X -. A <-> B
^--'
2) Run the following concurrently:
2-1) send() sk-B to sk-B from sk-X
2-2) close() both A and B
At 2-1), there is a small window where unix_add_edges()
publishes a new edge (B <-> B) to GC but its skb is not queued
by skb_queue_tail().
If 2-2) completes before skb_queue_tail() and GC is triggered,
it judges A <-> B as dead, but B is not freed because GC cannot
collect the not-yet-queued skb holding the B <-> B edge.
X -. A <-> B -. This edge is visible
^--' ^..' but skb is not
This itself is not a problem since the next GC run will judge
B as dead as well and free it finally.
X -. A <.> B -.
^--' ^--'
However, X's SCC forces the next GC to call unix_walk_scc_fast(),
and it iterates over A through B's scc_entry.
Let's unlink scc_entry before freeing the vertex in unix_del_edge().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a Version: de7921631ff323369aa63a4324695ab54ea4047e Version: 4090fa373f0e763c43610853d2774b5979915959 Version: 4090fa373f0e763c43610853d2774b5979915959 Version: 4090fa373f0e763c43610853d2774b5979915959 Version: 4090fa373f0e763c43610853d2774b5979915959 Version: 6.1.141 ≤ Version: 6.6.93 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/unix/garbage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2b6c2842692d08e7acaf32d1eb47f95def35f3fe",
"status": "affected",
"version": "5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a",
"versionType": "git"
},
{
"lessThan": "6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33",
"status": "affected",
"version": "de7921631ff323369aa63a4324695ab54ea4047e",
"versionType": "git"
},
{
"lessThan": "1293fd69a50d188a5788b08ba3741a3e86be1608",
"status": "affected",
"version": "4090fa373f0e763c43610853d2774b5979915959",
"versionType": "git"
},
{
"lessThan": "fe198b077864feafd4aa4b33b1a5ce26f50195a2",
"status": "affected",
"version": "4090fa373f0e763c43610853d2774b5979915959",
"versionType": "git"
},
{
"lessThan": "e3702470ced94fad74d71e2232f022d2eb752a6d",
"status": "affected",
"version": "4090fa373f0e763c43610853d2774b5979915959",
"versionType": "git"
},
{
"lessThan": "594d905195024b228c962627ae5ae7c17bd582a4",
"status": "affected",
"version": "4090fa373f0e763c43610853d2774b5979915959",
"versionType": "git"
},
{
"lessThan": "6.1.189",
"status": "affected",
"version": "6.1.141",
"versionType": "semver"
},
{
"lessThan": "6.6.158",
"status": "affected",
"version": "6.6.93",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/unix/garbage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "6.1.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.6.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Unlink scc_entry in unix_del_edge().\n\nKyle Zeng reported that GC could free a dead SCC partially.\n\nThe scenario is as follows:\n\n 1) Create two SCCs:\n\n X -. A \u003c-\u003e B\n ^--\u0027\n\n 2) Run the following concurrently:\n\n 2-1) send() sk-B to sk-B from sk-X\n 2-2) close() both A and B\n\nAt 2-1), there is a small window where unix_add_edges()\npublishes a new edge (B \u003c-\u003e B) to GC but its skb is not queued\nby skb_queue_tail().\n\nIf 2-2) completes before skb_queue_tail() and GC is triggered,\nit judges A \u003c-\u003e B as dead, but B is not freed because GC cannot\ncollect the not-yet-queued skb holding the B \u003c-\u003e B edge.\n\n X -. A \u003c-\u003e B -. This edge is visible\n ^--\u0027 ^..\u0027 but skb is not\n\nThis itself is not a problem since the next GC run will judge\nB as dead as well and free it finally.\n\n X -. A \u003c.\u003e B -.\n ^--\u0027 ^--\u0027\n\nHowever, X\u0027s SCC forces the next GC to call unix_walk_scc_fast(),\nand it iterates over A through B\u0027s scc_entry.\n\nLet\u0027s unlink scc_entry before freeing the vertex in unix_del_edge()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is only reachable through local AF_UNIX syscalls (socket/sendmsg with SCM_RIGHTS and close) that drive unix_add_edges(), unix_del_edge(), and unix_gc(); AF_UNIX is host-local IPC with no remote packet, Bluetooth, WiFi, or physical bus entry path.\nAC:L - Exploitation requires racing sendmsg() (scm_stat_add/unix_add_edges before skb_queue_tail) against concurrent close() that triggers GC; the attacker controls both threads, can pin CPUs, and can retry until the window is hit, so success does not depend on conditions outside attacker control.\nPR:L - An unprivileged local user can create AF_UNIX sockets, pass socket file descriptors via SCM_RIGHTS to form inflight reference cycles, and close sockets to schedule unix_gc(); no real-root capabilities, special namespaces, or non-default kernel configuration are required.\nUI:N - The attacker sets up the cyclic inflight graph, performs the concurrent self-send and close operations, and forces garbage collection from its own processes; no separate victim user action or cooperating peer is needed beyond the attacker\u0027s own sockets.\nS:U - The use-after-free corrupts kernel heap/list state during AF_UNIX garbage collection within the same kernel security authority; exploitation yields standard local privilege escalation rather than crossing a VM, IOMMU, or inter-tenant sandbox boundary.\nC:H - Freed struct unix_vertex objects remain linked through stale scc_entry; unix_walk_scc_fast(), unix_scc_dead(), and unix_collect_skb() dereference freed vertex-\u003eedges and predecessor socket receive queues, giving a slab UAF read primitive controllable through heap grooming.\nI:H - The same UAF enables reclaiming freed vertices and influencing GC list iteration and skb_queue_splice_init() during unix_collect_skb(), providing memory corruption primitives suitable for arbitrary kernel writes, control-flow hijack, and local privilege escalation.\nA:H - Iterating or collecting through a freed vertex reliably triggers kernel oops/panic (KASAN slab-use-after-free), and corrupt GC graph state can crash the host or deny service to local workloads even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T10:56:06.656Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2b6c2842692d08e7acaf32d1eb47f95def35f3fe"
},
{
"url": "https://git.kernel.org/stable/c/6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33"
},
{
"url": "https://git.kernel.org/stable/c/1293fd69a50d188a5788b08ba3741a3e86be1608"
},
{
"url": "https://git.kernel.org/stable/c/fe198b077864feafd4aa4b33b1a5ce26f50195a2"
},
{
"url": "https://git.kernel.org/stable/c/e3702470ced94fad74d71e2232f022d2eb752a6d"
},
{
"url": "https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4"
}
],
"title": "af_unix: Unlink scc_entry in unix_del_edge().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80521",
"datePublished": "2026-08-26T14:37:02.589Z",
"dateReserved": "2026-08-26T14:34:25.763Z",
"dateUpdated": "2026-10-03T10:56:06.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64030 (GCVE-0-2026-64030)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted
from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15.
sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14),
making index 15 out-of-bounds.
A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response
action frame with a PER_STA_PROFILE subelement where link_id = 15. The
unsolicited-notification path (dialog_token = 0) is reachable any time
EPCS is already enabled, without any prior client request.
sdata->link[15] reads into the first word of sdata->activate_links_work
(a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD),
so the NULL check on the result does not catch the invalid access. The
garbage pointer is then passed to ieee80211_sta_wmm_params(), which
dereferences link->sdata and crashes the kernel.
The same class of bug was fixed for ieee80211_ml_reconfiguration() by
commit 162d331d833d ("wifi: mac80211: bounds-check link_id in
ieee80211_ml_reconfiguration").
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64030",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:37.195700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:09.581Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2d8379834800c30602f24c71ab7c40f5fe84d200",
"status": "affected",
"version": "de86c5f60839dc0d771711a848b4f55ad3f90844",
"versionType": "git"
},
{
"lessThan": "863f1f02a3bd70dbd857b8ac4070292fde8cb4e2",
"status": "affected",
"version": "de86c5f60839dc0d771711a848b4f55ad3f90844",
"versionType": "git"
},
{
"lessThan": "f718506edd2d9c6a308ded9d13c632bf7b7d5a2c",
"status": "affected",
"version": "de86c5f60839dc0d771711a848b4f55ad3f90844",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: bounds-check link_id in ieee80211_ml_epcs\n\nIEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted\nfrom a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15.\nsdata-\u003elink[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14),\nmaking index 15 out-of-bounds.\n\nA connected WiFi 7 AP can trigger this by sending an EPCS Enable Response\naction frame with a PER_STA_PROFILE subelement where link_id = 15. The\nunsolicited-notification path (dialog_token = 0) is reachable any time\nEPCS is already enabled, without any prior client request.\n\nsdata-\u003elink[15] reads into the first word of sdata-\u003eactivate_links_work\n(a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD),\nso the NULL check on the result does not catch the invalid access. The\ngarbage pointer is then passed to ieee80211_sta_wmm_params(), which\ndereferences link-\u003esdata and crashes the kernel.\n\nThe same class of bug was fixed for ieee80211_ml_reconfiguration() by\ncommit 162d331d833d (\"wifi: mac80211: bounds-check link_id in\nieee80211_ml_reconfiguration\")."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - A malicious or compromised WiFi 7 AP transmits a crafted EPCS Enable Response action frame over the wireless link; exploitation requires proximity on the same WiFi segment, not remote internet reachability.\nAC:L - Once a victim WiFi 7 MLD station is associated with an EPCS-capable AP, the attacker reliably triggers the bug by setting link_id=15 in a PER_STA_PROFILE subelement, including via the unsolicited notification path (dialog_token=0) when EPCS is already enabled.\nPR:N - The attacker acts as the associated AP sending forged management frames and needs no local privileges, accounts, or capabilities on the victim system.\nUI:N - After association and EPCS enablement, the kernel processes the malicious frame automatically with no further victim action required at exploit time.\nS:U - Impact is confined to kernel memory corruption and crash on the victim station; it does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - Out-of-bounds read of sdata-\u003elink[15] pulls a kernel pointer from adjacent sdata-\u003eactivate_links_work memory, and the resulting bogus pointer is dereferenced as ieee80211_link_data, constituting an unbounded kernel memory read primitive.\nI:H - The out-of-bounds pointer is used as a valid ieee80211_link_data structure; if execution proceeds past the initial dereference, _ieee80211_sta_wmm_params() can write to link-\u003etx_conf[] at incorrect offsets, enabling potential kernel memory corruption beyond a simple fault.\nA:H - The invalid pointer dereference in ieee80211_sta_wmm_params() causes a kernel oops/panic, resulting in complete loss of availability for the victim system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:24.204Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2d8379834800c30602f24c71ab7c40f5fe84d200"
},
{
"url": "https://git.kernel.org/stable/c/863f1f02a3bd70dbd857b8ac4070292fde8cb4e2"
},
{
"url": "https://git.kernel.org/stable/c/f718506edd2d9c6a308ded9d13c632bf7b7d5a2c"
}
],
"title": "wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64030",
"datePublished": "2026-07-19T15:39:20.982Z",
"dateReserved": "2026-07-19T07:54:57.028Z",
"dateUpdated": "2026-10-19T20:28:09.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68426 (GCVE-0-2026-68426)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix stale skb->prev after async crypto steals a GSO segment
skb_gso_segment() leaves the segment list head with ->prev pointing at
the last segment, an invariant validate_xmit_skb_list() relies on when
it sets its tail pointer (tail = skb->prev).
When validate_xmit_xfrm() walks a GSO list and some segments are stolen
by async crypto (->xmit() returns -EINPROGRESS), those segments are
unlinked from the list but the head ->prev is never updated. If the
last segment is the one stolen, the returned head still has ->prev
pointing at it, even though it is now owned by the crypto engine and may
be freed. validate_xmit_skb_list() later does tail->next = skb, writing
through that stale pointer -- a use-after-free.
Repoint skb->prev at the last retained segment before returning.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:46.371818Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:09.834Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4927ab8a8acc8db4fad33e803d1d35e0b16cef83",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "b58731e0570bfd3989999fc2baf9ee4fecd5bec6",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "33e1b0d25ca0d2818c635ff80e6aa0d295e08a98",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "bbca7cc3b2b4b10afbfee99b81d9ee78f5423046",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
},
{
"lessThan": "3f4c3919baf0944ad96580467c302bc6c7758b00",
"status": "affected",
"version": "f53c723902d1ac5f0b0a11d7c9dcbff748dde74e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment\n\nskb_gso_segment() leaves the segment list head with -\u003eprev pointing at\nthe last segment, an invariant validate_xmit_skb_list() relies on when\nit sets its tail pointer (tail = skb-\u003eprev).\n\nWhen validate_xmit_xfrm() walks a GSO list and some segments are stolen\nby async crypto (-\u003exmit() returns -EINPROGRESS), those segments are\nunlinked from the list but the head -\u003eprev is never updated. If the\nlast segment is the one stolen, the returned head still has -\u003eprev\npointing at it, even though it is now owned by the crypto engine and may\nbe freed. validate_xmit_skb_list() later does tail-\u003enext = skb, writing\nthrough that stale pointer -- a use-after-free.\n\nRepoint skb-\u003eprev at the last retained segment before returning."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the IPsec transmit path (validate_xmit_xfrm) which processes any skb routed into an offloaded SA, including GRO-aggregated traffic forwarded from remote hosts on an IPsec gateway; xfrm_dev_offload_ok() has no socket/local-origin requirement, so a remote peer\u0027s packet stream drives the vulnerable GSO segmentation and async-crypto steal directly.\nAC:L - The attacker drives both preconditions with traffic alone: sustained large GSO flows keep the crypto engine backlogged so -\u003exmit() returns -EINPROGRESS routinely, and packet volume advances xo-\u003eseq.low toward the wrap that forces segmentation; each stolen trailing segment reproduces the stale skb-\u003eprev, and the subsequent tail-\u003enext write is deterministic once it occurs.\nPR:N - On an IPsec gateway the traffic that triggers the path is forwarded from remote, unauthenticated senders \u2014 no account, credentials, or capability on the target host is needed, since the SA and offload are pre-existing administrative configuration rather than something the attacker must set up.\nUI:N - No victim action is required; the vulnerable code runs automatically in softirq context on every qualifying transmit, driven purely by the attacker\u0027s packet stream.\nS:U - The corruption is of kernel sk_buff list state within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Writing through the stale -\u003eprev is a use-after-free on an skb whose memory the attacker can influence via heap grooming with concurrent traffic; per kernel UAF guidance this yields a high-confidentiality primitive, and the corrupted list can splice engine-owned skbs into the transmit path, exposing freed/reused memory contents on the wire.\nI:H - tail-\u003enext = skb is an attacker-influenced pointer write into freed heap memory, and the resulting skb list corruption lets live and engine-owned skbs be chained together; this is classic heap corruption that can be shaped via spraying into an arbitrary write or control-flow hijack.\nA:H - Even without full exploitation the use-after-free write and the double-ownership of a stolen segment cause list corruption, double-free/oops and kernel panic in the softirq transmit path, taking down the gateway."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:07.204Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4927ab8a8acc8db4fad33e803d1d35e0b16cef83"
},
{
"url": "https://git.kernel.org/stable/c/b58731e0570bfd3989999fc2baf9ee4fecd5bec6"
},
{
"url": "https://git.kernel.org/stable/c/33e1b0d25ca0d2818c635ff80e6aa0d295e08a98"
},
{
"url": "https://git.kernel.org/stable/c/bbca7cc3b2b4b10afbfee99b81d9ee78f5423046"
},
{
"url": "https://git.kernel.org/stable/c/3f4c3919baf0944ad96580467c302bc6c7758b00"
}
],
"title": "xfrm: fix stale skb-\u003eprev after async crypto steals a GSO segment",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68426",
"datePublished": "2026-08-10T12:04:46.945Z",
"dateReserved": "2026-07-30T09:28:09.392Z",
"dateUpdated": "2026-10-21T12:44:07.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63925 (GCVE-0-2026-63925)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-19 20:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
macsec: fix replay protection at XPN lower-PN wrap
In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0
and the first branch never fires. If next_pn_halves.lower is also in the
upper half, pn_same_half(pn, lower) is true and the XPN else-if does not
fire either, leaving next_pn_halves unchanged. An attacker that captures
the legitimate frame carrying pn == 0xFFFFFFFF on an XPN association
can then replay it indefinitely, since lowest_pn never rises above
the captured pn and macsec_decrypt() reconstructs the same IV.
Extend the XPN else-if to also fire when pn + 1 wraps to 0, so receipt
of pn == U32_MAX advances next_pn_halves to (upper + 1, 0).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a21ecf0e033807b976967286e6c392f48ee2049f Version: a21ecf0e033807b976967286e6c392f48ee2049f Version: a21ecf0e033807b976967286e6c392f48ee2049f Version: a21ecf0e033807b976967286e6c392f48ee2049f Version: a21ecf0e033807b976967286e6c392f48ee2049f Version: a21ecf0e033807b976967286e6c392f48ee2049f Version: a21ecf0e033807b976967286e6c392f48ee2049f Version: a21ecf0e033807b976967286e6c392f48ee2049f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63925",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:33:35.580266Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:57.078Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/macsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dd7306779c6ce1238f4cdc34f3c1f2246b854457",
"status": "affected",
"version": "a21ecf0e033807b976967286e6c392f48ee2049f",
"versionType": "git"
},
{
"lessThan": "d15130461df388136b62a7b0ce9f66e7e2fa9ff1",
"status": "affected",
"version": "a21ecf0e033807b976967286e6c392f48ee2049f",
"versionType": "git"
},
{
"lessThan": "23c0e230eab397d7f68be2538790ac41d3bb91fd",
"status": "affected",
"version": "a21ecf0e033807b976967286e6c392f48ee2049f",
"versionType": "git"
},
{
"lessThan": "679e13a65e68a67c8b3c0467c02ee89157ec6f0f",
"status": "affected",
"version": "a21ecf0e033807b976967286e6c392f48ee2049f",
"versionType": "git"
},
{
"lessThan": "79495a1b0944fe31ffd54b54b00211b493590d62",
"status": "affected",
"version": "a21ecf0e033807b976967286e6c392f48ee2049f",
"versionType": "git"
},
{
"lessThan": "6d00f5c7e5ff7ec4795b7f5f8ed88bd346641652",
"status": "affected",
"version": "a21ecf0e033807b976967286e6c392f48ee2049f",
"versionType": "git"
},
{
"lessThan": "d55acbe577db892b60547b6ef1c020b359331a6d",
"status": "affected",
"version": "a21ecf0e033807b976967286e6c392f48ee2049f",
"versionType": "git"
},
{
"lessThan": "e68842b3356471ba56c882209f324613dac47f64",
"status": "affected",
"version": "a21ecf0e033807b976967286e6c392f48ee2049f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/macsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacsec: fix replay protection at XPN lower-PN wrap\n\nIn macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0\nand the first branch never fires. If next_pn_halves.lower is also in the\nupper half, pn_same_half(pn, lower) is true and the XPN else-if does not\nfire either, leaving next_pn_halves unchanged. An attacker that captures\nthe legitimate frame carrying pn == 0xFFFFFFFF on an XPN association\ncan then replay it indefinitely, since lowest_pn never rises above\nthe captured pn and macsec_decrypt() reconstructs the same IV.\n\nExtend the XPN else-if to also fire when pn + 1 wraps to 0, so receipt\nof pn == U32_MAX advances next_pn_halves to (upper + 1, 0)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - MACsec processes attacker-supplied Ethernet frames via netdev rx_handler on the underlying link; exploitation requires L2 adjacency on the same broadcast domain or point-to-point MACsec link, not remote Internet reachability.\nAC:L - Once XPN with replay protection is deployed, an on-link attacker can passively capture the single legitimate frame at PN 0xFFFFFFFF and then replay it reliably and indefinitely without races or conditions outside their control.\nPR:N - Exploitation requires only the ability to send or replay Ethernet frames on the MACsec link; no local privileges, capabilities, or authentication on the victim Linux host are needed.\nUI:N - Replay injection is fully attacker-driven after capturing the target frame; no victim user or administrator action is required during exploitation.\nS:U - The flaw bypasses MACsec replay protection within the kernel network stack and does not cross a security boundary such as a VM, container, or IOMMU isolation domain.\nC:N - This is a replay-protection logic flaw, not a memory corruption or decryption weakness; the attacker replays already-captured ciphertext and gains no new confidentiality beyond what passive capture already provided.\nI:H - Bypassing replay protection allows unlimited re-injection of previously authenticated payloads into the controlled port, defeating MACsec\u0027s integrity guarantees and enabling repeated delivery of captured control or data traffic on automotive, industrial, and datacenter MACsec links.\nA:H - The commit confirms captured frames can be replayed indefinitely, enabling sustained injection of decrypted traffic that can overwhelm the receiver and deny service to legitimate peers on the protected link."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:20.197Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dd7306779c6ce1238f4cdc34f3c1f2246b854457"
},
{
"url": "https://git.kernel.org/stable/c/d15130461df388136b62a7b0ce9f66e7e2fa9ff1"
},
{
"url": "https://git.kernel.org/stable/c/23c0e230eab397d7f68be2538790ac41d3bb91fd"
},
{
"url": "https://git.kernel.org/stable/c/679e13a65e68a67c8b3c0467c02ee89157ec6f0f"
},
{
"url": "https://git.kernel.org/stable/c/79495a1b0944fe31ffd54b54b00211b493590d62"
},
{
"url": "https://git.kernel.org/stable/c/6d00f5c7e5ff7ec4795b7f5f8ed88bd346641652"
},
{
"url": "https://git.kernel.org/stable/c/d55acbe577db892b60547b6ef1c020b359331a6d"
},
{
"url": "https://git.kernel.org/stable/c/e68842b3356471ba56c882209f324613dac47f64"
}
],
"title": "macsec: fix replay protection at XPN lower-PN wrap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63925",
"datePublished": "2026-07-19T14:55:26.442Z",
"dateReserved": "2026-07-19T07:54:57.021Z",
"dateUpdated": "2026-10-19T20:17:57.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53239 (GCVE-0-2026-53239)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-10-19 19:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
Fix the race by pruning the bin while still holding xfrm_policy_lock,
before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since
the lock is already held. The wrapper xfrm_policy_inexact_prune_bin()
becomes unused and is removed.
Race:
CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO)
========================== ==========================
xfrm_policy_bysel_ctx():
spin_lock_bh(xfrm_policy_lock)
bin = xfrm_policy_inexact_lookup()
__xfrm_policy_unlink(pol)
spin_unlock_bh(xfrm_policy_lock)
xfrm_policy_kill(ret)
// wide window, lock not held
xfrm_hash_rebuild():
spin_lock_bh(xfrm_policy_lock)
__xfrm_policy_inexact_flush():
kfree_rcu(bin) // bin freed
spin_unlock_bh(xfrm_policy_lock)
xfrm_policy_inexact_prune_bin(bin)
// UAF: bin is freed
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:22:55.050Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:27:30.875032Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:57:30.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8fc536e9f6856230f19c7d13e71af064b6a77b22",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "c4c1ea36d83bf3c4569468ca5b8b614fda1bf821",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "25c8c7fb3b0b9668c7d05e209f58c158d2b020c7",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "42827d03f8009a6a218bacab153e21f39d6a121c",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "88697cf980222d5906a37bf47662dac0732e2a0f",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "b5316e2b8614a87d8736941972441cb47bfd4491",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "ec82ea4eb220164d854f8734ca5a35e23e577b94",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "7f2d76c9c03257c0782afef9d95321fa04096f60",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n\nFix the race by pruning the bin while still holding xfrm_policy_lock,\nbefore dropping it. Use __xfrm_policy_inexact_prune_bin() directly since\nthe lock is already held. The wrapper xfrm_policy_inexact_prune_bin()\nbecomes unused and is removed.\n\nRace:\n\n CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO)\n ========================== ==========================\n xfrm_policy_bysel_ctx():\n spin_lock_bh(xfrm_policy_lock)\n bin = xfrm_policy_inexact_lookup()\n __xfrm_policy_unlink(pol)\n spin_unlock_bh(xfrm_policy_lock)\n xfrm_policy_kill(ret)\n // wide window, lock not held\n xfrm_hash_rebuild():\n spin_lock_bh(xfrm_policy_lock)\n __xfrm_policy_inexact_flush():\n kfree_rcu(bin) // bin freed\n spin_unlock_bh(xfrm_policy_lock)\n xfrm_policy_inexact_prune_bin(bin)\n // UAF: bin is freed"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through NETLINK_XFRM messages such as XFRM_MSG_DELPOLICY and XFRM_MSG_NEWSPDINFO, which require local netlink access rather than remote packet delivery.\nAC:L - The attacker controls both sides of the race by creating/deleting an inexact XFRM policy while concurrently triggering SPD hash rebuilds, with no required external victim state.\nPR:L - XFRM netlink operations require CAP_NET_ADMIN, but the check is namespace-scoped via netlink_net_capable() and is reachable with CAP_NET_ADMIN in a user-created network namespace on systems allowing user namespaces.\nUI:N - No victim action is required; the attacker can issue the needed netlink messages directly.\nS:U - The vulnerability corrupts kernel networking/XFRM state within the same kernel security authority and does not cross a hypervisor, IOMMU, or separate trust boundary.\nC:H - This is a use-after-free of an XFRM inexact policy bin, and the stale freed object can be dereferenced after attacker-controlled heap reuse, making high confidentiality impact defensible.\nI:H - The stale bin is not only read but also passed into pruning logic that writes list/rhashtable/seqcount state, so exploitation can plausibly yield memory corruption and control-flow or data integrity compromise.\nA:H - The UAF can trigger kernel memory corruption, KASAN splats, oopses, or panics, giving high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:25.656Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8fc536e9f6856230f19c7d13e71af064b6a77b22"
},
{
"url": "https://git.kernel.org/stable/c/c4c1ea36d83bf3c4569468ca5b8b614fda1bf821"
},
{
"url": "https://git.kernel.org/stable/c/25c8c7fb3b0b9668c7d05e209f58c158d2b020c7"
},
{
"url": "https://git.kernel.org/stable/c/42827d03f8009a6a218bacab153e21f39d6a121c"
},
{
"url": "https://git.kernel.org/stable/c/88697cf980222d5906a37bf47662dac0732e2a0f"
},
{
"url": "https://git.kernel.org/stable/c/b5316e2b8614a87d8736941972441cb47bfd4491"
},
{
"url": "https://git.kernel.org/stable/c/ec82ea4eb220164d854f8734ca5a35e23e577b94"
},
{
"url": "https://git.kernel.org/stable/c/7f2d76c9c03257c0782afef9d95321fa04096f60"
}
],
"title": "xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53239",
"datePublished": "2026-06-25T08:39:35.149Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-10-19T19:57:30.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72288 (GCVE-0-2026-72288)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling
Hyunwoo Kim reports some really bad races should the following
situation occur:
- LPI-I is pending in vcpu-B's AP list
- vcpu-A writes to vcpu-B's RD to disable its LPIs
- vcpu-C moves I from B to C
If the last two race nicely enough, vgic_prune_ap_list() can drop
the irq and AP list locks, reacquire them, and in the interval
the irq has been freed. UAF follows.
The fix is two-fold:
- Before dropping the irq and ap_list locks, take a reference on
the irq
- Do not try to handle migration of the pending bit: there is no
expectation that this state is retained, as per the architecture
With that, we're sure that the interrupt is still around, and we
safely remove it from the AP list as it has no target at this
stage (unless another interrupt fires, but that's another story).
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:45:49.610829Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:14.997Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eb74f3feb68e64cf69f86cb806a15d8cfb6757f4",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "77c61235d66246dd6a5f55587f0afc273d832775",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "d19dca8194ebed371e624331c6be2cb73b562caf",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "b1a89d12d35a8256d2b170ced0b1c86851f3def2",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
},
{
"lessThan": "7258770e5814f15e8308ebda82ac9acf6964ba8e",
"status": "affected",
"version": "5dd4b924e390af426e424d5e52c1b4d1566af817",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling\n\nHyunwoo Kim reports some really bad races should the following\nsituation occur:\n\n- LPI-I is pending in vcpu-B\u0027s AP list\n- vcpu-A writes to vcpu-B\u0027s RD to disable its LPIs\n- vcpu-C moves I from B to C\n\nIf the last two race nicely enough, vgic_prune_ap_list() can drop\nthe irq and AP list locks, reacquire them, and in the interval\nthe irq has been freed. UAF follows.\n\nThe fix is two-fold:\n\n- Before dropping the irq and ap_list locks, take a reference on\n the irq\n\n- Do not try to handle migration of the pending bit: there is no\n expectation that this state is retained, as per the architecture\n\nWith that, we\u0027re sure that the interrupt is still around, and we\nsafely remove it from the AP list as it has no target at this\nstage (unless another interrupt fires, but that\u0027s another story)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only from KVM guest MMIO traps on GICv3 redistributor GICR_CTLR LPI-disable writes, ITS MOVI affinity changes, and vCPU-exit paths into vgic_prune_ap_list(); no network-facing host protocol is involved.\nAC:L - A guest controls all three racing vCPUs by pinning threads to concurrently issue ITS MOVI, cross-vCPU GICR_CTLR LPI-disable writes, and vCPU exits that invoke vgic_prune_ap_list(); the attacker creates and wins the race rather than depending on uncontrollable host timing.\nPR:N - No host privileges are required beyond running code in an assigned KVM guest (e.g. a cloud VM tenant on arm64); exploitation needs guest-kernel access to GIC/ITS MMIO, not host root or capabilities in the init namespace.\nUI:N - Exploitation is fully attacker-driven from within a multi-vCPU guest VM and does not require any victim user or administrator action on the host.\nS:C - The use-after-free corrupts host-kernel heap memory (struct vgic_irq) from guest-controlled VGIC operations, crossing the guest-to-host virtualization security boundary with VM-escape impact.\nC:H - vgic_flush_pending_lpis() can free the LPI vgic_irq while vgic_prune_ap_list() still dereferences it after reacquiring dropped locks, yielding a kernel heap use-after-free exploitable for arbitrary host memory disclosure via heap grooming.\nI:H - The dangling vgic_irq pointer permits attacker-influenced writes through irq_lock, list_head, vcpu, and target_vcpu fields during ap_list migration, enabling host control-flow or data corruption primitives.\nA:H - The race frees live kernel objects still referenced by the ap_list migration path, causing host kernel oops, panic, or hang during list_del, lock operations, or subsequent LPI delivery on arm64 KVM hosts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:30.737Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eb74f3feb68e64cf69f86cb806a15d8cfb6757f4"
},
{
"url": "https://git.kernel.org/stable/c/77c61235d66246dd6a5f55587f0afc273d832775"
},
{
"url": "https://git.kernel.org/stable/c/d19dca8194ebed371e624331c6be2cb73b562caf"
},
{
"url": "https://git.kernel.org/stable/c/b1a89d12d35a8256d2b170ced0b1c86851f3def2"
},
{
"url": "https://git.kernel.org/stable/c/7258770e5814f15e8308ebda82ac9acf6964ba8e"
}
],
"title": "KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72288",
"datePublished": "2026-08-15T05:55:10.256Z",
"dateReserved": "2026-08-09T03:40:39.917Z",
"dateUpdated": "2026-10-21T12:44:30.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89526 (GCVE-0-2026-89526)
Vulnerability from cvelistv5
Published
2026-09-11 19:44
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Validate Read chunk positions before reconstruction
The RPC/RDMA Read chunk position field is supplied by the remote
client and stored verbatim in the parsed chunk list.
xdr_count_read_segments() checks only 4-byte alignment; it never
compares the position against the received inline body length.
In the single-chunk path, svc_rdma_read_complete_one() splits the
head and tail kvecs at ch_position. A position past the inline
body underflows the tail length, exposing adjacent slab memory to
the upper XDR decoder.
In the multi-chunk path, svc_rdma_read_multiple_chunks() computes
gap lengths between chunks as unsigned subtractions from
ch_position. Overlapping Read chunks cause these subtractions to
underflow. A final position past the inline body likewise
underflows the trailing gap length. svc_rdma_copy_inline_range()
then copies past the receive buffer into request pages that are
returned to the client through the Reply channel.
Bound inline-range copies in svc_rdma_copy_inline_range() against
the decoded inline RPC body saved in rc_saved_arg. Reject a
single Read chunk positioned beyond that body, and reject
multi-chunk lists where accumulated read bytes exceed the next
chunk's position. Apply the same position and overlap checks in
the call-chunk interleaving path.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89526",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:22:57.126783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:40.839Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_rw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3861eeabaebe243050952b34063763527c44e1fe",
"status": "affected",
"version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4",
"versionType": "git"
},
{
"lessThan": "5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2",
"status": "affected",
"version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4",
"versionType": "git"
},
{
"lessThan": "f84ec84d8d4bc65f9ae23372570349687f66fa39",
"status": "affected",
"version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4",
"versionType": "git"
},
{
"lessThan": "577097455d084610fc31e91e6a61c5793b6f04ba",
"status": "affected",
"version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4",
"versionType": "git"
},
{
"lessThan": "3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b",
"status": "affected",
"version": "d96962e6d0e281bab6a48e83b42f5dce6eb28bf4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_rw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Validate Read chunk positions before reconstruction\n\nThe RPC/RDMA Read chunk position field is supplied by the remote\nclient and stored verbatim in the parsed chunk list.\nxdr_count_read_segments() checks only 4-byte alignment; it never\ncompares the position against the received inline body length.\n\nIn the single-chunk path, svc_rdma_read_complete_one() splits the\nhead and tail kvecs at ch_position. A position past the inline\nbody underflows the tail length, exposing adjacent slab memory to\nthe upper XDR decoder.\n\nIn the multi-chunk path, svc_rdma_read_multiple_chunks() computes\ngap lengths between chunks as unsigned subtractions from\nch_position. Overlapping Read chunks cause these subtractions to\nunderflow. A final position past the inline body likewise\nunderflows the trailing gap length. svc_rdma_copy_inline_range()\nthen copies past the receive buffer into request pages that are\nreturned to the client through the Reply channel.\n\nBound inline-range copies in svc_rdma_copy_inline_range() against\nthe decoded inline RPC body saved in rc_saved_arg. Reject a\nsingle Read chunk positioned beyond that body, and reject\nmulti-chunk lists where accumulated read bytes exceed the next\nchunk\u0027s position. Apply the same position and overlap checks in\nthe call-chunk interleaving path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - svcrdma is nfsd\u0027s RPC-over-RDMA transport; a remote peer reaches Read-chunk reconstruction on an enabled NFS/RDMA listener over routable iWARP or RoCE, consistent with prior kernel CNA scores for this subsystem.\nAC:L - The attacker fully controls the wire-supplied Read-chunk position (only 4-byte alignment is checked) and can deterministically underflow gap/tail lengths or copy past the receive buffer, with no race or uncontrollable layout required.\nPR:N - svc_rdma_process_read_list() and svc_rdma_read_complete_one() run in svc_rdma_recvfrom() while assembling the transport message, before svc_process() performs RPC or NFS authentication, and RDMA CM accept has no credential check.\nUI:N - Sending a crafted RPC-over-RDMA message with a malicious Read list is sufficient; no victim mount, click, or other user action is required.\nS:U - The vulnerable NFS/RDMA service and the affected kernel memory belong to the same host kernel security authority; this is not a VM, IOMMU, or sandbox escape.\nC:H - A position past the inline body underflows the tail kvec so the XDR decoder reads adjacent slab, and overlapping chunks make svc_rdma_copy_inline_range() memcpy past the receive buffer into request pages returned on the Reply channel, disclosing kernel memory.\nI:H - The reconstructed xdr_buf uses attacker-controlled head/tail lengths pointing into adjacent slab; XDR shift/copy helpers then memcpy through those kvecs, producing an out-of-bounds kernel write that can corrupt adjacent objects and hijack control flow.\nA:H - The unbounded inline copy and inflated kvec lengths walk unmapped memory or trip decoder/WARN paths, causing a kernel oops or panic that an unauthenticated peer can trigger repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:39.359Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3861eeabaebe243050952b34063763527c44e1fe"
},
{
"url": "https://git.kernel.org/stable/c/5ab3f6d882fe07ae5e61d0bcfeea00b9409155c2"
},
{
"url": "https://git.kernel.org/stable/c/f84ec84d8d4bc65f9ae23372570349687f66fa39"
},
{
"url": "https://git.kernel.org/stable/c/577097455d084610fc31e91e6a61c5793b6f04ba"
},
{
"url": "https://git.kernel.org/stable/c/3779b7b9e7d1c8ba4738f9d327de3b0288cefe9b"
}
],
"title": "svcrdma: Validate Read chunk positions before reconstruction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89526",
"datePublished": "2026-09-11T19:44:07.043Z",
"dateReserved": "2026-09-11T19:38:34.719Z",
"dateUpdated": "2026-10-21T12:47:39.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74641 (GCVE-0-2026-74641)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-10-16 19:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usx2y: bound the hwdep mmap fault offset
snd_us428ctls_vm_fault() turns the faulting page offset into a kernel
address with no bound of any kind:
offset = vmf->pgoff << PAGE_SHIFT;
vaddr = (char *)(...)->us428ctls_sharedmem + offset;
page = virt_to_page(vaddr);
get_page(page);
vmf->page = page;
return 0;
snd_us428ctls_mmap() checks only the length of the mapping, never the
offset, and us428ctls_sharedmem is a single page from
alloc_pages_exact(). For a character device file_mmap_size_max()
returns ULONG_MAX, so the mm layer imposes no ceiling either. Every page
offset above zero resolves to a struct page outside the object, and the
handler installs it into the caller's address space read-write; the vma
is not marked read-only.
The caller picks the page frame with a single mmap() argument and gets
read-write access to a page of kernel memory it does not own; an offset
that lands in an unpopulated vmemmap region oopses instead.
A process that can open the hwdep node of an attached US-X2Y reaches
this after loading the FPGA image through the same node; no capability
check is involved.
On 7.2.0-rc5 (arm64), mmap() with a large offset:
Unable to handle kernel paging request at virtual address fffffdffc45d5ac8
pc : snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]
Call trace:
snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]
__do_fault
__handle_mm_fault
handle_mm_fault
el0_da
Reject any offset outside the shared region. The pcm hwdep handler in
usx2yhwdeppcm.c computes its address the same way and needs the same
bound.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74641",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:03:36.280661Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:06:04.565Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/usx2y/usX2Yhwdep.c",
"sound/usb/usx2y/usx2yhwdeppcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ad6fedea65c6e90eda00d716c8bf20cdc437ed10",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "10a87401fb3148c388e55df0148295b3b137da07",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "34ab56ed854baa73a731cfd99af689f0b1bac444",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4208db2453e1ea71b8048a5b7802360cb29a53f1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f613b4a2d87247b51a1b2b330f2e083a454125f2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f75d6f61f0d9c5c1ea725104014e10d26d1e3a00",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5bf5ccddf00b59f1e3ea7e65d76a5f5b5c21cc2e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2ca1eea3cd17930daffe9e429a7c89232036ec24",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/usx2y/usX2Yhwdep.c",
"sound/usb/usx2y/usx2yhwdeppcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usx2y: bound the hwdep mmap fault offset\n\nsnd_us428ctls_vm_fault() turns the faulting page offset into a kernel\naddress with no bound of any kind:\n\n\toffset = vmf-\u003epgoff \u003c\u003c PAGE_SHIFT;\n\tvaddr = (char *)(...)-\u003eus428ctls_sharedmem + offset;\n\tpage = virt_to_page(vaddr);\n\tget_page(page);\n\tvmf-\u003epage = page;\n\n\treturn 0;\n\nsnd_us428ctls_mmap() checks only the length of the mapping, never the\noffset, and us428ctls_sharedmem is a single page from\nalloc_pages_exact(). For a character device file_mmap_size_max()\nreturns ULONG_MAX, so the mm layer imposes no ceiling either. Every page\noffset above zero resolves to a struct page outside the object, and the\nhandler installs it into the caller\u0027s address space read-write; the vma\nis not marked read-only.\n\nThe caller picks the page frame with a single mmap() argument and gets\nread-write access to a page of kernel memory it does not own; an offset\nthat lands in an unpopulated vmemmap region oopses instead.\n\nA process that can open the hwdep node of an attached US-X2Y reaches\nthis after loading the FPGA image through the same node; no capability\ncheck is involved.\n\nOn 7.2.0-rc5 (arm64), mmap() with a large offset:\n\n Unable to handle kernel paging request at virtual address fffffdffc45d5ac8\n pc : snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]\n Call trace:\n snd_us428ctls_vm_fault+0x68/0x140 [snd_usb_usx2y]\n __do_fault\n __handle_mm_fault\n handle_mm_fault\n el0_da\n\nReject any offset outside the shared region. The pcm hwdep handler in\nusx2yhwdeppcm.c computes its address the same way and needs the same\nbound.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local mmap() on the ALSA hwdep character device (/dev/snd/hwC*D*); the path is open\u2192SNDRV_HWDEP_IOCTL_DSP_LOAD\u2192mmap\u2192snd_us428ctls_vm_fault, with no network or remote packet handler involved.\nAC:L - The attacker fully controls the mmap() page offset (vmf-\u003epgoff); any offset beyond the single-page shared buffer deterministically maps an attacker-chosen kernel page read-write or oopses, with no race or uncontrollable memory-layout dependency.\nPR:L - The driver performs no capability checks on hwdep open, ioctl, or mmap; any unprivileged local user who can access the hwdep node (typically via the audio group on desktop distros) can reach the fault handler after loading the FPGA image.\nUI:N - All exploitation steps\u2014opening the hwdep node, loading FPGA firmware via DSP_LOAD ioctl, and mmap with a crafted offset\u2014are performed by the attacker; no discretionary victim action beyond the device being present in the environment is required.\nS:U - Impact is arbitrary read/write of host kernel memory leading to local privilege escalation within the same kernel security authority; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Unbounded pgoff arithmetic maps arbitrary kernel struct pages into the attacker\u0027s address space; the VMA is not read-only, giving attacker-controlled read access to any reachable kernel page selected via the mmap offset.\nI:H - The same unbounded mmap fault path installs attacker-chosen kernel pages into a read-write userspace mapping, enabling arbitrary kernel memory writes and heap corruption primitives suitable for privilege escalation or code execution.\nA:H - Large mmap offsets dereference unpopulated vmemmap regions causing kernel paging faults and oops (demonstrated on arm64); arbitrary kernel page writes can also panic the system or destabilize the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:03.118Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ad6fedea65c6e90eda00d716c8bf20cdc437ed10"
},
{
"url": "https://git.kernel.org/stable/c/10a87401fb3148c388e55df0148295b3b137da07"
},
{
"url": "https://git.kernel.org/stable/c/34ab56ed854baa73a731cfd99af689f0b1bac444"
},
{
"url": "https://git.kernel.org/stable/c/4208db2453e1ea71b8048a5b7802360cb29a53f1"
},
{
"url": "https://git.kernel.org/stable/c/f613b4a2d87247b51a1b2b330f2e083a454125f2"
},
{
"url": "https://git.kernel.org/stable/c/f75d6f61f0d9c5c1ea725104014e10d26d1e3a00"
},
{
"url": "https://git.kernel.org/stable/c/5bf5ccddf00b59f1e3ea7e65d76a5f5b5c21cc2e"
},
{
"url": "https://git.kernel.org/stable/c/2ca1eea3cd17930daffe9e429a7c89232036ec24"
}
],
"title": "ALSA: usx2y: bound the hwdep mmap fault offset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74641",
"datePublished": "2026-08-22T15:32:19.696Z",
"dateReserved": "2026-08-15T05:44:03.922Z",
"dateUpdated": "2026-10-16T19:06:04.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68123 (GCVE-0-2026-68123)
Vulnerability from cvelistv5
Published
2026-08-10 11:58
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: fix GSO userspace truncation underflow
OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb
length in OVS_CB(skb)->cutlen. When a later userspace action segments a
GSO skb, queue_gso_packets() reuses that delta for each smaller segment.
A segment can then reach queue_userspace_packet() with cutlen greater
than skb->len, underflowing the length passed to skb_zerocopy().
Store the maximum preserved length instead and bound each consumer
against the current skb length. Use U32_MAX as the no-truncation
sentinel so the value remains valid if skb geometry changes before a
consumer handles it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 Version: f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:44:13.520896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:51.936Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/actions.c",
"net/openvswitch/datapath.c",
"net/openvswitch/datapath.h",
"net/openvswitch/vport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "50a6a85f3d6b1d22d8436848606cdef5d2c490b4",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "2623c48cc3a8da9a1886fd8f65c0e348f4406fd6",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "e211b081901ffca76674082c73eeaed53524c369",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "a16eaaf7c0b0ccdef6166707d90ffbc6eebf6855",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "fbfa3ad2ad6f3a5624aba5211c46290fb98cc9dc",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "100a23b1613e9218e0af654ef102352c713f0263",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "ea85dbcbe8d4056ecb54352f97743d138ea4c407",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
},
{
"lessThan": "4032f8ed10fcb84d41c508dfb04be96589f78dfe",
"status": "affected",
"version": "f2a4d086ed4c588d32fe9b7aa67fead7280e7bf1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/actions.c",
"net/openvswitch/datapath.c",
"net/openvswitch/datapath.h",
"net/openvswitch/vport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix GSO userspace truncation underflow\n\nOVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb\nlength in OVS_CB(skb)-\u003ecutlen. When a later userspace action segments a\nGSO skb, queue_gso_packets() reuses that delta for each smaller segment.\nA segment can then reach queue_userspace_packet() with cutlen greater\nthan skb-\u003elen, underflowing the length passed to skb_zerocopy().\n\nStore the maximum preserved length instead and bound each consumer\nagainst the current skb length. Use U32_MAX as the no-truncation\nsentinel so the value remains valid if skb geometry changes before a\nconsumer handles it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Ingress packets reach ovs_vport_receive() through netdev rx_handlers or tunnel vports; GRO-coalesced GSO skbs from remote senders traverse this path into queue_gso_packets(), so the underflow is reachable from the network without physical access.\nAC:L - The attacker chooses truncation max_len relative to GSO super-skb size and sends traffic that GRO segments predictably; no timing race or fragile heap layout is required to make cutlen exceed a child segment length after __skb_gso_segment().\nPR:N - In multi-tenant cloud/OVN deployments, a remote VM or container can send crafted GSO traffic into the host OVS datapath to hit provider-installed TRUNC+USERSPACE sampling flows without possessing any Linux capabilities on the host.\nUI:N - Triggering the flaw requires only network traffic matching existing OVS flow actions; no victim login, file open, mount, or other interactive step is needed.\nS:U - Impact is kernel memory corruption and crash/escalation within the host kernel security domain; it does not cross a guest-to-hypervisor, VM, or hardware IOMMU trust boundary by itself.\nC:H - Unsigned underflow makes skb-\u003elen-cutlen enormous for skb_zerocopy()/skb_copy_bits(), enabling out-of-bounds reads from the source skb and adjacent slab data, i.e., an exploitable information-disclosure primitive.\nI:H - The same underflowed length can expand destination skbs via skb_len_add()/nlattr sizing, corrupting kernel heap metadata and yielding a write primitive suitable for control-flow hijacking.\nA:H - The miscopied lengths can BUG the skb helpers or cause immediate kernel oops/panic during zerocopy/trim handling, and corrupted metadata can crash the system even if exploitation is not completed."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:34.391Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/50a6a85f3d6b1d22d8436848606cdef5d2c490b4"
},
{
"url": "https://git.kernel.org/stable/c/2623c48cc3a8da9a1886fd8f65c0e348f4406fd6"
},
{
"url": "https://git.kernel.org/stable/c/e211b081901ffca76674082c73eeaed53524c369"
},
{
"url": "https://git.kernel.org/stable/c/a16eaaf7c0b0ccdef6166707d90ffbc6eebf6855"
},
{
"url": "https://git.kernel.org/stable/c/fbfa3ad2ad6f3a5624aba5211c46290fb98cc9dc"
},
{
"url": "https://git.kernel.org/stable/c/100a23b1613e9218e0af654ef102352c713f0263"
},
{
"url": "https://git.kernel.org/stable/c/ea85dbcbe8d4056ecb54352f97743d138ea4c407"
},
{
"url": "https://git.kernel.org/stable/c/4032f8ed10fcb84d41c508dfb04be96589f78dfe"
}
],
"title": "openvswitch: fix GSO userspace truncation underflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68123",
"datePublished": "2026-08-10T11:58:43.727Z",
"dateReserved": "2026-07-30T09:28:09.369Z",
"dateUpdated": "2026-10-19T20:58:51.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64191 (GCVE-0-2026-64191)
Vulnerability from cvelistv5
Published
2026-07-20 16:27
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: stub: Reject I2C block transfers with invalid length
The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]
as the transfer length. The existing check only clamps it to avoid
overrunning the chip->words[256] register array, but does not validate
it against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union
i2c_smbus_data.block buffer (34 bytes total). The driver is a
development/test tool (CONFIG_I2C_STUB=m, not built by default)
that must be loaded with a chip_addr= parameter.
A local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl
with I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing
stub_xfer() to read or write past the end of the union
i2c_smbus_data.block buffer:
BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)
Read of size 1 at addr ffff88800abcfd92 by task exploit/81
Call Trace:
<TASK>
stub_xfer (drivers/i2c/i2c-stub.c:223)
__i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)
i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)
i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)
i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)
__x64_sys_ioctl (fs/ioctl.c:583)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
</TASK>
The bug exists because i2c-stub implements .smbus_xfer directly,
bypassing the I2C_SMBUS_BLOCK_MAX validation in
i2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same
function correctly validates against I2C_SMBUS_BLOCK_MAX, but the
I2C_SMBUS_I2C_BLOCK_DATA case does not.
Fix by rejecting transfers with data->block[0] == 0 or
data->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with
both the I2C_SMBUS_BLOCK_DATA case in the same function and the
I2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 Version: 4710317891e4824ce1510a6b5066abbd3e917750 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64191",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:37:24.187565Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:15.069Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-stub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7e9072dbd5f2f17934751873450d2c22080ead80",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "21e87f336ac6303fed54a69b1d0d79a23b25c8d0",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "3fd225f3e4cd67ec8ddab1afed9da03c7c43537c",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "1c4ffe6b4f04365485ed58d64c9bb86b46fc9037",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "4bd8635f28c135a08aac6badcd7d9b5cdb34335f",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "5f4d2bd028ebb6e4c09a9d64842546022321d4a7",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "0526931b16e5a118d367b7bfce7d797e63f7ac69",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
},
{
"lessThan": "6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e",
"status": "affected",
"version": "4710317891e4824ce1510a6b5066abbd3e917750",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-stub.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.33"
},
{
"lessThan": "2.6.33",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: stub: Reject I2C block transfers with invalid length\n\nThe I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data-\u003eblock[0]\nas the transfer length. The existing check only clamps it to avoid\noverrunning the chip-\u003ewords[256] register array, but does not validate\nit against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union\ni2c_smbus_data.block buffer (34 bytes total). The driver is a\ndevelopment/test tool (CONFIG_I2C_STUB=m, not built by default)\nthat must be loaded with a chip_addr= parameter.\n\nA local user with access to /dev/i2c-* can issue an I2C_SMBUS ioctl\nwith I2C_SMBUS_I2C_BLOCK_DATA and data-\u003eblock[0] \u003e 32, causing\nstub_xfer() to read or write past the end of the union\ni2c_smbus_data.block buffer:\n\n BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers/i2c/i2c-stub.c:223)\n Read of size 1 at addr ffff88800abcfd92 by task exploit/81\n Call Trace:\n \u003cTASK\u003e\n stub_xfer (drivers/i2c/i2c-stub.c:223)\n __i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:593)\n i2c_smbus_xfer (drivers/i2c/i2c-core-smbus.c:536)\n i2cdev_ioctl_smbus (drivers/i2c/i2c-dev.c:391)\n i2cdev_ioctl (drivers/i2c/i2c-dev.c:478)\n __x64_sys_ioctl (fs/ioctl.c:583)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n\nThe bug exists because i2c-stub implements .smbus_xfer directly,\nbypassing the I2C_SMBUS_BLOCK_MAX validation in\ni2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same\nfunction correctly validates against I2C_SMBUS_BLOCK_MAX, but the\nI2C_SMBUS_I2C_BLOCK_DATA case does not.\n\nFix by rejecting transfers with data-\u003eblock[0] == 0 or\ndata-\u003eblock[0] \u003e I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with\nboth the I2C_SMBUS_BLOCK_DATA case in the same function and the\nI2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by a local process issuing I2C_SMBUS ioctls on an i2c-stub /dev/i2c-* character device; it is neither remotely nor physically reachable.\nAC:L - Once i2c-stub is loaded, the attacker controls the address, direction, length, and register contents, making the corruption deterministic without a race. The non-default module configuration defines the vulnerable deployment rather than complicating exploitation within it.\nPR:L - The attacker needs unprivileged local access to the applicable /dev/i2c-* node, but no capability or namespace-specific administrative privilege is checked anywhere along the ioctl path.\nUI:N - After the vulnerable adapter is configured, exploitation requires only attacker-issued ioctls and no action by another user.\nS:U - The corruption occurs within the host kernel and represents conventional local privilege escalation, without crossing a separate virtualization or hardware security authority.\nC:H - An oversized block write reads up to 222 bytes beyond the 34-byte stack union and persists those bytes in attacker-readable stub registers, enabling substantial kernel-stack disclosure.\nI:H - An oversized block read writes up to 222 attacker-chosen bytes beyond the stack union because the attacker can prepopulate the stub registers, enabling control-data corruption and potential kernel code execution.\nA:H - The controlled stack overwrite can corrupt stack canaries, return state, or other control data, causing a repeatable kernel oops or panic even when code execution is unsuccessful."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:59.861Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7e9072dbd5f2f17934751873450d2c22080ead80"
},
{
"url": "https://git.kernel.org/stable/c/21e87f336ac6303fed54a69b1d0d79a23b25c8d0"
},
{
"url": "https://git.kernel.org/stable/c/3fd225f3e4cd67ec8ddab1afed9da03c7c43537c"
},
{
"url": "https://git.kernel.org/stable/c/1c4ffe6b4f04365485ed58d64c9bb86b46fc9037"
},
{
"url": "https://git.kernel.org/stable/c/4bd8635f28c135a08aac6badcd7d9b5cdb34335f"
},
{
"url": "https://git.kernel.org/stable/c/5f4d2bd028ebb6e4c09a9d64842546022321d4a7"
},
{
"url": "https://git.kernel.org/stable/c/0526931b16e5a118d367b7bfce7d797e63f7ac69"
},
{
"url": "https://git.kernel.org/stable/c/6036b5067a8199ba7a2dc7b377d4b9dd276d5f9e"
}
],
"title": "i2c: stub: Reject I2C block transfers with invalid length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64191",
"datePublished": "2026-07-20T16:27:51.120Z",
"dateReserved": "2026-07-19T07:54:57.040Z",
"dateUpdated": "2026-10-19T20:28:15.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81003 (GCVE-0-2026-81003)
Vulnerability from cvelistv5
Published
2026-09-11 19:42
Modified
2026-10-19 08:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte
name fields in the transport header alone. No check is made against the
net_device the frame arrived on.
This can cause a frame arriving on any netdev to be delivered to an AF_IUCV
socket. Three problems follow.
First, a frame arriving over HiperSockets can be delivered to a socket
bound to the classic z/VM IUCV transport, which has iucv->hs_dev == NULL.
iucv_sock_bind() takes the classic path whenever the requested userid
matches iucv_userid, even on a guest that also has a HiperSockets device
carrying the same identifier. The child socket created by
afiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and
transport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV.
The socket delivered to accept() is unusable.
Second, a frame arriving on one netdev can be delivered to a socket bound
to a different IQD device. Which can lead to
- Accept-queue exhaustion (DoS)
- Attacker-controlled peer identity in the child socket
- Data injection into existing sockets
- Fabric noise on the IQD fabric, where bogus replies are sent
- killing established connections
Third, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls
sk_alloc(&init_net, ...). But even frames arriving on netdev devices in a
namespace can be delivered to an IUCV socket. So a process in an
unprivileged user and network namespace holding only the CAP_NET_RAW
capability valid within that namespace can send a raw ETH_P_AF_IUCV frame
on its own lo device and have it matched against init_net sockets.
Fix all three by skipping any socket whose hs_dev does not match the
ingress device. A classic z/VM IUCV socket has hs_dev == NULL; the ingress
dev is never NULL, so classic sockets are skipped automatically. An unbound
HIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket
is only reachable from the exact IQD device it was bound to. Because hs_dev
is always a device in init_net (iucv_sock_bind() scans
for_each_netdev_rcu(&init_net, ...) exclusively), a frame whose ingress
device belongs to another namespace never matches any socket.
Note that AF_IUCV over HiperSockets provides no per-connection
authentication: no sequence numbers, no TLS, no nonce. The four name fields
identifying a connection are exchanged in plaintext on the shared
HiperSockets segment (VCHID). Any host on the same HiperSockets segment
could spoof any frame type against an existing connection. That is a
protocol-level property unchanged by this patch. The fix reduces the attack
surface to peers present on the same HiperSockets segment.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b Version: 3881ac441f642d56503818123446f7298442236b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/iucv/af_iucv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "639828ad4d374056167391dbaffd13dd5e5e5ddb",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "92e5c281f1caa287bb58292f2687c9e3ff3aa23e",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "712330f8a4293cfd97b0d62b7c7dc01862a16b98",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "0a5af67e7184c6a0e155c317840bd64b37177af4",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "dfac2936b83be00035ae176f8252e1c1e1de9207",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "8e3763f1ccac3fc395f9af2b87114c023ced8a3f",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "a7f0130a091724e69827ab58e74777a88747e892",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
},
{
"lessThan": "80230a18c164a4b5bbc048fe2768b219ac17bc5a",
"status": "affected",
"version": "3881ac441f642d56503818123446f7298442236b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/iucv/af_iucv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: filter frames in afiucv_hs_rcv() by ingress device\n\nafiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte\nname fields in the transport header alone. No check is made against the\nnet_device the frame arrived on.\n\nThis can cause a frame arriving on any netdev to be delivered to an AF_IUCV\nsocket. Three problems follow.\n\nFirst, a frame arriving over HiperSockets can be delivered to a socket\nbound to the classic z/VM IUCV transport, which has iucv-\u003ehs_dev == NULL.\niucv_sock_bind() takes the classic path whenever the requested userid\nmatches iucv_userid, even on a guest that also has a HiperSockets device\ncarrying the same identifier. The child socket created by\nafiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and\ntransport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV.\nThe socket delivered to accept() is unusable.\n\nSecond, a frame arriving on one netdev can be delivered to a socket bound\nto a different IQD device. Which can lead to\n- Accept-queue exhaustion (DoS)\n- Attacker-controlled peer identity in the child socket\n- Data injection into existing sockets\n- Fabric noise on the IQD fabric, where bogus replies are sent\n- killing established connections\n\nThird, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls\nsk_alloc(\u0026init_net, ...). But even frames arriving on netdev devices in a\nnamespace can be delivered to an IUCV socket. So a process in an\nunprivileged user and network namespace holding only the CAP_NET_RAW\ncapability valid within that namespace can send a raw ETH_P_AF_IUCV frame\non its own lo device and have it matched against init_net sockets.\n\nFix all three by skipping any socket whose hs_dev does not match the\ningress device. A classic z/VM IUCV socket has hs_dev == NULL; the ingress\ndev is never NULL, so classic sockets are skipped automatically. An unbound\nHIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket\nis only reachable from the exact IQD device it was bound to. Because hs_dev\nis always a device in init_net (iucv_sock_bind() scans\nfor_each_netdev_rcu(\u0026init_net, ...) exclusively), a frame whose ingress\ndevice belongs to another namespace never matches any socket.\n\nNote that AF_IUCV over HiperSockets provides no per-connection\nauthentication: no sequence numbers, no TLS, no nonce. The four name fields\nidentifying a connection are exchanged in plaintext on the shared\nHiperSockets segment (VCHID). Any host on the same HiperSockets segment\ncould spoof any frame type against an existing connection. That is a\nprotocol-level property unchanged by this patch. The fix reduces the attack\nsurface to peers present on the same HiperSockets segment."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - afiucv_hs_rcv() is registered via dev_add_pack() for ethertype ETH_P_AF_IUCV (0xFBFB) on every netdevice and matches sockets by name fields only, so crafted L2 frames from a peer LPAR/guest on the HiperSockets VCHID or a host on an attached Ethernet segment reach AF_IUCV sockets; these frames are not IP-routable.\nAC:L - The attacker fully controls the ETH_P_AF_IUCV frames and can set the plaintext dest/src name fields to match a listening or connected socket (names are exchanged in the clear on the fabric and IBM apps use well-known 8-byte names), so matching and delivery are reliable with no race.\nPR:N - afiucv_hs_rcv() runs from netif RX softirq with no authentication, capability, or credential check on the path, so an adjacent HiperSockets or Ethernet peer needs no account or privilege on the victim s390 system.\nUI:N - Exploitation requires only sending crafted frames; the packet handler runs unconditionally in softirq and needs no victim action such as opening a file or mounting a filesystem.\nS:U - Impact is unauthorized delivery into the victim kernel\u0027s AF_IUCV sockets within the same OS security authority; this is not a KVM/Xen guest-to-host escape or IOMMU/DMA boundary bypass.\nC:N - The flaw injects attacker-supplied frames into socket receive and control paths and does not provide a kernel memory read, out-of-bounds read, or use-after-free disclosure primitive.\nI:H - Because lookup ignores the ingress device, an attacker can inject arbitrary payload into connected AF_IUCV sockets, spoof the accepted peer identity on SYN, and forge FIN/WIN control frames, fully compromising the integrity of AF_IUCV communications.\nA:H - SYN floods exhaust the listen accept queue and forged FIN/SYN|FIN frames tear down established connections, including classic z/VM IUCV sockets wrongly matched from any netdev, causing complete denial of AF_IUCV services."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:46:27.617Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/639828ad4d374056167391dbaffd13dd5e5e5ddb"
},
{
"url": "https://git.kernel.org/stable/c/92e5c281f1caa287bb58292f2687c9e3ff3aa23e"
},
{
"url": "https://git.kernel.org/stable/c/712330f8a4293cfd97b0d62b7c7dc01862a16b98"
},
{
"url": "https://git.kernel.org/stable/c/0a5af67e7184c6a0e155c317840bd64b37177af4"
},
{
"url": "https://git.kernel.org/stable/c/dfac2936b83be00035ae176f8252e1c1e1de9207"
},
{
"url": "https://git.kernel.org/stable/c/8e3763f1ccac3fc395f9af2b87114c023ced8a3f"
},
{
"url": "https://git.kernel.org/stable/c/a7f0130a091724e69827ab58e74777a88747e892"
},
{
"url": "https://git.kernel.org/stable/c/80230a18c164a4b5bbc048fe2768b219ac17bc5a"
}
],
"title": "net/iucv: filter frames in afiucv_hs_rcv() by ingress device",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-81003",
"datePublished": "2026-09-11T19:42:56.172Z",
"dateReserved": "2026-08-26T14:34:25.812Z",
"dateUpdated": "2026-10-19T08:46:27.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63919 (GCVE-0-2026-63919)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-19 20:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: input: hold netns during deferred transport reinjection
Transport-mode reinjection stores a struct net pointer in skb->cb and
uses it later from xfrm_trans_reinject(). That pointer must stay valid
until the deferred callback runs.
Take a netns reference when queueing deferred reinjection work and drop
it after the callback completes. Use maybe_get_net() so the queueing
path does not revive a namespace that is already being torn down.
This keeps the existing workqueue design and fixes the netns lifetime
handling in one place for all users of xfrm_trans_queue_net().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7b3801927e52f8621de311277f7fc727635019e7 Version: 7b3801927e52f8621de311277f7fc727635019e7 Version: 7b3801927e52f8621de311277f7fc727635019e7 Version: 7b3801927e52f8621de311277f7fc727635019e7 Version: 7b3801927e52f8621de311277f7fc727635019e7 Version: 7b3801927e52f8621de311277f7fc727635019e7 Version: 7b3801927e52f8621de311277f7fc727635019e7 Version: 7b3801927e52f8621de311277f7fc727635019e7 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63919",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:33:20.958476Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:56.102Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7ee59eda8820b758ed29e1cd3222359c7b97302c",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "2df7059a18afb7d3aee6c36cad5d371c198111d4",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "8dfabcba6a943a7a02ebe1e1637c361ba96acbaa",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "48ce101cd630d6745b6923b5bad8358bc4c119da",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "55ddfc41451f01c588089cd74957a05311b6f202",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "9f7ebb45a83afc3216e855e57d51bb4bc9b5232e",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "9f67a36e91bb50d358760f381f233913fe5c09f8",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
},
{
"lessThan": "c16f74dc1d75d0e2e7670076d5375deda110ebeb",
"status": "affected",
"version": "7b3801927e52f8621de311277f7fc727635019e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: input: hold netns during deferred transport reinjection\n\nTransport-mode reinjection stores a struct net pointer in skb-\u003ecb and\nuses it later from xfrm_trans_reinject(). That pointer must stay valid\nuntil the deferred callback runs.\n\nTake a netns reference when queueing deferred reinjection work and drop\nit after the callback completes. Use maybe_get_net() so the queueing\npath does not revive a namespace that is already being torn down.\n\nThis keeps the existing workqueue design and fixes the netns lifetime\nhandling in one place for all users of xfrm_trans_queue_net()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is reached when IPsec ESP/AH packets are received and processed through xfrm_input transport-mode reinjection, which is a network packet receive path in net/xfrm. Remote peers can send ESP traffic to trigger deferred queueing on systems with IPsec configured.\nAC:L - The attacker controls both sides of the race by flooding IPsec packets to queue deferred reinjection work while concurrently destroying the network namespace, making the UAF reliably triggerable without conditions outside attacker control.\nPR:L - Exploitation requires configuring xfrm/IPsec and managing network namespace lifecycle, both reachable with CAP_NET_ADMIN obtainable by an unprivileged user via user namespaces (unshare -Urn), not requiring real root in the init namespace.\nUI:N - No victim user interaction is required; exploitation is achieved through automated packet transmission and namespace teardown scripted by the attacker.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The deferred callback dereferences a freed struct net (e.g., ip6_rcv_finish_core reads sysctl fields from the UAF pointer), providing an information disclosure primitive from attacker-influenced freed slab memory.\nI:H - Use-after-free on the large struct net slab object enables heap grooming and memory corruption exploitable for arbitrary kernel writes and control-flow hijacking, not merely a bounded modification.\nA:H - Dereferencing a freed network namespace structure causes kernel oops/panic from the workqueue callback path, and UAF reliably threatens system availability even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:13.727Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7ee59eda8820b758ed29e1cd3222359c7b97302c"
},
{
"url": "https://git.kernel.org/stable/c/2df7059a18afb7d3aee6c36cad5d371c198111d4"
},
{
"url": "https://git.kernel.org/stable/c/8dfabcba6a943a7a02ebe1e1637c361ba96acbaa"
},
{
"url": "https://git.kernel.org/stable/c/48ce101cd630d6745b6923b5bad8358bc4c119da"
},
{
"url": "https://git.kernel.org/stable/c/55ddfc41451f01c588089cd74957a05311b6f202"
},
{
"url": "https://git.kernel.org/stable/c/9f7ebb45a83afc3216e855e57d51bb4bc9b5232e"
},
{
"url": "https://git.kernel.org/stable/c/9f67a36e91bb50d358760f381f233913fe5c09f8"
},
{
"url": "https://git.kernel.org/stable/c/c16f74dc1d75d0e2e7670076d5375deda110ebeb"
}
],
"title": "xfrm: input: hold netns during deferred transport reinjection",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63919",
"datePublished": "2026-07-19T14:55:22.121Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-10-19T20:17:56.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72320 (GCVE-0-2026-72320)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_lookup: fix catchall element handling with inverted lookups
nft_lookup_eval() decides whether a lookup matched (`found`) from the
direct set lookup and priv->invert before falling back to the
catchall element used by interval sets (e.g. nft_set_rbtree) for the
open-ended default range. Since `found` is never recomputed after
`ext` is replaced by the catchall lookup, inverted lookups
(NFT_LOOKUP_F_INV, "!= @set") can wrongly match or wrongly skip the
catchall element, producing the wrong verdict. Fold the catchall
lookup into `ext` before computing `found`, matching the order
already used by nft_objref_map_eval().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72320",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:46:52.637095Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:17.651Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_lookup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "65d35cb555f40529a9edc6bf4beaa3bee917f015",
"status": "affected",
"version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
"versionType": "git"
},
{
"lessThan": "0ab8880865f9678eb6174e72c1fc4712e44c745c",
"status": "affected",
"version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
"versionType": "git"
},
{
"lessThan": "238c612357b5a25f03eacf356f95034f8551f218",
"status": "affected",
"version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
"versionType": "git"
},
{
"lessThan": "ef0c7d4b04a0e6ad175323c24bc84e11470dd79d",
"status": "affected",
"version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
"versionType": "git"
},
{
"lessThan": "e6107a4c74b54cb33e3bce162a63048ae5a6b198",
"status": "affected",
"version": "aaa31047a6d25da0fa101da1ed544e1247949b40",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_lookup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_lookup: fix catchall element handling with inverted lookups\n\nnft_lookup_eval() decides whether a lookup matched (`found`) from the\ndirect set lookup and priv-\u003einvert before falling back to the\ncatchall element used by interval sets (e.g. nft_set_rbtree) for the\nopen-ended default range. Since `found` is never recomputed after\n`ext` is replaced by the catchall lookup, inverted lookups\n(NFT_LOOKUP_F_INV, \"!= @set\") can wrongly match or wrongly skip the\ncatchall element, producing the wrong verdict. Fold the catchall\nlookup into `ext` before computing `found`, matching the order\nalready used by nft_objref_map_eval()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - nft_lookup_eval() runs on the netfilter packet datapath via nft_do_chain() for ingress/forward/prerouting hooks, so a remote sender can reach the bug by sending packets evaluated against an affected inverted lookup rule on a catchall interval set.\nAC:L - Once such a ruleset exists, the attacker reliably controls whether the lookup key hits a set element or the catchall by crafting packet fields; no race, memory layout dependency, or other uncontrollable victim state is required.\nPR:N - Exploitation at runtime only requires sending network traffic through the victim\u0027s nftables hooks; although rule installation needs CAP_NET_ADMIN, the remote attacker needs no credentials or local privileges on the target system.\nUI:N - No victim user interaction is needed beyond normal network traffic processing; the kernel automatically evaluates the inverted lookup expression for each matching packet.\nS:U - The impact is incorrect nftables verdicts within the host/kernel network security authority and does not cross VM, container-host, or IOMMU security boundaries.\nC:H - Wrongly matching or skipping the catchall element can bypass intended filtering and expose protected internal services or data that the firewall policy was meant to block from the attacker\u0027s network position.\nI:H - The bug can apply or omit catchall set-element actions and verdicts (accept/drop/jump), allowing unauthorized traffic handling contrary to the administrator\u0027s intended nftables policy.\nA:N - This is a pure logic error that returns incorrect verdicts without memory corruption, kernel oops/panic, hang, or other direct loss of kernel availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:31.838Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/65d35cb555f40529a9edc6bf4beaa3bee917f015"
},
{
"url": "https://git.kernel.org/stable/c/0ab8880865f9678eb6174e72c1fc4712e44c745c"
},
{
"url": "https://git.kernel.org/stable/c/238c612357b5a25f03eacf356f95034f8551f218"
},
{
"url": "https://git.kernel.org/stable/c/ef0c7d4b04a0e6ad175323c24bc84e11470dd79d"
},
{
"url": "https://git.kernel.org/stable/c/e6107a4c74b54cb33e3bce162a63048ae5a6b198"
}
],
"title": "netfilter: nft_lookup: fix catchall element handling with inverted lookups",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72320",
"datePublished": "2026-08-15T05:55:32.939Z",
"dateReserved": "2026-08-09T03:40:39.919Z",
"dateUpdated": "2026-10-21T12:44:31.838Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68245 (GCVE-0-2026-68245)
Vulnerability from cvelistv5
Published
2026-08-10 12:01
Modified
2026-10-21 12:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()
The vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only
valid while the lock is still being held. Once xa_unlock_irqrestore is
called and returned, the pointer is no longer under lock and is subject
to modification. Since, the caller still dereferences vm->task_info in
amdgpu_vm_get_task_info_vm() after the lock is removed, this causes a
use after unlock problem.
Remove the lifetime issue present in amdgpu_vm_get_task_info_pasid()
through removing the amdgpu_vm_get_vm_from_pasid() function from
amdgpu_vm.c and making the relevant code inline to hold the lock while
it is still in use.
(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b8f67b9ddf4f8fe6dd536590712b5912ad78f99c Version: b8f67b9ddf4f8fe6dd536590712b5912ad78f99c Version: b8f67b9ddf4f8fe6dd536590712b5912ad78f99c Version: b8f67b9ddf4f8fe6dd536590712b5912ad78f99c Version: 251840f22eff35c25de531a3fcb523df94c128c0 Version: 6.6.160 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68245",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:46:07.633489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:57.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fe16a7e5336ae888751984e30c451fbf7cfa5df7",
"status": "affected",
"version": "b8f67b9ddf4f8fe6dd536590712b5912ad78f99c",
"versionType": "git"
},
{
"lessThan": "1173190412fb9d12e7efce76734118d9712ff970",
"status": "affected",
"version": "b8f67b9ddf4f8fe6dd536590712b5912ad78f99c",
"versionType": "git"
},
{
"lessThan": "5d5fb9124a2bba96a7807086d8fe0f7ce810d546",
"status": "affected",
"version": "b8f67b9ddf4f8fe6dd536590712b5912ad78f99c",
"versionType": "git"
},
{
"lessThan": "04cc4aa3617b0ed67e859f91f09de5d896a46f3a",
"status": "affected",
"version": "b8f67b9ddf4f8fe6dd536590712b5912ad78f99c",
"versionType": "git"
},
{
"status": "affected",
"version": "251840f22eff35c25de531a3fcb523df94c128c0",
"versionType": "git"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.160",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.160",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()\n\nThe vm pointer returned from amdgpu_vm_get_vm_from_pasid() is only\nvalid while the lock is still being held. Once xa_unlock_irqrestore is\ncalled and returned, the pointer is no longer under lock and is subject\nto modification. Since, the caller still dereferences vm-\u003etask_info in\namdgpu_vm_get_task_info_vm() after the lock is removed, this causes a\nuse after unlock problem.\n\nRemove the lifetime issue present in amdgpu_vm_get_task_info_pasid()\nthrough removing the amdgpu_vm_get_vm_from_pasid() function from\namdgpu_vm.c and making the relevant code inline to hold the lock while\nit is still in use.\n\n(cherry picked from commit 9d01579f3f868b333acc901815972685989092c7)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through the amdgpu DRM device (render node) via command submission causing a GPU VM page fault or a ring timeout; this requires local access to /dev/dri/renderD*, with no network exposure.\nAC:L - The attacker controls both sides of the race: it can generate GPU page faults or job timeouts at will while concurrently closing DRM file descriptors to free the amdgpu_vm/fpriv, and can retry the race arbitrarily many times until it wins.\nPR:L - Only an unprivileged local account with access to the AMD GPU render node is needed; render nodes are world/group accessible by default on desktop, Android and container workloads, and no capability is checked on the CS/fault path.\nUI:N - The attacker\u0027s own processes generate the GPU faults and the concurrent VM teardown; no action by any other user is required.\nS:U - The corruption stays within the kernel\u0027s own security authority \u2014 the freed amdgpu_vm/amdgpu_task_info are kernel heap objects, with no crossing of a VM or IOMMU boundary.\nC:H - The stale vm pointer is dereferenced after free, reading vm-\u003etask_info out of reallocated kernel heap memory, and the resulting task_info contents (process name, pid, tgid) are then printed/exported, allowing disclosure of attacker-groomed or unrelated kernel data.\nI:H - kref_get() is performed on memory that may already be freed and reallocated, writing an increment into another object\u0027s fields, and the paired kref_put() can drop a foreign refcount to zero \u2014 a classic use-after-free/refcount-corruption primitive leveraged for arbitrary write and privilege escalation.\nA:H - The use-after-free occurs in a GPU interrupt handler and the reset/timeout path; dereferencing freed memory or corrupting a reused slab object readily oopses or panics the kernel, and it can be retriggered repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:43:38.724Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fe16a7e5336ae888751984e30c451fbf7cfa5df7"
},
{
"url": "https://git.kernel.org/stable/c/1173190412fb9d12e7efce76734118d9712ff970"
},
{
"url": "https://git.kernel.org/stable/c/5d5fb9124a2bba96a7807086d8fe0f7ce810d546"
},
{
"url": "https://git.kernel.org/stable/c/04cc4aa3617b0ed67e859f91f09de5d896a46f3a"
}
],
"title": "drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68245",
"datePublished": "2026-08-10T12:01:11.501Z",
"dateReserved": "2026-07-30T09:28:09.377Z",
"dateUpdated": "2026-10-21T12:43:38.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80985 (GCVE-0-2026-80985)
Vulnerability from cvelistv5
Published
2026-09-11 19:42
Modified
2026-10-19 08:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part
of a v2 message that does not fit into the 44-byte union smc_llc_msg, and
both bound themselves by the size of the buffer it landed in, not by what
arrived. On a link with a shared v2 receive buffer a 44-byte
DELETE_RKEY_V2 declaring 255 rkeys reaches rkey[9..254] in whatever an
earlier message left in lgr->wr_rx_buf_v2, and passes each of them to
smc_rtoken_delete(). One of those 255 matched a registered rtoken and
deleted it. An ADD_LINK on such a link installs up to 255 rtokens from
the same bytes.
Copy the tail into the queue entry, so its length is the length of the
message that arrived, and declare the rkeys that fit inline as a member of
the union instead of reaching them through a cast. The same
DELETE_RKEY_V2 now processes the 9 rkeys it carries. The copy is limited
to the longest tail the two functions can read, so the peer does not pick
the size of the entry.
The bound the previous patch placed on links without a shared v2 receive
buffer is no longer needed.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/smc_llc.c",
"net/smc/smc_wr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "edf30d65e3ac52f886f7d87b1a7449742e79157d",
"status": "affected",
"version": "27ef6a9981fe74191849966a6d5e0400a4008ab8",
"versionType": "git"
},
{
"lessThan": "0d6f80be8ac5886842640d6526abf3f9a215be75",
"status": "affected",
"version": "27ef6a9981fe74191849966a6d5e0400a4008ab8",
"versionType": "git"
},
{
"lessThan": "8d3c1ab82c11d4fadebf817a825fd221b3e197ea",
"status": "affected",
"version": "27ef6a9981fe74191849966a6d5e0400a4008ab8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/smc_llc.c",
"net/smc/smc_wr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: carry oversized SMC-Rv2 LLC messages in the queue entry\n\nsmc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part\nof a v2 message that does not fit into the 44-byte union smc_llc_msg, and\nboth bound themselves by the size of the buffer it landed in, not by what\narrived. On a link with a shared v2 receive buffer a 44-byte\nDELETE_RKEY_V2 declaring 255 rkeys reaches rkey[9..254] in whatever an\nearlier message left in lgr-\u003ewr_rx_buf_v2, and passes each of them to\nsmc_rtoken_delete(). One of those 255 matched a registered rtoken and\ndeleted it. An ADD_LINK on such a link installs up to 255 rtokens from\nthe same bytes.\n\nCopy the tail into the queue entry, so its length is the length of the\nmessage that arrived, and declare the rkeys that fit inline as a member of\nthe union instead of reaching them through a cast. The same\nDELETE_RKEY_V2 now processes the 9 rkeys it carries. The copy is limited\nto the longest tail the two functions can read, so the peer does not pick\nthe size of the entry.\n\nThe bound the previous patch placed on links without a shared v2 receive\nbuffer is no longer needed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote SMC-Rv2 peer delivers DELETE_RKEY_V2 and ADD_LINK LLC messages over the RDMA QP after the TCP CLC handshake; RoCEv2 is IP/UDP-routable (port 4791) and SMC-Rv2 supports routed peers. smc_llc_rx_handler runs from the RDMA completion path with no local syscall.\nAC:L - The attacker controls the prior oversized LLC payload that fills the shared lgr-\u003ewr_rx_buf_v2 spillover and the later 44-byte DELETE_RKEY_V2 or ADD_LINK that declares up to 255 rkeys, so leftover bytes are attacker-chosen. No race, lucky layout, or rare non-default config is required on the usual max_recv_sge\u003e=2 path.\nPR:N - SMC performs no peer authentication; smc_create() has no capability check, and LLC DELETE_RKEY/ADD_LINK run after an unauthenticated CLC handshake. Any network peer that completes SMC-R v2 to a listener reaches smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys().\nUI:N - Incoming LLC messages are demultiplexed from the RDMA receive completion tasklet into smc_llc_event_work. A listening SMC-R server processes DELETE_RKEY_V2 automatically with no victim user action.\nS:U - The corrupted rtoken table lives in the same kernel security authority as the SMC-R stack; this does not cross a VM, IOMMU, or sandbox boundary.\nC:N - Leftover bytes are prior peer LLC payloads in the shared 8KiB wr_rx_buf_v2, not adjacent kernel objects, so the extra rkey walks do not disclose kernel memory. Rtokens are remote keys used only for outbound RDMA writes to that same peer.\nI:L - Leftover rkeys are passed to smc_rtoken_delete() and leftover ADD_LINK extensions are written via smc_rtoken_set(), so registered rtokens can be cleared or remapped on a new link. That is limited corruption of the LGR rtoken table, not an arbitrary kernel write.\nA:H - Deleting a live rtoken zeros its rkey and dma_addr while connections still use that slot, so later smc_tx_rdma_write() posts fail and smcr_link_down tears down the link group. A peer can repeat this at will and fully deny SMC-R on the LGR."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:46:09.624Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/edf30d65e3ac52f886f7d87b1a7449742e79157d"
},
{
"url": "https://git.kernel.org/stable/c/0d6f80be8ac5886842640d6526abf3f9a215be75"
},
{
"url": "https://git.kernel.org/stable/c/8d3c1ab82c11d4fadebf817a825fd221b3e197ea"
}
],
"title": "net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80985",
"datePublished": "2026-09-11T19:42:44.243Z",
"dateReserved": "2026-08-26T14:34:25.811Z",
"dateUpdated": "2026-10-19T08:46:09.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90036 (GCVE-0-2026-90036)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent client use-after-free during blocked-lock reaping
A bare lock owner -- its only remaining reference a blocked lock on
nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but
no reference keeping the client alive. When the per-net laundromat
reaps such a lock, freeing the nbl drops the owner reference
held through flc_owner, and the final nfs4_put_stateowner()
takes the client's cl_lock. Because the laundromat detaches the
nbl first, __destroy_client() no longer finds it, so a concurrent
force_expire_client() can free the client before nfs4_put_stateowner()
runs, dereferencing cl_lock in freed memory.
Pin the client with cl_rpc_users before dropping
nn->blocked_locks_lock, and skip clients already expiring, whose
blocked locks __destroy_client() frees while holding an owner
reference. Take nn->client_lock outside nn->blocked_locks_lock.
Every other site holds nn->blocked_locks_lock as a leaf, acquiring
no further lock, so placing nn->client_lock outside it cannot form
a lock-order cycle.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0d53a47c913d0bce3b5ec35c28cbcca4d015f33d",
"status": "affected",
"version": "7919d0a27f1e7cb324e023776aa1cbff00f1ee7b",
"versionType": "git"
},
{
"lessThan": "7081224a59a0ca4edcd62c068588f4d900199a18",
"status": "affected",
"version": "7919d0a27f1e7cb324e023776aa1cbff00f1ee7b",
"versionType": "git"
},
{
"lessThan": "cd489b03587378645fe0d20142a33f1ed60bac98",
"status": "affected",
"version": "7919d0a27f1e7cb324e023776aa1cbff00f1ee7b",
"versionType": "git"
},
{
"lessThan": "6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0",
"status": "affected",
"version": "7919d0a27f1e7cb324e023776aa1cbff00f1ee7b",
"versionType": "git"
},
{
"lessThan": "9026932ac8be4d0ae01db47f23619a98cc57b671",
"status": "affected",
"version": "7919d0a27f1e7cb324e023776aa1cbff00f1ee7b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent client use-after-free during blocked-lock reaping\n\nA bare lock owner -- its only remaining reference a blocked lock on\nnn-\u003eblocked_locks_lru -- holds a raw pointer to its nfs4_client but\nno reference keeping the client alive. When the per-net laundromat\nreaps such a lock, freeing the nbl drops the owner reference\nheld through flc_owner, and the final nfs4_put_stateowner()\ntakes the client\u0027s cl_lock. Because the laundromat detaches the\nnbl first, __destroy_client() no longer finds it, so a concurrent\nforce_expire_client() can free the client before nfs4_put_stateowner()\nruns, dereferencing cl_lock in freed memory.\n\nPin the client with cl_rpc_users before dropping\nnn-\u003eblocked_locks_lock, and skip clients already expiring, whose\nblocked locks __destroy_client() frees while holding an owner\nreference. Take nn-\u003eclient_lock outside nn-\u003eblocked_locks_lock.\nEvery other site holds nn-\u003eblocked_locks_lock as a leaf, acquiring\nno further lock, so placing nn-\u003eclient_lock outside it cannot form\na lock-order cycle."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - NFSD is the in-kernel NFS server; the UAF is reached by remote NFSv4.1 COMPOUND RPCs over TCP/UDP 2049 (EXCHANGE_ID, CREATE_SESSION, OPEN, blocking LOCK, DESTROY_SESSION, DESTROY_CLIENTID) that queue a blocked lock and expire the client while nfs4_laundromat() reaps it.\nAC:L - The attacker controls both sides: one client holds a conflicting lock while another queues a FILE_LOCK_DEFERRED blocked lock (bare lockowner), then DESTROY_CLIENTID races with laundromat free_blocked_lock() after nbl detach; concurrent compounds create the race and it is retryable.\nPR:N - Typical nfsd deployments use AUTH_SYS/AUTH_NULL with no cryptographic RPC authentication. A remote peer that can reach an export can create NFSv4.1 state and issue DESTROY_CLIENTID (ALLOWED_WITHOUT_FH) without a local account or kernel capabilities on the server.\nUI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export. No victim user action such as mounting a filesystem or opening a local file on the server is required.\nS:U - The use-after-free is of struct nfs4_client in the NFS server kernel and does not cross a separate security authority such as a VM, guest/host, sandbox, or IOMMU boundary.\nC:H - free_blocked_lock() drops flc_owner into nfs4_put_stateowner(), which takes cl_lock on a nfs4_client already freed by concurrent expire_client(). The mergeable client_slab object (KMEM_CACHE flags 0) can be reclaimed via EXCHANGE_ID to disclose kernel memory.\nI:H - nfs4_put_stateowner() does atomic_dec_and_lock on the freed client\u0027s cl_lock and so_unhash walks client-owned lists; reclaiming the nfs4_client slab enables heap corruption and control-flow hijack. Kernel guidance scores use-after-free as I:H.\nA:H - Use-after-free of nfs4_client (spin_lock of freed cl_lock) in the laundromat worker oopses or panics the NFS server even without full exploitation, fully denying service of the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:32.115Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d53a47c913d0bce3b5ec35c28cbcca4d015f33d"
},
{
"url": "https://git.kernel.org/stable/c/7081224a59a0ca4edcd62c068588f4d900199a18"
},
{
"url": "https://git.kernel.org/stable/c/cd489b03587378645fe0d20142a33f1ed60bac98"
},
{
"url": "https://git.kernel.org/stable/c/6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0"
},
{
"url": "https://git.kernel.org/stable/c/9026932ac8be4d0ae01db47f23619a98cc57b671"
}
],
"title": "NFSD: Prevent client use-after-free during blocked-lock reaping",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90036",
"datePublished": "2026-09-16T10:33:35.967Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-10-21T12:49:32.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72318 (GCVE-0-2026-72318)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cifs: validate DFS referral string offsets
parse_dfs_referrals() validates that the response header and referral
array fit in the received buffer, but each referral also contains string
offsets supplied by the server.
Those offsets are used to compute the DfsPath and NetworkAddress string
pointers without checking whether they still point inside the response
buffer. A malformed referral can therefore make the computed pointer
exceed the end of the buffer. The resulting negative max_len is then
passed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it
to kstrndup() as a size_t, allowing strnlen() to read out of bounds.
Validate each string offset before deriving the string pointer.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4ecce920e13ace16a5ba45efe8909946c28fb2ad Version: 4ecce920e13ace16a5ba45efe8909946c28fb2ad Version: 4ecce920e13ace16a5ba45efe8909946c28fb2ad Version: 4ecce920e13ace16a5ba45efe8909946c28fb2ad Version: 4ecce920e13ace16a5ba45efe8909946c28fb2ad Version: 4ecce920e13ace16a5ba45efe8909946c28fb2ad |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72318",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:46:37.626528Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:17.318Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "76c607b9353d377b1d1b11db50e743eee0ccf658",
"status": "affected",
"version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
"versionType": "git"
},
{
"lessThan": "d64b6be5740ce230aca184d8d224c75d9866045d",
"status": "affected",
"version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
"versionType": "git"
},
{
"lessThan": "929a85932d14190988f1eafd6ee8cc68d66ace0b",
"status": "affected",
"version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
"versionType": "git"
},
{
"lessThan": "b784cd1c24d89bf71be2efe1e948ff7c03371e57",
"status": "affected",
"version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
"versionType": "git"
},
{
"lessThan": "c37abc99bb3de3d3219ecef253d649f74117fd83",
"status": "affected",
"version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
"versionType": "git"
},
{
"lessThan": "027a84ac6b50c12ef767c15abfc58aa865820e9e",
"status": "affected",
"version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: validate DFS referral string offsets\n\nparse_dfs_referrals() validates that the response header and referral\narray fit in the received buffer, but each referral also contains string\noffsets supplied by the server.\n\nThose offsets are used to compute the DfsPath and NetworkAddress string\npointers without checking whether they still point inside the response\nbuffer. A malformed referral can therefore make the computed pointer\nexceed the end of the buffer. The resulting negative max_len is then\npassed to cifs_strndup_from_utf16(), and the non-Unicode path forwards it\nto kstrndup() as a size_t, allowing strnlen() to read out of bounds.\n\nValidate each string offset before deriving the string pointer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote malicious SMB/DFS server delivers the malformed DFS referral reply over the network when the CIFS client issues FSCTL_DFS_GET_REFERRALS (SMB2) or TRANS2_GET_DFS_REFERRAL (SMB1); no local or physical access is required to reach parse_dfs_referrals().\nAC:L - Once a client session exists, the attacker fully controls referral header fields and per-entry DfsPathOffset/NetworkAddressOffset in the reply; no races, timing, or victim-specific memory layout are needed to trigger the out-of-bounds read reliably.\nPR:N - Exploitation requires no privileges on the victim host\u2014the attacker only needs to operate the SMB server returning the malicious DFS referral; the client kernel parses the response regardless of which local user triggered the referral lookup.\nUI:N - After a DFS CIFS mount or autofs/enterprise logon mount, referral lookups and periodic dfs_cache_refresh work run automatically on file access and reconnect without any additional deliberate user action beyond normal SMB/DFS client use.\nS:U - The flaw corrupts/confidentiality-impacts kernel memory in the same security authority as the CIFS client; it does not by itself cross a hypervisor, IOMMU, or container sandbox boundary distinct from standard kernel compromise.\nC:H - Unvalidated string offsets let DfsPath/NetworkAddress pointers sit past the response buffer; the resulting negative max_len is cast to size_t for kstrndup()/strnlen(), enabling large out-of-bounds reads of adjacent kernel memory (SMB1/non-Unicode path).\nI:L - The bug is an out-of-bounds read that copies attacker-influenced kernel bytes into newly allocated heap buffers rather than an arbitrary write primitive, but heap contents are modified beyond the intended referral data scope.\nA:H - Reading past the SMB response buffer can oops/panic the kernel on unmapped pages, and casting a negative max_len to size_t can drive very large strnlen()/allocation attempts, causing severe denial of service on servers and workstations using DFS mounts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:42:44.209Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/76c607b9353d377b1d1b11db50e743eee0ccf658"
},
{
"url": "https://git.kernel.org/stable/c/d64b6be5740ce230aca184d8d224c75d9866045d"
},
{
"url": "https://git.kernel.org/stable/c/929a85932d14190988f1eafd6ee8cc68d66ace0b"
},
{
"url": "https://git.kernel.org/stable/c/b784cd1c24d89bf71be2efe1e948ff7c03371e57"
},
{
"url": "https://git.kernel.org/stable/c/c37abc99bb3de3d3219ecef253d649f74117fd83"
},
{
"url": "https://git.kernel.org/stable/c/027a84ac6b50c12ef767c15abfc58aa865820e9e"
}
],
"title": "cifs: validate DFS referral string offsets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72318",
"datePublished": "2026-08-15T05:55:31.682Z",
"dateReserved": "2026-08-09T03:40:39.919Z",
"dateUpdated": "2026-10-16T18:55:17.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46309 (GCVE-0-2026-46309)
Vulnerability from cvelistv5
Published
2026-06-08 15:50
Modified
2026-07-15 00:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
Add validation in xe_vm_madvise_ioctl() to reject PAT indices with
XE_COH_NONE coherency mode when applied to CPU cached memory.
Using coh_none with CPU cached buffers is a security issue. When the
kernel clears pages before reallocation, the clear operation stays in
CPU cache (dirty). GPU with coh_none can bypass CPU caches and read
stale sensitive data directly from DRAM, potentially leaking data from
previously freed pages of other processes.
This aligns with the existing validation in vm_bind path
(xe_vm_bind_ioctl_validate_bo).
v2(Matthew brost)
- Add fixes
- Move one debug print to better place
v3(Matthew Auld)
- Should be drm/xe/uapi
- More Cc
v4(Shuicheng Lin)
- Fix kmem leak issues by the way
v5
- Remove kmem leak because it has been merged by another patch
v6
- Remove the fix which is not related to current fix
v7
- No change
v8
- Rebase
v9
- Limit the restrictions to iGPU
v10
- No change
(cherry picked from commit 016ccdb674b8c899940b3944952c96a6a490d10a)
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s drm/xe/uapi component. This vulnerability allows a Graphics Processing Unit (GPU) using coh_none coherency mode to bypass CPU caches and read stale sensitive data directly from Dynamic Random-Access Memory (DRAM). This can lead to information disclosure, where data from previously freed pages of other processes may be leaked."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-524",
"description": "Use of Cache Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:50:51.323Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46309"
},
{
"name": "RHBZ#2486468",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486468"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46309.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-08T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-08T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_vm_madvise.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "87f9b1528e1ffc1da3615d552c9a06aba5e20b00",
"status": "affected",
"version": "ada7486c5668db542a7d361268df931aca5b726a",
"versionType": "git"
},
{
"lessThan": "fea04cf6f2345bc50f15b6638906c35962b89424",
"status": "affected",
"version": "ada7486c5668db542a7d361268df931aca5b726a",
"versionType": "git"
},
{
"lessThan": "4e5591c2fc1b30f4ea5e2eab4c3a695acc404e39",
"status": "affected",
"version": "ada7486c5668db542a7d361268df931aca5b726a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_vm_madvise.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise\n\nAdd validation in xe_vm_madvise_ioctl() to reject PAT indices with\nXE_COH_NONE coherency mode when applied to CPU cached memory.\n\nUsing coh_none with CPU cached buffers is a security issue. When the\nkernel clears pages before reallocation, the clear operation stays in\nCPU cache (dirty). GPU with coh_none can bypass CPU caches and read\nstale sensitive data directly from DRAM, potentially leaking data from\npreviously freed pages of other processes.\n\nThis aligns with the existing validation in vm_bind path\n(xe_vm_bind_ioctl_validate_bo).\n\nv2(Matthew brost)\n- Add fixes\n- Move one debug print to better place\n\nv3(Matthew Auld)\n- Should be drm/xe/uapi\n- More Cc\n\nv4(Shuicheng Lin)\n- Fix kmem leak issues by the way\n\nv5\n- Remove kmem leak because it has been merged by another patch\n\nv6\n- Remove the fix which is not related to current fix\n\nv7\n- No change\n\nv8\n- Rebase\n\nv9\n- Limit the restrictions to iGPU\n\nv10\n- No change\n\n(cherry picked from commit 016ccdb674b8c899940b3944952c96a6a490d10a)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:08:12.426Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/87f9b1528e1ffc1da3615d552c9a06aba5e20b00"
},
{
"url": "https://git.kernel.org/stable/c/fea04cf6f2345bc50f15b6638906c35962b89424"
},
{
"url": "https://git.kernel.org/stable/c/4e5591c2fc1b30f4ea5e2eab4c3a695acc404e39"
}
],
"title": "drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46309",
"datePublished": "2026-06-08T15:50:39.689Z",
"dateReserved": "2026-05-13T15:03:33.111Z",
"dateUpdated": "2026-07-15T00:50:51.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93262 (GCVE-0-2026-93262)
Vulnerability from cvelistv5
Published
2026-09-24 15:52
Modified
2026-10-19 09:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md/raid5-ppl: fix use-after-free in ppl_do_flush()
The loop in ppl_do_flush() continues iterating after calling
ppl_io_unit_finished(), touching io->pending_flushes and leading to a
use-after-free.
Add a break statement to stop the loop once io is freed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 Version: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 Version: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 Version: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 Version: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 Version: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 Version: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 Version: 1532d9e87e8b2377f12929f9e40724d5fbe6ecc5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/raid5-ppl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cf01f9413565e86673baf927291a088b6975692b",
"status": "affected",
"version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
"versionType": "git"
},
{
"lessThan": "e7505842f1329ece90cb9ea0db87772aeca44052",
"status": "affected",
"version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
"versionType": "git"
},
{
"lessThan": "b5123bf667ac29ddd8106f9ca7cc01316513ae66",
"status": "affected",
"version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
"versionType": "git"
},
{
"lessThan": "e77c80670f2c2bf491da9b173931e1da4677c23a",
"status": "affected",
"version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
"versionType": "git"
},
{
"lessThan": "8914c3d40870f16429a326e97e4016bedc6ede4c",
"status": "affected",
"version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
"versionType": "git"
},
{
"lessThan": "455b56209f9615c3902dcc398dd867abb5ade3ab",
"status": "affected",
"version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
"versionType": "git"
},
{
"lessThan": "fcf21df7d3c50c8ebeb0757df5d21b02dcae4218",
"status": "affected",
"version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
"versionType": "git"
},
{
"lessThan": "371f7a1b392edc8b7cf449cc7713179b588f2d0e",
"status": "affected",
"version": "1532d9e87e8b2377f12929f9e40724d5fbe6ecc5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/raid5-ppl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5-ppl: fix use-after-free in ppl_do_flush()\n\nThe loop in ppl_do_flush() continues iterating after calling\nppl_io_unit_finished(), touching io-\u003epending_flushes and leading to a\nuse-after-free.\n\nAdd a break statement to stop the loop once io is freed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The patched ppl_do_flush() runs from ppl_stripe_write_finished() after RAID5 stripe data+parity I/O completes. Those writes enter via md_submit_bio() -\u003e raid5_make_request() from local write(2) to a filesystem or /dev/md*; ppl_submit_iounit() only sets disk_flush_bitmap from local stripe R5_Wantwrite/wb_cache_on state, not from a network protocol message.\nAC:L - Writes the attacker issues are logged by ppl_write_stripe()/ppl_log_stripe() and ppl_submit_iounit() sets disk_flush_bitmap for child_logs[i].wb_cache_on members. When pending_stripes hits 0, ppl_stripe_write_finished() calls ppl_do_flush(); the remainder loop\u0027s missing break after ppl_io_unit_finished() is a logic bug on that path, not a second-actor race or a disk-fault precondition.\nPR:L - md_submit_bio() and raid5_make_request() have no capability check; md_ioctl()\u0027s capable(CAP_SYS_ADMIN) applies only to array-management ioctls, not I/O. An unprivileged user who can write a filesystem on the RAID5+PPL array (or /dev/md* with disk-group write access) reaches ppl_do_flush() without init-namespace root.\nUI:N - The attacker triggers ppl_do_flush() through their own writes: raid5 handle_stripe()/handle_stripe_clean_event() calls ppl_stripe_write_finished() on I/O they submitted. No victim action such as mounting an image or plugging a device is required.\nS:U - ppl_io_unit_finished() mempool_free()s the ppl_io_unit from ppl_conf-\u003eio_pool in the host md/raid5 kernel. The later dangling atomic_dec_and_test(\u0026io-\u003epending_flushes) in ppl_do_flush() stays in that kernel\u0027s authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - ppl_io_unit_finished() returns the ppl_io_unit to io_pool via mempool_free(); ppl_do_flush()\u0027s remainder loop then does atomic_dec_and_test(\u0026io-\u003epending_flushes) on that freed kmem_cache object. A UAF of the recycled io_unit header is a kernel read primitive against adjacent/reconstituted pool memory.\nI:H - The same dangling io is a writeable ppl_io_unit: atomic_dec_and_test() mutates pending_flushes on a recycled object, and another true dec_and_test would call ppl_io_unit_finished() again (list_del/mempool_free of a live unit). That is a kernel write/double-free primitive on the PPL io_unit cache.\nA:H - Use-after-free of the mempool ppl_io_unit in ppl_do_flush() after ppl_io_unit_finished() can oops on the stale pending_flushes access or corrupt list_del() pointers in a second finish, panicking the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:08:15.484Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cf01f9413565e86673baf927291a088b6975692b"
},
{
"url": "https://git.kernel.org/stable/c/e7505842f1329ece90cb9ea0db87772aeca44052"
},
{
"url": "https://git.kernel.org/stable/c/b5123bf667ac29ddd8106f9ca7cc01316513ae66"
},
{
"url": "https://git.kernel.org/stable/c/e77c80670f2c2bf491da9b173931e1da4677c23a"
},
{
"url": "https://git.kernel.org/stable/c/8914c3d40870f16429a326e97e4016bedc6ede4c"
},
{
"url": "https://git.kernel.org/stable/c/455b56209f9615c3902dcc398dd867abb5ade3ab"
},
{
"url": "https://git.kernel.org/stable/c/fcf21df7d3c50c8ebeb0757df5d21b02dcae4218"
},
{
"url": "https://git.kernel.org/stable/c/371f7a1b392edc8b7cf449cc7713179b588f2d0e"
}
],
"title": "md/raid5-ppl: fix use-after-free in ppl_do_flush()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93262",
"datePublished": "2026-09-24T15:52:01.886Z",
"dateReserved": "2026-09-17T16:02:15.097Z",
"dateUpdated": "2026-10-19T09:08:15.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64007 (GCVE-0-2026-64007)
Vulnerability from cvelistv5
Published
2026-07-19 14:56
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: synproxy: refresh tcphdr after skb_ensure_writable
synproxy_tstamp_adjust() rewrites the TCP timestamp option in place
and then patches the TCP checksum via inet_proto_csum_replace4() on
the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and
ipv6_synproxy_hook() obtain that pointer with skb_header_pointer()
before calling in, so it may either alias skb->head directly or
point at the caller's on-stack _tcph buffer.
Between obtaining the pointer and using it, the function calls
skb_ensure_writable(skb, optend), which on a cloned or non-linear
skb invokes pskb_expand_head() and frees the old skb->head. After
that point the cached th is stale:
caller (ipv[46]_synproxy_hook)
th = skb_header_pointer(skb, ..., &_tcph)
synproxy_tstamp_adjust(skb, protoff, th, ...)
skb_ensure_writable(skb, optend)
pskb_expand_head() /* kfree(old skb->head) */
...
inet_proto_csum_replace4(&th->check, ...)
/* writes into freed head, or
into the caller's stack copy
leaving the on-wire checksum
stale */
The option bytes are written through skb->data and are fine; only
the checksum update goes through th and so lands in the wrong
place. The result is either a write into freed slab memory or a
packet leaving with a checksum that does not match its payload.
Fix by re-deriving th from skb->data + protoff immediately after
skb_ensure_writable() succeeds, so the subsequent checksum update
targets the linear, writable header.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad Version: 48b1de4c110a7afa4b85862f6c75af817db26fad |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64007",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:12.812094Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:08.086Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_synproxy_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9902a1058992de5d95656b64a3bd95c077f7ba2c",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "d3019c61799adc21811af4b521f11f3dc77f8e04",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "dd206819f210522579010d889d45a9530bb494bc",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "af2c22ccb1f621aff487ff47a040e38e058541e7",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "c7f945f7da097245a2f8ed7775ce48421047ee96",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "f0fea2b6d5453a11ad11713bbf37561b9b3a7edf",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "a91887a5b6ee4b98dfbf1db657ed2b879430149e",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
},
{
"lessThan": "92170e6afe927ab2792a3f71902845789c8e31b1",
"status": "affected",
"version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_synproxy_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: refresh tcphdr after skb_ensure_writable\n\nsynproxy_tstamp_adjust() rewrites the TCP timestamp option in place\nand then patches the TCP checksum via inet_proto_csum_replace4() on\nthe caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()\nbefore calling in, so it may either alias skb-\u003ehead directly or\npoint at the caller\u0027s on-stack _tcph buffer.\n\nBetween obtaining the pointer and using it, the function calls\nskb_ensure_writable(skb, optend), which on a cloned or non-linear\nskb invokes pskb_expand_head() and frees the old skb-\u003ehead. After\nthat point the cached th is stale:\n\n caller (ipv[46]_synproxy_hook)\n th = skb_header_pointer(skb, ..., \u0026_tcph)\n synproxy_tstamp_adjust(skb, protoff, th, ...)\n skb_ensure_writable(skb, optend)\n pskb_expand_head() /* kfree(old skb-\u003ehead) */\n ...\n inet_proto_csum_replace4(\u0026th-\u003echeck, ...)\n /* writes into freed head, or\n into the caller\u0027s stack copy\n leaving the on-wire checksum\n stale */\n\nThe option bytes are written through skb-\u003edata and are fine; only\nthe checksum update goes through th and so lands in the wrong\nplace. The result is either a write into freed slab memory or a\npacket leaving with a checksum that does not match its payload.\n\nFix by re-deriving th from skb-\u003edata + protoff immediately after\nskb_ensure_writable() succeeds, so the subsequent checksum update\ntargets the linear, writable header."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is triggered when remote TCP packets traverse SYNPROXY netfilter hooks (NF_INET_LOCAL_IN / NF_INET_POST_ROUTING) on a host with SYNPROXY configured, which is the standard internet-facing firewall/router deployment for this subsystem.\nAC:L - An attacker who controls a TCP session through SYNPROXY can reliably send timestamp-bearing packets to hit the vulnerable path; the stale-pointer UAF write occurs whenever skb_ensure_writable() must expand a cloned skb, which the attacker can influence by sustaining traffic on the proxied connection.\nPR:N - Exploitation requires only that the victim already runs SYNPROXY (normal for protected services); the remote attacker needs no credentials or local privileges on the target system to send the triggering TCP packets.\nUI:N - No victim user action is required beyond normal network operation; exploitation is fully automated via crafted or sustained TCP traffic through the SYNPROXY session.\nS:U - Impact is confined to kernel memory on the affected host running SYNPROXY; this is standard kernel privilege escalation/memory corruption, not a cross-VM or cross-security-boundary escape.\nC:H - The stale tcphdr pointer causes inet_proto_csum_replace4() to write into freed slab memory, a use-after-free class bug that can be leveraged for arbitrary kernel memory read via heap grooming techniques.\nI:H - The out-of-bounds write into freed slab memory via a stale tcphdr pointer is a use-after-free write primitive that can be developed into arbitrary kernel memory writes and local privilege escalation.\nA:H - Writing into freed slab memory can corrupt adjacent kernel objects and cause kernel oops, panic, or crash, and UAF conditions are inherently capable of destabilizing the system even during exploitation attempts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:06.995Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c"
},
{
"url": "https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04"
},
{
"url": "https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc"
},
{
"url": "https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7"
},
{
"url": "https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96"
},
{
"url": "https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf"
},
{
"url": "https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e"
},
{
"url": "https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1"
}
],
"title": "netfilter: synproxy: refresh tcphdr after skb_ensure_writable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64007",
"datePublished": "2026-07-19T14:56:23.049Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-10-19T20:28:08.086Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72130 (GCVE-0-2026-72130)
Vulnerability from cvelistv5
Published
2026-08-15 05:53
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: reject short AUTH_RECEIVE buffers
nvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length
after checking only that it is nonzero and matches the transfer length.
In the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF
initiator reach the fixed-size DH-HMAC-CHAP response builders with a
kmalloc() buffer shorter than the response, so nvmet_auth_success1() and
nvmet_auth_failure1() write past the allocation; both only WARN_ON the
short length and then format the message anyway.
Impact: A remote NVMe-oF initiator with access to an auth-enabled target
can trigger a 16-byte heap out-of-bounds write via a one-byte
AUTH_RECEIVE allocation length.
Compute the minimum response length for the current DH-HMAC-CHAP step in
nvmet_auth_receive_data_len() and report a zero data length when the
host-supplied allocation length is shorter, so the existing zero-length
check in nvmet_execute_auth_receive() rejects the command before any
builder runs. The SUCCESS1 minimum is sizeof(struct
nvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the
response hash is written into the rval[] flexible-array tail, so the
minimum is state dependent rather than a flat sizeof. CHALLENGE keeps its
existing variable-length guard in nvmet_auth_challenge().
This is reachable only when in-band DH-HMAC-CHAP authentication is
configured on the target.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72130",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:42:34.388225Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:44:58.498Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fabrics-cmd-auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "584d7d14d9b40b080b1195cec83de86ade63343e",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "80bf7b7f676e3987bbe06af3c359bd56ac91a5a9",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "2eaa3ad450141cfcf187bb43cb8335eb336b5f87",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "bc111698b46e43eddd8664cceaa621cd559e99a0",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
},
{
"lessThan": "779575bc35c687697ba69e904f2cd22e60112534",
"status": "affected",
"version": "db1312dd95488b5e6ff362ff66fcf953a46b1821",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/fabrics-cmd-auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: reject short AUTH_RECEIVE buffers\n\nnvmet_execute_auth_receive() trusts the AUTH_RECEIVE allocation length\nafter checking only that it is nonzero and matches the transfer length.\nIn the SUCCESS1 and FAILURE1/default states, that lets a remote NVMe-oF\ninitiator reach the fixed-size DH-HMAC-CHAP response builders with a\nkmalloc() buffer shorter than the response, so nvmet_auth_success1() and\nnvmet_auth_failure1() write past the allocation; both only WARN_ON the\nshort length and then format the message anyway.\n\nImpact: A remote NVMe-oF initiator with access to an auth-enabled target\ncan trigger a 16-byte heap out-of-bounds write via a one-byte\nAUTH_RECEIVE allocation length.\n\nCompute the minimum response length for the current DH-HMAC-CHAP step in\nnvmet_auth_receive_data_len() and report a zero data length when the\nhost-supplied allocation length is shorter, so the existing zero-length\ncheck in nvmet_execute_auth_receive() rejects the command before any\nbuilder runs. The SUCCESS1 minimum is sizeof(struct\nnvmf_auth_dhchap_success1_data) plus the HMAC hash length, because the\nresponse hash is written into the rval[] flexible-array tail, so the\nminimum is state dependent rather than a flat sizeof. CHALLENGE keeps its\nexisting variable-length guard in nvmet_auth_challenge().\n\nThis is reachable only when in-band DH-HMAC-CHAP authentication is\nconfigured on the target."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in nvmet DH-HMAC-CHAP AUTH_RECEIVE handling reached by remote NVMe-oF initiators over network transports (nvmet-tcp/RDMA/FC); malicious allocation length arrives in a Fabrics command capsule from the network.\nAC:L - Once an auth-enabled target is reachable, the attacker fully controls AUTH_RECEIVE allocation length and can reliably reach vulnerable states (e.g. default NEGOTIATE branch or FAILURE1) without conditions beyond their control.\nPR:N - Exploitation occurs on the pre-authentication DH-HMAC-CHAP handshake before credentials are verified; no Linux privileges on the target are required, only network access to an auth-configured NVMe-oF target port.\nUI:N - No victim user action is required beyond the administrator having already deployed an NVMe-oF target; exploitation is driven entirely by attacker-sent Fabrics authentication commands.\nS:U - Impact is kernel heap memory corruption within the NVMe target subsystem on the same host; it does not cross a VM/hypervisor or IOMMU security boundary by itself.\nC:H - A controlled heap out-of-bounds write (up to 16 bytes plus optional HMAC tail in SUCCESS1) can corrupt adjacent kmalloc objects and be leveraged for kernel information disclosure, per memory-corruption guidance.\nI:H - The vulnerability is a heap out-of-bounds write in kernel context; such corruption is exploitable for arbitrary memory modification and potential code execution, not merely a bounded logic error.\nA:H - Heap corruption can cause kernel oops/panic, and the FAILURE1 AUTH_RECEIVE completion path calls nvmet_ctrl_fatal_error(), taking down the NVMe controller and denying service to connected initiators."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:23.088Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/584d7d14d9b40b080b1195cec83de86ade63343e"
},
{
"url": "https://git.kernel.org/stable/c/80bf7b7f676e3987bbe06af3c359bd56ac91a5a9"
},
{
"url": "https://git.kernel.org/stable/c/2eaa3ad450141cfcf187bb43cb8335eb336b5f87"
},
{
"url": "https://git.kernel.org/stable/c/bc111698b46e43eddd8664cceaa621cd559e99a0"
},
{
"url": "https://git.kernel.org/stable/c/779575bc35c687697ba69e904f2cd22e60112534"
}
],
"title": "nvmet-auth: reject short AUTH_RECEIVE buffers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72130",
"datePublished": "2026-08-15T05:53:06.604Z",
"dateReserved": "2026-08-09T03:40:39.907Z",
"dateUpdated": "2026-10-21T12:44:23.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80887 (GCVE-0-2026-80887)
Vulnerability from cvelistv5
Published
2026-09-04 17:11
Modified
2026-09-04 17:11
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vmwgfx: use check_add_overflow for shader size+offset bound
vmw_shader_define() validates the user-supplied shader window against
its backing buffer with
(u64)buffer->tbo.base.size < (u64)size + (u64)offset
drm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is
near U64_MAX the unsigned addition wraps and the resulting tiny value
passes the check. The unbounded offset is then stored in
res->guest_memory_offset and forwarded to host SVGA shader-create
commands.
Use check_add_overflow() to detect the wrap and compare the resulting
endpoint against the buffer size.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_shader.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1bbe7751f5ebac383405ef29a66622d65bd505d3",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
},
{
"lessThan": "d3f44438aa805270aaead3b6840ccaea0f4c11f9",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
},
{
"lessThan": "cfd163169af3be56eaef113c680ea251f0d09189",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
},
{
"lessThan": "5c725901908eb1e52a16fc0e2373cb761df42d21",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
},
{
"lessThan": "54d56d5b42d2e4c72ba6e365e9774da90698aa22",
"status": "affected",
"version": "668b206601c5f5063e03b76784a0d3024fa2b249",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vmwgfx/vmwgfx_shader.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: use check_add_overflow for shader size+offset bound\n\nvmw_shader_define() validates the user-supplied shader window against\nits backing buffer with\n\n\t(u64)buffer-\u003etbo.base.size \u003c (u64)size + (u64)offset\n\ndrm_vmw_shader_create_arg::offset is __u64 in the uapi; when it is\nnear U64_MAX the unsigned addition wraps and the resulting tiny value\npasses the check. The unbounded offset is then stored in\nres-\u003eguest_memory_offset and forwarded to host SVGA shader-create\ncommands.\n\nUse check_add_overflow() to detect the wrap and compare the resulting\nendpoint against the buffer size."
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:11:04.063Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1bbe7751f5ebac383405ef29a66622d65bd505d3"
},
{
"url": "https://git.kernel.org/stable/c/d3f44438aa805270aaead3b6840ccaea0f4c11f9"
},
{
"url": "https://git.kernel.org/stable/c/cfd163169af3be56eaef113c680ea251f0d09189"
},
{
"url": "https://git.kernel.org/stable/c/5c725901908eb1e52a16fc0e2373cb761df42d21"
},
{
"url": "https://git.kernel.org/stable/c/54d56d5b42d2e4c72ba6e365e9774da90698aa22"
}
],
"title": "drm/vmwgfx: use check_add_overflow for shader size+offset bound",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80887",
"datePublished": "2026-09-04T17:11:04.063Z",
"dateReserved": "2026-08-26T14:34:25.799Z",
"dateUpdated": "2026-09-04T17:11:04.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63899 (GCVE-0-2026-63899)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-07-19 14:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: mxuport: fix memory corruption with small endpoint
Make sure that the bulk-out endpoint max packet size is at least eight
bytes to avoid user-controlled slab corruption should a malicious device
report a smaller size.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e Version: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e Version: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e Version: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e Version: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e Version: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e Version: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e Version: ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/mxuport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "086b858b5f5125bc9d967ea2bd825f83d9f8f29d",
"status": "affected",
"version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
"versionType": "git"
},
{
"lessThan": "2f3661eb2446e1ef593da45e01a3b21a906768ec",
"status": "affected",
"version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
"versionType": "git"
},
{
"lessThan": "ccbec56f2f9af008f1574335cc6a668f16603e47",
"status": "affected",
"version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
"versionType": "git"
},
{
"lessThan": "be3a1ed4ae51fa8dde57383277d336ce834f2cd9",
"status": "affected",
"version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
"versionType": "git"
},
{
"lessThan": "e906545641d34fb1a09a65b4b5cfdff40eb09681",
"status": "affected",
"version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
"versionType": "git"
},
{
"lessThan": "6c0cf56f00f280d72180bb6ce79741bc787a6269",
"status": "affected",
"version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
"versionType": "git"
},
{
"lessThan": "b40166b4ef96067620a0f248e74ad9658c8f680c",
"status": "affected",
"version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
"versionType": "git"
},
{
"lessThan": "4085f0dbb1ce2251c9a5938d693de6593f0ab2bd",
"status": "affected",
"version": "ee467a1f2066d2bfa293f7c2c7f1ff7000b0a39e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/mxuport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: mxuport: fix memory corruption with small endpoint\n\nMake sure that the bulk-out endpoint max packet size is at least eight\nbytes to avoid user-controlled slab corruption should a malicious device\nreport a smaller size."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-19T14:55:08.116Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/086b858b5f5125bc9d967ea2bd825f83d9f8f29d"
},
{
"url": "https://git.kernel.org/stable/c/2f3661eb2446e1ef593da45e01a3b21a906768ec"
},
{
"url": "https://git.kernel.org/stable/c/ccbec56f2f9af008f1574335cc6a668f16603e47"
},
{
"url": "https://git.kernel.org/stable/c/be3a1ed4ae51fa8dde57383277d336ce834f2cd9"
},
{
"url": "https://git.kernel.org/stable/c/e906545641d34fb1a09a65b4b5cfdff40eb09681"
},
{
"url": "https://git.kernel.org/stable/c/6c0cf56f00f280d72180bb6ce79741bc787a6269"
},
{
"url": "https://git.kernel.org/stable/c/b40166b4ef96067620a0f248e74ad9658c8f680c"
},
{
"url": "https://git.kernel.org/stable/c/4085f0dbb1ce2251c9a5938d693de6593f0ab2bd"
}
],
"title": "USB: serial: mxuport: fix memory corruption with small endpoint",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63899",
"datePublished": "2026-07-19T14:55:08.116Z",
"dateReserved": "2026-07-19T07:54:57.019Z",
"dateUpdated": "2026-07-19T14:55:08.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72262 (GCVE-0-2026-72262)
Vulnerability from cvelistv5
Published
2026-08-15 05:54
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get
The ipc_control_data buffer is allocated as kzalloc(max_size), where
max_size covers the entire struct sof_ipc_ctrl_data including its
flexible array payload. However, the bounds checks in bytes_ext_put
and _bytes_ext_get compared user data lengths against max_size
directly, ignoring that cdata->data sits at an offset of
sizeof(struct sof_ipc_ctrl_data) bytes into the allocation.
This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past
the end of the heap buffer from unprivileged userspace via the ALSA TLV
kcontrol interface, and similarly allowed over-reading adjacent heap
data on the get path.
Fix all bounds checks to subtract sizeof(*cdata) from max_size so they
reflect the actual space available at the cdata->data offset. Also fix
the error-path restore in bytes_ext_put which wrote to cdata->data
instead of cdata, causing the same overflow.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 Version: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 Version: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 Version: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 Version: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 Version: 67ec2a091630c28ea8d05db2bd7178a05b04b7e6 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72262",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:45:34.306028Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:14.172Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/ipc3-control.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af4b437a463ac0482ba705434a44da06783778e6",
"status": "affected",
"version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
"versionType": "git"
},
{
"lessThan": "1adde1941bba7b0d7104b86ed819d48d81cb0ad9",
"status": "affected",
"version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
"versionType": "git"
},
{
"lessThan": "eaa67e139c9217099e2a7b717aeeb46c65de3494",
"status": "affected",
"version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
"versionType": "git"
},
{
"lessThan": "121577383b5cf221e86581e0f2bcca4c66f17469",
"status": "affected",
"version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
"versionType": "git"
},
{
"lessThan": "f4933e1d11b97b6a0951648b7c3e53850e1b33a9",
"status": "affected",
"version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
"versionType": "git"
},
{
"lessThan": "fd46668d538993218eea19c6925c868ac0f2630c",
"status": "affected",
"version": "67ec2a091630c28ea8d05db2bd7178a05b04b7e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/ipc3-control.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get\n\nThe ipc_control_data buffer is allocated as kzalloc(max_size), where\nmax_size covers the entire struct sof_ipc_ctrl_data including its\nflexible array payload. However, the bounds checks in bytes_ext_put\nand _bytes_ext_get compared user data lengths against max_size\ndirectly, ignoring that cdata-\u003edata sits at an offset of\nsizeof(struct sof_ipc_ctrl_data) bytes into the allocation.\n\nThis allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past\nthe end of the heap buffer from unprivileged userspace via the ALSA TLV\nkcontrol interface, and similarly allowed over-reading adjacent heap\ndata on the get path.\n\nFix all bounds checks to subtract sizeof(*cdata) from max_size so they\nreflect the actual space available at the cdata-\u003edata offset. Also fix\nthe error-path restore in bytes_ext_put which wrote to cdata-\u003edata\ninstead of cdata, causing the same overflow."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local ioctl on /dev/snd/controlC* (SNDRV_CTL_IOCTL_TLV_WRITE/READ) through the ALSA control device; there is no network, adjacent-radio, or physical-bus attack surface for this SOF IPC3 kcontrol path.\nAC:L - On affected SOF IPC3 systems with topology bytes_ext controls, an attacker can deterministically trigger the bug by issuing TLV writes with header.length equal to max_size, causing copy_from_user/memcpy to overrun the kzalloc(max_size) buffer by sizeof(struct sof_ipc_ctrl_data).\nPR:L - The fix commit states the overflow is reachable from unprivileged userspace via ALSA TLV kcontrols; any local user who can open the sound control device (typically membership in the audio group on Linux, or an app with audio access on Android/ChromeOS) can reach the vulnerable code without real root.\nUI:N - Exploitation is performed entirely by the attacker issuing ALSA TLV ioctls against an existing bytes_ext kcontrol; no victim click, mount, or other interactive action beyond the attacker\u0027s own access to the sound control interface is required.\nS:U - The vulnerability corrupts kernel heap memory from a local userspace context and enables standard kernel privilege escalation or denial of service; it does not cross a VM, container, or IOMMU security boundary into a separate authority.\nC:H - The get path can copy_to_user up to sizeof(struct sof_ipc_ctrl_data) bytes beyond the allocated ipc_control_data buffer, leaking adjacent kernel heap contents; combined with the controllable overflow, this is an out-of-bounds read/memory corruption primitive consistent with arbitrary disclosure potential.\nI:H - The put path performs an out-of-bounds heap write of up to sizeof(struct sof_ipc_ctrl_data) bytes past the kzalloc(max_size) allocation (including via the err_restore memcpy), enabling heap metadata/object corruption that can be developed into arbitrary kernel write or code execution.\nA:H - Heap out-of-bounds writes of roughly 96 bytes into adjacent slab objects can corrupt kernel structures and trigger oops/panic or wedged audio/subsystem state; repeated TLV operations make denial of service reliably achievable even without full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:47:11.302Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af4b437a463ac0482ba705434a44da06783778e6"
},
{
"url": "https://git.kernel.org/stable/c/1adde1941bba7b0d7104b86ed819d48d81cb0ad9"
},
{
"url": "https://git.kernel.org/stable/c/eaa67e139c9217099e2a7b717aeeb46c65de3494"
},
{
"url": "https://git.kernel.org/stable/c/121577383b5cf221e86581e0f2bcca4c66f17469"
},
{
"url": "https://git.kernel.org/stable/c/f4933e1d11b97b6a0951648b7c3e53850e1b33a9"
},
{
"url": "https://git.kernel.org/stable/c/fd46668d538993218eea19c6925c868ac0f2630c"
}
],
"title": "ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72262",
"datePublished": "2026-08-15T05:54:49.635Z",
"dateReserved": "2026-08-09T03:40:39.915Z",
"dateUpdated": "2026-10-16T18:55:14.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72289 (GCVE-0-2026-72289)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-16 18:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic: Check the interrupt is still ours before migrating it
vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating
an interrupt to another vCPU. After reacquiring the locks it only checks
that the affinity is unchanged (target_vcpu == vgic_target_oracle(irq))
before moving the interrupt, which assumes that an interrupt whose affinity
is preserved is still queued on this vCPU's ap_list.
That assumption no longer holds if the interrupt is taken off the ap_list
while the locks are dropped. vgic_flush_pending_lpis() removes the
interrupt from the list and sets irq->vcpu to NULL, but leaves
enabled/pending/target_vcpu untouched. As the interrupt is still enabled
and pending, vgic_target_oracle() returns the same target_vcpu, so the
affinity check passes and list_del() is run a second time on an entry that
has already been removed.
Also check that the interrupt is still assigned to this vCPU
(irq->vcpu == vcpu) before moving it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 Version: 0919e84c0fc1fc73525fdcedefab89ea8460f697 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72289",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:45:52.646883Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:15.201Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3893e1fcf6f306b327a8358dcd1cbd077989a240",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "cb3efe1a354f1638726725c3ecee1ce8d1a7e2dc",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "da2d249a39a1881681c303ceea33f38ba1c5bbeb",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "654be81c4c637af12709d47c7efc3302cd336513",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "e363c0bc0226dc5ea5046a88e9a6864b82c45399",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "79fdd2aa774e44847cd9bb7edc811e73e3dc7bfe",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "0658b09cba7fe866c6cd70cd2dcdfdcabe80328f",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
},
{
"lessThan": "0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe",
"status": "affected",
"version": "0919e84c0fc1fc73525fdcedefab89ea8460f697",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic: Check the interrupt is still ours before migrating it\n\nvgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating\nan interrupt to another vCPU. After reacquiring the locks it only checks\nthat the affinity is unchanged (target_vcpu == vgic_target_oracle(irq))\nbefore moving the interrupt, which assumes that an interrupt whose affinity\nis preserved is still queued on this vCPU\u0027s ap_list.\n\nThat assumption no longer holds if the interrupt is taken off the ap_list\nwhile the locks are dropped. vgic_flush_pending_lpis() removes the\ninterrupt from the list and sets irq-\u003evcpu to NULL, but leaves\nenabled/pending/target_vcpu untouched. As the interrupt is still enabled\nand pending, vgic_target_oracle() returns the same target_vcpu, so the\naffinity check passes and list_del() is run a second time on an entry that\nhas already been removed.\n\nAlso check that the interrupt is still assigned to this vCPU\n(irq-\u003evcpu == vcpu) before moving it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only from KVM guest execution paths\u2014GICv3 redistributor GICR_CTLR LPI-disable MMIO traps into vgic_flush_pending_lpis() and vCPU exit/sync paths into vgic_prune_ap_list()\u2014not from any remote network, adjacent-radio, or physical-device interface on the host.\nAC:L - A malicious multi-vCPU guest controls both racing sides by pinning threads, changing LPI affinity via ITS so an interrupt must migrate off one vCPU\u0027s ap_list, and concurrently disabling LPIS on that redistributor; the attacker creates the window rather than depending on uncontrollable host timing or memory layout.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant on arm64 KVM who needs no host privileges beyond code already running inside the assigned guest; exploitation uses guest-kernel GIC MMIO/ITS operations, not host root, CAP_SYS_ADMIN in the init namespace, or additional /dev/kvm access beyond having a VM.\nUI:N - Exploitation is fully attacker-driven from within the guest VM through deliberate LPI setup, affinity changes, and timed GICR_CTLR writes; no victim user or administrator action on the host is required beyond normal VM operation.\nS:C - Double list_del()/list_add_tail() on host-kernel ap_list linkages corrupts KVM VGIC state from guest-controlled interrupt operations, crossing the guest-to-host virtualization security boundary with VM-escape-class impact rather than confining damage to the attacker\u0027s VM.\nC:H - Corrupting detached ap_list pointers and inserting them into another vCPU\u0027s ap_list_head enables out-of-bounds kernel linked-list traversal and disclosure of adjacent kmalloc slab memory (struct vgic_irq and neighboring objects); per kernel guidance, this list corruption is leverageable for arbitrary host memory read primitives.\nI:H - The vulnerable path performs list_del() on an already removed entry and may follow with list_add_tail() onto another vCPU\u0027s ap_list, letting a guest steer kernel list pointers and overwrite adjacent vgic_irq/host heap metadata for control-flow or data corruption on the hypervisor.\nA:H - Re-running list_del() on an entry already removed by vgic_flush_pending_lpis() dereferences poisoned list pointers and corrupts live ap_list_heads, causing immediate host kernel BUG/oops/panic or persistent interrupt-delivery failure during subsequent VGIC processing."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:42:24.760Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3893e1fcf6f306b327a8358dcd1cbd077989a240"
},
{
"url": "https://git.kernel.org/stable/c/cb3efe1a354f1638726725c3ecee1ce8d1a7e2dc"
},
{
"url": "https://git.kernel.org/stable/c/da2d249a39a1881681c303ceea33f38ba1c5bbeb"
},
{
"url": "https://git.kernel.org/stable/c/654be81c4c637af12709d47c7efc3302cd336513"
},
{
"url": "https://git.kernel.org/stable/c/e363c0bc0226dc5ea5046a88e9a6864b82c45399"
},
{
"url": "https://git.kernel.org/stable/c/79fdd2aa774e44847cd9bb7edc811e73e3dc7bfe"
},
{
"url": "https://git.kernel.org/stable/c/0658b09cba7fe866c6cd70cd2dcdfdcabe80328f"
},
{
"url": "https://git.kernel.org/stable/c/0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe"
}
],
"title": "KVM: arm64: vgic: Check the interrupt is still ours before migrating it",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72289",
"datePublished": "2026-08-15T05:55:10.870Z",
"dateReserved": "2026-08-09T03:40:39.917Z",
"dateUpdated": "2026-10-16T18:55:15.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53002 (GCVE-0-2026-53002)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-10-19 19:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: remove sprintf usage
Replace it with scnprintf, the buffer sizes are expected to be large enough
to hold the result, no need for snprintf+overflow check.
Increase buffer size in mangle_content_len() while at it.
BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270
Write of size 1 at addr [..]
vsnprintf+0xea5/0x1270
sprintf+0xb1/0xe0
mangle_content_len+0x1ac/0x280
nf_nat_sdp_session+0x1cc/0x240
process_sdp+0x8f8/0xb80
process_invite_request+0x108/0x2b0
process_sip_msg+0x5da/0xf50
sip_help_tcp+0x45e/0x780
nf_confirm+0x34d/0x990
[..]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.160.1.rt7.501.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.160.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.46.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s netfilter conntrack module. This vulnerability arises from the use of `sprintf` and insufficient buffer sizing in the `mangle_content_len()` function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue to cause a denial of service or other unspecified impacts."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T12:04:52.973Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53002"
},
{
"name": "RHBZ#2492329",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492329"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53002.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:66180"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:66000"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:64770"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:66180: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:66000: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:64770: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: netfilter: conntrack: remove sprintf usage",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, prevent the nf_conntrack_sip and nf_nat_sip modules from being loaded. See https://access.redhat.com/solutions/41278 for instructions."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.7",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T01:22:14.681Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"
}
],
"x_adpType": "supplier"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53002",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:24:29.288398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:47:13.138Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_nat_amanda.c",
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2f793ba78470a99f40389b7dc60a81d9f5ad3956",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "6bbf829b4c1b44c941c47dd0d710f1393258f3d5",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "ab64e61c9323fa6de21bd20da1ddb29a0fb65d34",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1e",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "a8e0a32a23d3f34862af3b4da792ecb3a891a9a3",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "8e3be0d12615a173fe260cd42753ca7a001acbf2",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "c08ff52e44945e6ef4ce0790f49ea761b060c45b",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "6e7066bdb481a87fe88c4fa563e348c03b2d373d",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_nat_amanda.c",
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.20"
},
{
"lessThan": "2.6.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: remove sprintf usage\n\nReplace it with scnprintf, the buffer sizes are expected to be large enough\nto hold the result, no need for snprintf+overflow check.\n\nIncrease buffer size in mangle_content_len() while at it.\n\nBUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270\nWrite of size 1 at addr [..]\n vsnprintf+0xea5/0x1270\n sprintf+0xb1/0xe0\n mangle_content_len+0x1ac/0x280\n nf_nat_sdp_session+0x1cc/0x240\n process_sdp+0x8f8/0xb80\n process_invite_request+0x108/0x2b0\n process_sip_msg+0x5da/0xf50\n sip_help_tcp+0x45e/0x780\n nf_confirm+0x34d/0x990\n [..]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable SIP NAT helper is reached from network packet processing when a target acts as a SIP-aware NAT/conntrack gateway. A remote peer can send crafted SIP/SDP traffic through that configured path.\nAC:L - No race or hard-to-control state is required; the attacker controls the SIP/SDP payload and can drive the oversized Content-Length recomputation. The needed NAT/helper configuration is a normal deployment condition for SIP ALG/firewall use.\nPR:N - In the remote deployment scenario, the attacker only sends network traffic and does not need local credentials or administrative privileges on the target. Local helper setup would require CAP_NET_ADMIN, but that is not required when attacking an already configured SIP NAT gateway.\nUI:N - No victim user action is required once the vulnerable helper is active. Packet processing happens automatically in the netfilter conntrack/NAT path.\nS:U - The corruption occurs inside the Linux kernel networking stack and impacts the same kernel security authority. There is no VM, IOMMU, or cross-authority boundary change.\nC:H - This is kernel stack memory corruption from an out-of-bounds sprintf write. Even though the report shows a KASAN crash, such memory corruption can plausibly be leveraged toward broader kernel compromise, so the higher severity value is appropriate.\nI:H - The bug is an out-of-bounds write on the kernel stack in packet processing. Kernel memory corruption can plausibly alter control data or enable code execution, so integrity impact is high.\nA:H - The reported failure is a KASAN stack-out-of-bounds write in kernel context and can crash or panic the system. The crafted traffic can be sent repeatedly to sustain denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:32.201Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2f793ba78470a99f40389b7dc60a81d9f5ad3956"
},
{
"url": "https://git.kernel.org/stable/c/6bbf829b4c1b44c941c47dd0d710f1393258f3d5"
},
{
"url": "https://git.kernel.org/stable/c/ab64e61c9323fa6de21bd20da1ddb29a0fb65d34"
},
{
"url": "https://git.kernel.org/stable/c/1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1e"
},
{
"url": "https://git.kernel.org/stable/c/a8e0a32a23d3f34862af3b4da792ecb3a891a9a3"
},
{
"url": "https://git.kernel.org/stable/c/8e3be0d12615a173fe260cd42753ca7a001acbf2"
},
{
"url": "https://git.kernel.org/stable/c/c08ff52e44945e6ef4ce0790f49ea761b060c45b"
},
{
"url": "https://git.kernel.org/stable/c/6e7066bdb481a87fe88c4fa563e348c03b2d373d"
}
],
"title": "netfilter: conntrack: remove sprintf usage",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53002",
"datePublished": "2026-06-24T16:29:14.391Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-10-19T19:47:13.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64032 (GCVE-0-2026-64032)
Vulnerability from cvelistv5
Published
2026-07-19 15:39
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bridge: mcast: Fix a possible use-after-free when removing a bridge port
When per-VLAN multicast snooping is enabled, the bridge iterates over
all the bridge ports, disables the per-port multicast context on each
port and enables the per-{port, VLAN} multicast contexts instead. The
reverse happens when per-VLAN multicast snooping is disabled.
When global multicast snooping is enabled, the bridge iterates over all
the bridge ports and enables the per-port multicast context on each
port. The reverse happens when multicast snooping is disabled.
The above scheme can result in a situation where both types of contexts
(per-port and per-{port, VLAN}) are enabled on a single bridge port:
# ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1
# ip link add name dummy1 up master br1 type dummy
# ip link set dev br1 type bridge mcast_vlan_snooping 1
# ip link set dev br1 type bridge mcast_snooping 0
# ip link set dev br1 type bridge mcast_snooping 1
This is not intended and it is a problem since the commit cited below.
Prior to this commit, when removing a bridge port,
br_multicast_disable_port() would disable the per-port multicast context
and the per-{port, VLAN} multicast contexts would get disabled when
flushing VLANs.
After this commit, br_multicast_disable_port() only disables the
per-port multicast context if per-VLAN multicast snooping is disabled.
If both types of contexts were enabled on the port when it was removed,
the per-port multicast context would remain enabled when freeing the
bridge port, leading to a use-after-free [1].
Fix by preventing the bridge from enabling / disabling the per-port
multicast contexts when toggling global multicast snooping if per-VLAN
multicast snooping is enabled.
[1]
ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927)
WARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0
[...]
Call Trace:
<IRQ>
__debug_check_no_obj_freed (lib/debugobjects.c:1116)
kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565)
kobject_cleanup (lib/kobject.c:689)
rcu_do_batch (kernel/rcu/tree.c:2617)
rcu_core (kernel/rcu/tree.c:2869)
handle_softirqs (kernel/softirq.c:622)
__irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735)
irq_exit_rcu (kernel/softirq.c:752)
sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47))
</IRQ>
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 410a033bfa8c7daefbae0225c836693db2149ec1 Version: c6d16eab122744df698f18b47cf771945cd55066 Version: b4c83b37490d61cfdd62a2b29e98a9b89004b5c0 Version: 78f768e36c065ca3f88272fcf39014782c2d4ecd Version: 4b30ae9adb047dd0a7982975ec3933c529537026 Version: 4b30ae9adb047dd0a7982975ec3933c529537026 Version: 4b30ae9adb047dd0a7982975ec3933c529537026 Version: c996e25df0b3282c724bb5aca434518bc08cd963 Version: 5.15.186 ≤ Version: 6.1.142 ≤ Version: 6.6.95 ≤ Version: 6.12.35 ≤ Version: 6.15.4 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64032",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:39.604315Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:09.740Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_multicast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b",
"status": "affected",
"version": "410a033bfa8c7daefbae0225c836693db2149ec1",
"versionType": "git"
},
{
"lessThan": "ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70",
"status": "affected",
"version": "c6d16eab122744df698f18b47cf771945cd55066",
"versionType": "git"
},
{
"lessThan": "1900ca8acb92fbea8bf9abef9927c7fed03db7fc",
"status": "affected",
"version": "b4c83b37490d61cfdd62a2b29e98a9b89004b5c0",
"versionType": "git"
},
{
"lessThan": "ebe5561154c823b323bd06e350b55e0b8604d851",
"status": "affected",
"version": "78f768e36c065ca3f88272fcf39014782c2d4ecd",
"versionType": "git"
},
{
"lessThan": "a9224862d597d0eed0a34bbb27343f703fc4113f",
"status": "affected",
"version": "4b30ae9adb047dd0a7982975ec3933c529537026",
"versionType": "git"
},
{
"lessThan": "7213256c91ed778a0997c2029c152b18dc50e4fd",
"status": "affected",
"version": "4b30ae9adb047dd0a7982975ec3933c529537026",
"versionType": "git"
},
{
"lessThan": "4df78ff02629c7729168f0696a7a2123c389818d",
"status": "affected",
"version": "4b30ae9adb047dd0a7982975ec3933c529537026",
"versionType": "git"
},
{
"status": "affected",
"version": "c996e25df0b3282c724bb5aca434518bc08cd963",
"versionType": "git"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.186",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.142",
"versionType": "semver"
},
{
"lessThan": "6.6.142",
"status": "affected",
"version": "6.6.95",
"versionType": "semver"
},
{
"lessThan": "6.12.92",
"status": "affected",
"version": "6.12.35",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_multicast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.186",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.142",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "6.6.95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "6.12.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: mcast: Fix a possible use-after-free when removing a bridge port\n\nWhen per-VLAN multicast snooping is enabled, the bridge iterates over\nall the bridge ports, disables the per-port multicast context on each\nport and enables the per-{port, VLAN} multicast contexts instead. The\nreverse happens when per-VLAN multicast snooping is disabled.\n\nWhen global multicast snooping is enabled, the bridge iterates over all\nthe bridge ports and enables the per-port multicast context on each\nport. The reverse happens when multicast snooping is disabled.\n\nThe above scheme can result in a situation where both types of contexts\n(per-port and per-{port, VLAN}) are enabled on a single bridge port:\n\n # ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1\n # ip link add name dummy1 up master br1 type dummy\n # ip link set dev br1 type bridge mcast_vlan_snooping 1\n # ip link set dev br1 type bridge mcast_snooping 0\n # ip link set dev br1 type bridge mcast_snooping 1\n\nThis is not intended and it is a problem since the commit cited below.\nPrior to this commit, when removing a bridge port,\nbr_multicast_disable_port() would disable the per-port multicast context\nand the per-{port, VLAN} multicast contexts would get disabled when\nflushing VLANs.\n\nAfter this commit, br_multicast_disable_port() only disables the\nper-port multicast context if per-VLAN multicast snooping is disabled.\nIf both types of contexts were enabled on the port when it was removed,\nthe per-port multicast context would remain enabled when freeing the\nbridge port, leading to a use-after-free [1].\n\nFix by preventing the bridge from enabling / disabling the per-port\nmulticast contexts when toggling global multicast snooping if per-VLAN\nmulticast snooping is enabled.\n\n[1]\nODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927)\nWARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0\n[...]\nCall Trace:\n\u003cIRQ\u003e\n__debug_check_no_obj_freed (lib/debugobjects.c:1116)\nkfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565)\nkobject_cleanup (lib/kobject.c:689)\nrcu_do_batch (kernel/rcu/tree.c:2617)\nrcu_core (kernel/rcu/tree.c:2869)\nhandle_softirqs (kernel/softirq.c:622)\n__irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735)\nirq_exit_rcu (kernel/softirq.c:752)\nsysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47))\n\u003c/IRQ\u003e"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached only through local bridge administration (rtnetlink RTM_NEWLINK, bridge ioctl, or sysfs), not through processing of remote network packets. An attacker must issue `ip link`/`bridge` configuration commands to create the inconsistent multicast state and remove a bridge port.\nAC:L - The reproducer sequence is fully attacker-controlled and deterministic; syzkaller triggered it reliably. The attacker configures the toggle sequence, removes the port, and the orphaned IGMP/MLD query timers fire on schedule without depending on uncontrollable timing or memory layout.\nPR:L - All entry paths require CAP_NET_ADMIN in the target network namespace (rtnetlink at rtnl_newlink, br_ioctl add_del_if, sysfs bridge attributes). Unprivileged local users can obtain this capability by creating a user+network namespace (`unshare -Urn`), which is widely enabled on server and container hosts.\nUI:N - Exploitation requires no action from any other user or victim; the attacker performs the entire bridge setup, state toggling, and port removal themselves.\nS:U - Successful exploitation corrupts kernel memory within the same kernel security domain. This is a standard local kernel memory corruption issue, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - This is a heap use-after-free on a freed net_bridge_port structure; the timer callback dereferences pmctx-\u003eport-\u003ebr on freed memory. UAF on kernel slab objects enables arbitrary kernel memory reads via heap grooming and reclamation of the freed port object.\nI:H - The UAF occurs in a timer softirq handler that reads and writes through fields of the freed port multicast context, including sending queries via br_multicast_send_query. Kernel heap UAF is exploitable for arbitrary write and control-flow hijack primitives, not merely a crash.\nA:H - The freed port structure is kfree\u0027d while IGMP/MLD own-query timers remain active, producing a debugobjects \"free active timer\" warning and use-after-free in softirq. This reliably causes kernel oops/panic and can be triggered repeatedly to deny service on shared infrastructure such as cloud hosts or software switches."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:26.376Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b"
},
{
"url": "https://git.kernel.org/stable/c/ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70"
},
{
"url": "https://git.kernel.org/stable/c/1900ca8acb92fbea8bf9abef9927c7fed03db7fc"
},
{
"url": "https://git.kernel.org/stable/c/ebe5561154c823b323bd06e350b55e0b8604d851"
},
{
"url": "https://git.kernel.org/stable/c/a9224862d597d0eed0a34bbb27343f703fc4113f"
},
{
"url": "https://git.kernel.org/stable/c/7213256c91ed778a0997c2029c152b18dc50e4fd"
},
{
"url": "https://git.kernel.org/stable/c/4df78ff02629c7729168f0696a7a2123c389818d"
}
],
"title": "bridge: mcast: Fix a possible use-after-free when removing a bridge port",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64032",
"datePublished": "2026-07-19T15:39:22.228Z",
"dateReserved": "2026-07-19T07:54:57.028Z",
"dateUpdated": "2026-10-19T20:28:09.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93228 (GCVE-0-2026-93228)
Vulnerability from cvelistv5
Published
2026-09-24 15:29
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Reject Write/Reply chunks with segcount 0
A peer can send a Write or Reply chunk whose segcount field is zero.
xdr_check_write_chunk() only rejects segcount > rc_maxpages, so zero
passes the range check, and xdr_inline_decode(stream, 0) returns the
current (non-NULL) cursor without advancing. The function returns
true and pcl_alloc_write() then links a struct svc_rdma_chunk with
ch_segcount == 0 onto rc_write_pcl or rc_reply_pcl.
An earlier patch in this series made pcl_for_each_segment() safe for
ch_segcount == 0, so this no longer drives the memory walk it used
to. Rejecting the malformed frame at the decode boundary is still
worthwhile as defense in depth: it keeps degenerate zero-segment
chunks off the parsed chunk lists entirely, so any future consumer
that walks ch_segments directly cannot observe one, and it makes the
zero-floor easy to backport to trees where the macro change is more
intrusive. RFC 8166 has no meaning for a Write/Reply chunk that
describes no remote buffer, so no legitimate client is affected.
xdr_check_reply_chunk() funnels Reply chunks through
xdr_check_write_chunk() and inherits the same rejection.
pcl_alloc_write() also links each chunk onto the parsed chunk list
before filling its segment array. If a future change weakens the
segcount-0 rejection, an incomplete chunk is visible to consumers
during the fill loop. Reorder so that list_add_tail() follows the
segment fill loop, ensuring only fully-populated chunks appear on
the list.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_pcl.c",
"net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "28c5a3a572f6cf81ac304459cfd515480995d62a",
"status": "affected",
"version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
"versionType": "git"
},
{
"lessThan": "fe533ae1bed2ef2b3d54ee7ab410da1874ed3d4f",
"status": "affected",
"version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
"versionType": "git"
},
{
"lessThan": "a798714b58041e88716db3bf8fb03ae13eecd54a",
"status": "affected",
"version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
"versionType": "git"
},
{
"lessThan": "45dbdb2637b7fc5f1355b588780d2a7fb0516805",
"status": "affected",
"version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
"versionType": "git"
},
{
"lessThan": "9808eb7656666acc7291bae9ab6b987bd16e47e0",
"status": "affected",
"version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_pcl.c",
"net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.111",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject Write/Reply chunks with segcount 0\n\nA peer can send a Write or Reply chunk whose segcount field is zero.\nxdr_check_write_chunk() only rejects segcount \u003e rc_maxpages, so zero\npasses the range check, and xdr_inline_decode(stream, 0) returns the\ncurrent (non-NULL) cursor without advancing. The function returns\ntrue and pcl_alloc_write() then links a struct svc_rdma_chunk with\nch_segcount == 0 onto rc_write_pcl or rc_reply_pcl.\n\nAn earlier patch in this series made pcl_for_each_segment() safe for\nch_segcount == 0, so this no longer drives the memory walk it used\nto. Rejecting the malformed frame at the decode boundary is still\nworthwhile as defense in depth: it keeps degenerate zero-segment\nchunks off the parsed chunk lists entirely, so any future consumer\nthat walks ch_segments directly cannot observe one, and it makes the\nzero-floor easy to backport to trees where the macro change is more\nintrusive. RFC 8166 has no meaning for a Write/Reply chunk that\ndescribes no remote buffer, so no legitimate client is affected.\n\nxdr_check_reply_chunk() funnels Reply chunks through\nxdr_check_write_chunk() and inherits the same rejection.\n\npcl_alloc_write() also links each chunk onto the parsed chunk list\nbefore filling its segment array. If a future change weakens the\nsegcount-0 rejection, an incomplete chunk is visible to consumers\nduring the fill loop. Reorder so that list_add_tail() follows the\nsegment fill loop, ensuring only fully-populated chunks appear on\nthe list."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote NFS/RDMA peer places a Write or Reply chunk with segcount 0 in the RPC-over-RDMA transport header; svc_rdma_recvfrom() \u2192 svc_rdma_xdr_decode_req() \u2192 xdr_check_write_list()/xdr_check_reply_chunk() \u2192 xdr_check_write_chunk() accepted that field over iWARP or routable RoCEv2.\nAC:L - The attacker sets RPCRDMA_CMP_F_SND_W_INV_OK in the RDMA-CM private connect blob (svc_rdma_parse_connect_private) and sends a Write/Reply chunk with segcount 0; xdr_check_write_chunk() only rejected segcount \u003e rc_maxpages, xdr_inline_decode(0) returns the cursor, and pcl_alloc_write() links a ch_segcount==0 chunk with no race.\nPR:N - xdr_check_write_chunk() and pcl_alloc_write() run in svc_rdma_xdr_decode_req() from svc_rdma_recvfrom() while parsing the transport header, before svc_xprt_do_recv() calls svc_process()/svc_authenticate(); RDMA CM accept performs no NFS credential check.\nUI:N - The attacker only needs to connect to a listening NFS/RDMA service and send an RPC-over-RDMA Call whose Write list or Reply chunk has segcount 0; no victim mount, click, or other user action is required.\nS:U - pcl_alloc_write() installs the empty chunk on the host kernel rc_write_pcl/rc_reply_pcl, and the subsequent heap walk and general protection fault stay inside nfsd\u0027s RPC-over-RDMA server; this is not a VM, IOMMU, or sandbox escape.\nC:H - Accepting segcount 0 in xdr_check_write_chunk() lets pcl_alloc_write() put a ch_segcount==0 Write/Reply chunk on the parsed list; pcl_for_each_segment then uses \u0026ch_segments[0u-1u] and walks adjacent kernel heap at sizeof(struct svc_rdma_segment) stride, an unbounded out-of-bounds read.\nI:N - svc_rdma_get_inv_rkey() only loads segment-\u003ers_handle from the overrun pointer to choose an invalidate rkey; Write/Reply encode and RDMA Write paths index with segno \u003c ch_segcount and skip or return -E2BIG on an empty chunk, so there is no out-of-bounds write or control-flow hijack.\nA:H - The underflowed pcl_for_each_segment walk of the empty Write/Reply chunk continues until it hits unmapped memory and raises a general protection fault, oopsing or panicking the kernel, and the peer can send another zero-segcount Call to repeat it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:23.995Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/28c5a3a572f6cf81ac304459cfd515480995d62a"
},
{
"url": "https://git.kernel.org/stable/c/fe533ae1bed2ef2b3d54ee7ab410da1874ed3d4f"
},
{
"url": "https://git.kernel.org/stable/c/a798714b58041e88716db3bf8fb03ae13eecd54a"
},
{
"url": "https://git.kernel.org/stable/c/45dbdb2637b7fc5f1355b588780d2a7fb0516805"
},
{
"url": "https://git.kernel.org/stable/c/9808eb7656666acc7291bae9ab6b987bd16e47e0"
}
],
"title": "svcrdma: Reject Write/Reply chunks with segcount 0",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93228",
"datePublished": "2026-09-24T15:29:10.087Z",
"dateReserved": "2026-09-17T16:02:15.094Z",
"dateUpdated": "2026-10-21T12:52:23.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53011 (GCVE-0-2026-53011)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-10-19 19:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
In advance_sched(), when should_change_schedules() returns true,
switch_schedules() is called to promote the admin schedule to oper.
switch_schedules() queues the old oper schedule for RCU freeing via
call_rcu(), but 'next' still points into an entry of the old oper
schedule. The subsequent 'next->end_time = end_time' and
rcu_assign_pointer(q->current_entry, next) are use-after-free.
Fix this by selecting 'next' from the new oper schedule immediately
after switch_schedules(), and using its pre-calculated end_time.
setup_first_end_time() sets the first entry's end_time to
base_time + interval when the schedule is installed, so the value
is already correct.
The deleted 'end_time = sched_base_time(admin)' assignment was also
harmful independently: it would overwrite the new first entry's
pre-calculated end_time with just base_time.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53011",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:24:41.510503Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:47:13.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_taprio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a8fc396519ef4f081bc545e88f61241728bb78d7",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "3471874578160a28c171a607fa069f24062634b8",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "7256996e1ef553716817f3bfd077c2f3b48b582f",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "eee072fe16c646190d33ae69c9983d8de1562bf8",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "1bd286fa3e21200133478ed523cc6a2788baf38a",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "b73235da5dde77ed1264f9767b62c28c9d71fd78",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "0e62171df8ed4804d00db088f17eed06468233fa",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "105425b1969c5affe532713cfac1c0b320d7ac2b",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_taprio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: taprio: fix use-after-free in advance_sched() on schedule switch\n\nIn advance_sched(), when should_change_schedules() returns true,\nswitch_schedules() is called to promote the admin schedule to oper.\nswitch_schedules() queues the old oper schedule for RCU freeing via\ncall_rcu(), but \u0027next\u0027 still points into an entry of the old oper\nschedule. The subsequent \u0027next-\u003eend_time = end_time\u0027 and\nrcu_assign_pointer(q-\u003ecurrent_entry, next) are use-after-free.\n\nFix this by selecting \u0027next\u0027 from the new oper schedule immediately\nafter switch_schedules(), and using its pre-calculated end_time.\nsetup_first_end_time() sets the first entry\u0027s end_time to\nbase_time + interval when the schedule is installed, so the value\nis already correct.\n\nThe deleted \u0027end_time = sched_base_time(admin)\u0027 assignment was also\nharmful independently: it would overwrite the new first entry\u0027s\npre-calculated end_time with just base_time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable taprio schedule switch is reached through local `NETLINK_ROUTE`/tc qdisc configuration, not by unauthenticated network packets. An attacker sends `RTM_NEWQDISC` messages to install and later switch taprio schedules.\nAC:L - The trigger is deterministic once the attacker installs an oper schedule and a later admin schedule with chosen base times/intervals. The attacker controls the schedule timing, so no condition beyond attacker control is required.\nPR:L - The rtnetlink qdisc path requires `CAP_NET_ADMIN` in the target network namespace. Because tc/qdisc configuration is reachable with namespaced `CAP_NET_ADMIN` via user namespaces in reasonable deployments, this is low privilege rather than high privilege.\nUI:N - No victim action is required after the attacker can issue the local netlink configuration. The hrtimer-driven schedule transition occurs automatically.\nS:U - The vulnerability corrupts kernel memory within the same kernel security authority. It is a standard local kernel privilege-escalation/DoS class issue, not a VM or hardware boundary escape.\nC:H - This is a use-after-free of taprio schedule entry memory that leaves `current_entry` pointing into freed objects. As a kernel UAF, it can plausibly be shaped into memory disclosure primitives.\nI:H - The stale schedule entry is later written and used by scheduler/dequeue paths, giving attacker-influenced heap corruption potential. Under the required kernel guidance, a UAF is high integrity impact because it can be leveraged for arbitrary write or control-flow compromise.\nA:H - The dangling schedule entry can be dereferenced after RCU freeing by the timer or dequeue path. Even without full exploitation, this can cause kernel oops, panic, or repeated crashes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:38.643Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a8fc396519ef4f081bc545e88f61241728bb78d7"
},
{
"url": "https://git.kernel.org/stable/c/3471874578160a28c171a607fa069f24062634b8"
},
{
"url": "https://git.kernel.org/stable/c/7256996e1ef553716817f3bfd077c2f3b48b582f"
},
{
"url": "https://git.kernel.org/stable/c/eee072fe16c646190d33ae69c9983d8de1562bf8"
},
{
"url": "https://git.kernel.org/stable/c/1bd286fa3e21200133478ed523cc6a2788baf38a"
},
{
"url": "https://git.kernel.org/stable/c/b73235da5dde77ed1264f9767b62c28c9d71fd78"
},
{
"url": "https://git.kernel.org/stable/c/0e62171df8ed4804d00db088f17eed06468233fa"
},
{
"url": "https://git.kernel.org/stable/c/105425b1969c5affe532713cfac1c0b320d7ac2b"
}
],
"title": "net/sched: taprio: fix use-after-free in advance_sched() on schedule switch",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53011",
"datePublished": "2026-06-24T16:29:22.082Z",
"dateReserved": "2026-06-09T07:44:35.378Z",
"dateUpdated": "2026-10-19T19:47:13.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68108 (GCVE-0-2026-68108)
Vulnerability from cvelistv5
Published
2026-08-10 11:58
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/vce: fix integer overflow in image size
Fix a security vulnerability where malicious VCE command streams
with oversized dimensions (e.g. 65536×65536) cause 32-bit integer
overflow, wrapping the calculated buffer size to 0. This bypasses
validation and allows GPU firmware to perform out-of-bound memory
access.
The fix uses 64-bit arithmetic to detect overflow and rejects
invalid dimensions before they reach the hardware.
V2: remove redundant check
V3: modify max height value
V4: remove size64
(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c Version: f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c Version: f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c Version: f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c Version: f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c Version: f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:43:59.908598Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:51.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "893db20383800cfe92e638705984eebb13bc81a5",
"status": "affected",
"version": "f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c",
"versionType": "git"
},
{
"lessThan": "a07430abd556de3707adfcadcc60db3fa64e4b2b",
"status": "affected",
"version": "f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c",
"versionType": "git"
},
{
"lessThan": "a6d7065b91a14790980ce6f4960db0ca8c3c9940",
"status": "affected",
"version": "f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c",
"versionType": "git"
},
{
"lessThan": "7eebef042c12dfe0568593ee6a8926d16505925e",
"status": "affected",
"version": "f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c",
"versionType": "git"
},
{
"lessThan": "00c311a13d225266800c712f2b7db2711c6897de",
"status": "affected",
"version": "f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c",
"versionType": "git"
},
{
"lessThan": "186bfdc4e26d019b2e7570cb121964a1d89b2e5b",
"status": "affected",
"version": "f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vce: fix integer overflow in image size\n\nFix a security vulnerability where malicious VCE command streams\nwith oversized dimensions (e.g. 65536\u00d765536) cause 32-bit integer\noverflow, wrapping the calculated buffer size to 0. This bypasses\nvalidation and allows GPU firmware to perform out-of-bound memory\naccess.\n\nThe fix uses 64-bit arithmetic to detect overflow and rejects\ninvalid dimensions before they reach the hardware.\n\nV2: remove redundant check\nV3: modify max height value\nV4: remove size64\n\n(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only through the AMDGPU_CS DRM ioctl on a local render node (/dev/dri/renderD*); there is no network, adjacent-radio, or physical-device path to the VCE command-stream parser.\nAC:L - On affected AMD GPUs using physical-mode VCE parsing, an attacker fully controls the IB and can set create-command dimensions (e.g., 65536x65536) to deterministically overflow the 32-bit size to zero without races or uncontrollable layout conditions.\nPR:L - Exploitation requires only unprivileged local access to the amdgpu DRM render node; AMDGPU_CS is gated by DRM_AUTH|DRM_RENDER_ALLOW with no root, DRM-master, or non-namespace capability requirement.\nUI:N - No victim interaction is needed beyond the attacker submitting crafted VCE command buffers through their own render-node context; no third party must open files or take other actions.\nS:C - Bypassing size-based BO relocation/validation lets VCE firmware DMA outside the intended buffer boundaries, crossing the GPU memory-isolation boundary that kernel validation is meant to enforce on GART/VRAM mappings.\nC:H - With validation defeated, VCE firmware can read arbitrarily beyond undersized encode/context/MV buffers, exposing other GPU-accessible memory including GTT-mapped system memory and adjacent VRAM allocations.\nI:H - The same out-of-bounds VCE firmware accesses enable arbitrary writes to GPU-mapped memory beyond validated buffers, providing memory-corruption primitives suitable for privilege escalation or control-flow influence.\nA:H - Oversized VCE operations against undersized buffers can trigger GPU page faults, engine hangs, GPU resets, or broader system disruption that the attacker can repeat via further command submissions."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:22.109Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/893db20383800cfe92e638705984eebb13bc81a5"
},
{
"url": "https://git.kernel.org/stable/c/a07430abd556de3707adfcadcc60db3fa64e4b2b"
},
{
"url": "https://git.kernel.org/stable/c/a6d7065b91a14790980ce6f4960db0ca8c3c9940"
},
{
"url": "https://git.kernel.org/stable/c/7eebef042c12dfe0568593ee6a8926d16505925e"
},
{
"url": "https://git.kernel.org/stable/c/00c311a13d225266800c712f2b7db2711c6897de"
},
{
"url": "https://git.kernel.org/stable/c/186bfdc4e26d019b2e7570cb121964a1d89b2e5b"
}
],
"title": "drm/amdgpu/vce: fix integer overflow in image size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68108",
"datePublished": "2026-08-10T11:58:25.241Z",
"dateReserved": "2026-07-30T09:28:09.368Z",
"dateUpdated": "2026-10-19T20:58:51.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68236 (GCVE-0-2026-68236)
Vulnerability from cvelistv5
Published
2026-08-10 12:01
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: set new_stream to NULL after release
In dm_update_crtc_state(), the skip_modeset path releases new_stream
via dc_stream_release() but does not set the pointer to NULL.
If a later error (e.g., color management failure) triggers the fail
label, the error path calls dc_stream_release() again on the same
dangling pointer, causing a double release and potential use-after-free.
Fix this by setting new_stream to NULL after the initial release.
(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f Version: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f Version: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f Version: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f Version: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f Version: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f Version: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f Version: 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68236",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:46:01.329903Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415 Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:57.661Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "92b7c6e3a1546c6db868b07e93fa6fb950d1d3a0",
"status": "affected",
"version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
"versionType": "git"
},
{
"lessThan": "bf9c06c70f496f1ba4474caf95c69696c828340e",
"status": "affected",
"version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
"versionType": "git"
},
{
"lessThan": "01ba5b36898d6258f584269537cc49e7b05cf7c6",
"status": "affected",
"version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
"versionType": "git"
},
{
"lessThan": "ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76",
"status": "affected",
"version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
"versionType": "git"
},
{
"lessThan": "5182e442e61397d446c36995b8f5676942d35b82",
"status": "affected",
"version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
"versionType": "git"
},
{
"lessThan": "679f23f0a3606afcef1ffabd72222f00a54ad9e3",
"status": "affected",
"version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
"versionType": "git"
},
{
"lessThan": "0676fecbb5242aa22c057e78326d6d6041db034c",
"status": "affected",
"version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
"versionType": "git"
},
{
"lessThan": "9fa26b9eed6195bf840f39ac183b9a6237548755",
"status": "affected",
"version": "9b690ef3c70422cdcd0cf912db33f2c92ef4a53f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: set new_stream to NULL after release\n\nIn dm_update_crtc_state(), the skip_modeset path releases new_stream\nvia dc_stream_release() but does not set the pointer to NULL.\n\nIf a later error (e.g., color management failure) triggers the fail\nlabel, the error path calls dc_stream_release() again on the same\ndangling pointer, causing a double release and potential use-after-free.\n\nFix this by setting new_stream to NULL after the initial release.\n\n(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached through the DRM atomic modeset ioctl (DRM_IOCTL_MODE_ATOMIC) on a local /dev/dri/card* node of an AMD GPU; there is no network or remote input path into dm_update_crtc_state().\nAC:L - A single atomic commit that requests a mode change while attaching a wrong-sized DEGAMMA_LUT blob deterministically drives amdgpu_dm_check_crtc_color_mgmt() to -EINVAL and hits the double dc_stream_release(); no race and no uncontrolled precondition, and TEST_ONLY commits let the attacker repeat it freely to groom the heap.\nPR:L - The atomic ioctl is gated only by DRM master on the card node, which any unprivileged local user on a graphical seat or an unused VT can hold; no CAP_SYS_ADMIN or root is needed.\nUI:N - The attacker performs the whole sequence with its own ioctl calls; no action by another user or administrator is required, and TEST_ONLY commits do not even disturb the display.\nS:U - The corrupted dc_stream_state and the resulting freed-memory reuse stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The extra kref_put() frees the dc_stream_state while the CRTC state and the DC context still reference it; reading through those dangling pointers after the slab is reallocated leaks adjacent kernel object contents and pointers, and the attacker can spray to control what lands there.\nI:H - The reference-count underflow yields a use-after-free/double-free: subsequent kref_put() writes into reallocated slab memory and dc_stream_free() kfree()s an attacker-influenced update_scratch pointer, giving write and arbitrary-free primitives usable for privilege escalation.\nA:H - Even without exploitation the premature free causes dereference of freed stream/sink/link structures during atomic state unwind, producing a kernel oops or panic and killing the display pipeline; it can be triggered repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T10:55:40.750Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/92b7c6e3a1546c6db868b07e93fa6fb950d1d3a0"
},
{
"url": "https://git.kernel.org/stable/c/bf9c06c70f496f1ba4474caf95c69696c828340e"
},
{
"url": "https://git.kernel.org/stable/c/01ba5b36898d6258f584269537cc49e7b05cf7c6"
},
{
"url": "https://git.kernel.org/stable/c/ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76"
},
{
"url": "https://git.kernel.org/stable/c/5182e442e61397d446c36995b8f5676942d35b82"
},
{
"url": "https://git.kernel.org/stable/c/679f23f0a3606afcef1ffabd72222f00a54ad9e3"
},
{
"url": "https://git.kernel.org/stable/c/0676fecbb5242aa22c057e78326d6d6041db034c"
},
{
"url": "https://git.kernel.org/stable/c/9fa26b9eed6195bf840f39ac183b9a6237548755"
}
],
"title": "drm/amd/display: set new_stream to NULL after release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68236",
"datePublished": "2026-08-10T12:01:01.114Z",
"dateReserved": "2026-07-30T09:28:09.376Z",
"dateUpdated": "2026-10-19T20:58:57.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68409 (GCVE-0-2026-68409)
Vulnerability from cvelistv5
Published
2026-08-10 12:04
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: defer link RX stats percpu free to RCU
sta_remove_link() frees a removed MLO link's RX stats percpu buffer right
away, but defers only the link container to RCU:
sta_info_free_link(&alloc->info);
kfree_rcu(alloc, rcu_head);
The RX fast path reads link_sta under rcu_read_lock and writes the percpu
stats. A reader that resolved link_sta before the removal keeps the
pointer. The container stays alive from the kfree_rcu, so the read still
works. But the percpu block it points to is already freed. This needs
uses_rss. That is when pcpu_rx_stats exists.
The full STA teardown frees the deflink stats only after
synchronize_net(). The link removal path had no such barrier. The race is
hard to win in practice, but the free should still wait for RCU.
Free the link together with its data from a single RCU callback, so the
percpu block is reclaimed only after readers drain.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68409",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:48:24.807491Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:09:09.046Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/sta_info.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a5afc00280986063f1c355821544fabbb2a960f7",
"status": "affected",
"version": "c71420db653aba30a234d1e4cf86dde376e604fa",
"versionType": "git"
},
{
"lessThan": "b679c1cffb2f3d0854b8b05ea9e909ad6489046f",
"status": "affected",
"version": "c71420db653aba30a234d1e4cf86dde376e604fa",
"versionType": "git"
},
{
"lessThan": "2aa1789880fa5e41049b0f6a74a4fc2fa1997610",
"status": "affected",
"version": "c71420db653aba30a234d1e4cf86dde376e604fa",
"versionType": "git"
},
{
"lessThan": "a03fceae0c65b31ce31840dac5e26684ceecb65b",
"status": "affected",
"version": "c71420db653aba30a234d1e4cf86dde376e604fa",
"versionType": "git"
},
{
"lessThan": "aa2eb62525188269cdd402a583b9a8ed94657ff0",
"status": "affected",
"version": "c71420db653aba30a234d1e4cf86dde376e604fa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/sta_info.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: defer link RX stats percpu free to RCU\n\nsta_remove_link() frees a removed MLO link\u0027s RX stats percpu buffer right\naway, but defers only the link container to RCU:\n\n\tsta_info_free_link(\u0026alloc-\u003einfo);\n\tkfree_rcu(alloc, rcu_head);\n\nThe RX fast path reads link_sta under rcu_read_lock and writes the percpu\nstats. A reader that resolved link_sta before the removal keeps the\npointer. The container stays alive from the kfree_rcu, so the read still\nworks. But the percpu block it points to is already freed. This needs\nuses_rss. That is when pcpu_rx_stats exists.\n\nThe full STA teardown frees the deflink stats only after\nsynchronize_net(). The link removal path had no such barrier. The race is\nhard to win in practice, but the free should still wait for RCU.\n\nFree the link together with its data from a single RCU callback, so the\npercpu block is reclaimed only after readers drain."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The race is driven entirely over the air: the RX fast path writing the freed percpu stats is fed by received 802.11 data frames, and the link removal that frees them is triggered by AP-originated ML reconfiguration/association-response handling in ieee80211_ml_reconf_work(). A rogue AP or frame injector within radio range of the victim station suffices, so this is adjacent (Wi-Fi) rather than routable network access.\nAC:L - The attacker controls both sides of the race \u2014 it supplies the RX traffic stream that dereferences link_sta and writes pcpu_rx_stats, and it triggers the MLO link removal that frees that percpu block \u2014 and can repeat link add/remove cycles indefinitely under high packet rates spread across many CPUs by RSS. No condition outside the attacker\u0027s influence is needed beyond a mainstream RSS-capable MLO driver (iwlwifi, ath11k/ath12k).\nPR:N - No privileges or accounts on the victim system are required; the frames come from the peer AP, and a rogue AP or spoofed ML reconfiguration/data frames reach the code with no authorization on the target host.\nUI:N - Frame reception, MLO link reconfiguration and station link teardown are all handled automatically by mac80211 with no action by the device\u0027s user.\nS:U - The use-after-free corrupts kernel memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The freed percpu block can be reallocated to other subsystems, and the RX path continues reading fields such as last_signal, chains and counters from it, so attacker-influenced reuse of that memory can expose kernel data; per use-after-free scoring this is treated as high confidentiality impact.\nI:H - The RX fast path performs repeated writes (last_rx, last_rate, fragments, packets, chain_signal_last) into the already-freed percpu allocation, corrupting whatever percpu data is reallocated there \u2014 an attacker-timed write primitive into arbitrary recycled kernel state.\nA:H - Writing through a freed percpu pointer from the RX hot path corrupts kernel allocator state and unrelated percpu data, readily producing oopses or panics; KASAN-instrumented kernels report the use-after-free outright."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:03.143Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a5afc00280986063f1c355821544fabbb2a960f7"
},
{
"url": "https://git.kernel.org/stable/c/b679c1cffb2f3d0854b8b05ea9e909ad6489046f"
},
{
"url": "https://git.kernel.org/stable/c/2aa1789880fa5e41049b0f6a74a4fc2fa1997610"
},
{
"url": "https://git.kernel.org/stable/c/a03fceae0c65b31ce31840dac5e26684ceecb65b"
},
{
"url": "https://git.kernel.org/stable/c/aa2eb62525188269cdd402a583b9a8ed94657ff0"
}
],
"title": "wifi: mac80211: defer link RX stats percpu free to RCU",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68409",
"datePublished": "2026-08-10T12:04:29.238Z",
"dateReserved": "2026-07-30T09:28:09.390Z",
"dateUpdated": "2026-10-21T12:44:03.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64162 (GCVE-0-2026-64162)
Vulnerability from cvelistv5
Published
2026-07-19 15:40
Modified
2026-10-19 20:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
In idpf_ptp_init(), read_dev_clk_lock is initialized after
ptp_schedule_worker() had already been called (and after
idpf_ptp_settime64() could reach the lock). The PTP aux worker
fires immediately upon scheduling and can call into
idpf_ptp_read_src_clk_reg_direct(), which takes
spin_lock(&ptp->read_dev_clk_lock) on an uninitialized lock, triggering
the lockdep "non-static key" warning:
[12973.796587] idpf 0000:83:00.0: Device HW Reset initiated
[12974.094507] INFO: trying to register non-static key.
...
[12974.097208] Call Trace:
[12974.097213] <TASK>
[12974.097218] dump_stack_lvl+0x93/0xe0
[12974.097234] register_lock_class+0x4c4/0x4e0
[12974.097249] ? __lock_acquire+0x427/0x2290
[12974.097259] __lock_acquire+0x98/0x2290
[12974.097272] lock_acquire+0xc6/0x310
[12974.097281] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf]
[12974.097311] ? lockdep_hardirqs_on_prepare+0xde/0x190
[12974.097318] ? finish_task_switch.isra.0+0xd2/0x350
[12974.097330] ? __pfx_ptp_aux_kworker+0x10/0x10 [ptp]
[12974.097343] _raw_spin_lock+0x30/0x40
[12974.097353] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf]
[12974.097373] idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf]
[12974.097391] ? kthread_worker_fn+0x88/0x3d0
[12974.097404] ? kthread_worker_fn+0x4e/0x3d0
[12974.097411] idpf_ptp_update_cached_phctime+0x26/0x120 [idpf]
[12974.097428] ? _raw_spin_unlock_irq+0x28/0x50
[12974.097436] idpf_ptp_do_aux_work+0x15/0x20 [idpf]
[12974.097454] ptp_aux_kworker+0x20/0x40 [ptp]
[12974.097464] kthread_worker_fn+0xd5/0x3d0
[12974.097474] ? __pfx_kthread_worker_fn+0x10/0x10
[12974.097482] kthread+0xf4/0x130
[12974.097489] ? __pfx_kthread+0x10/0x10
[12974.097498] ret_from_fork+0x32c/0x410
[12974.097512] ? __pfx_kthread+0x10/0x10
[12974.097519] ret_from_fork_asm+0x1a/0x30
[12974.097540] </TASK>
Move the call to spin_lock_init() up a bit to make sure read_dev_clk_lock
is not touched before it's been initialized.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64162",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:37:07.013851Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-666",
"description": "CWE-666 Operation on Resource in Wrong Phase of Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:14.274Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_ptp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eb5991d4c8ba2e8153dfcda3e66a9608377b7dce",
"status": "affected",
"version": "5cb8805d2366b20ee4d7afff586d8acf17649330",
"versionType": "git"
},
{
"lessThan": "3122d70b7c0101d897fb795658a7b93f854935f2",
"status": "affected",
"version": "5cb8805d2366b20ee4d7afff586d8acf17649330",
"versionType": "git"
},
{
"lessThan": "da4f76b6a84ede14a71282ef841768299ead0221",
"status": "affected",
"version": "5cb8805d2366b20ee4d7afff586d8acf17649330",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_ptp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()\n\nIn idpf_ptp_init(), read_dev_clk_lock is initialized after\nptp_schedule_worker() had already been called (and after\nidpf_ptp_settime64() could reach the lock). The PTP aux worker\nfires immediately upon scheduling and can call into\nidpf_ptp_read_src_clk_reg_direct(), which takes\nspin_lock(\u0026ptp-\u003eread_dev_clk_lock) on an uninitialized lock, triggering\nthe lockdep \"non-static key\" warning:\n\n[12973.796587] idpf 0000:83:00.0: Device HW Reset initiated\n[12974.094507] INFO: trying to register non-static key.\n...\n[12974.097208] Call Trace:\n[12974.097213] \u003cTASK\u003e\n[12974.097218] dump_stack_lvl+0x93/0xe0\n[12974.097234] register_lock_class+0x4c4/0x4e0\n[12974.097249] ? __lock_acquire+0x427/0x2290\n[12974.097259] __lock_acquire+0x98/0x2290\n[12974.097272] lock_acquire+0xc6/0x310\n[12974.097281] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf]\n[12974.097311] ? lockdep_hardirqs_on_prepare+0xde/0x190\n[12974.097318] ? finish_task_switch.isra.0+0xd2/0x350\n[12974.097330] ? __pfx_ptp_aux_kworker+0x10/0x10 [ptp]\n[12974.097343] _raw_spin_lock+0x30/0x40\n[12974.097353] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf]\n[12974.097373] idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf]\n[12974.097391] ? kthread_worker_fn+0x88/0x3d0\n[12974.097404] ? kthread_worker_fn+0x4e/0x3d0\n[12974.097411] idpf_ptp_update_cached_phctime+0x26/0x120 [idpf]\n[12974.097428] ? _raw_spin_unlock_irq+0x28/0x50\n[12974.097436] idpf_ptp_do_aux_work+0x15/0x20 [idpf]\n[12974.097454] ptp_aux_kworker+0x20/0x40 [ptp]\n[12974.097464] kthread_worker_fn+0xd5/0x3d0\n[12974.097474] ? __pfx_kthread_worker_fn+0x10/0x10\n[12974.097482] kthread+0xf4/0x130\n[12974.097489] ? __pfx_kthread+0x10/0x10\n[12974.097498] ret_from_fork+0x32c/0x410\n[12974.097512] ? __pfx_kthread+0x10/0x10\n[12974.097519] ret_from_fork_asm+0x1a/0x30\n[12974.097540] \u003c/TASK\u003e\n\nMove the call to spin_lock_init() up a bit to make sure read_dev_clk_lock\nis not touched before it\u0027s been initialized."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On internet-facing cloud or datacenter hosts using Intel idpf NICs, a remote peer can send sustained or crafted traffic that stalls TX completion, triggering `idpf_tx_timeout()` \u2192 hardware reset \u2192 `idpf_vc_core_init()` \u2192 `idpf_ptp_init()`, which reaches the uninitialized `read_dev_clk_lock` via the immediately scheduled PTP aux worker or `idpf_ptp_settime64()`.\nAC:L - Once PTP reinitialization runs with device clock access enabled, `ptp_schedule_worker(..., 0)` fires the aux kworker immediately and races deterministically with the late `spin_lock_init()`; the attacker does not need to win a timing lottery beyond causing the reset that enters this path.\nPR:N - Triggering the vulnerable init path via TX-timeout-driven hardware reset requires no target-system privileges\u2014only the ability to send traffic to a network interface managed by idpf, including unauthenticated remote access to a publicly reachable server.\nUI:N - Exploitation is fully automated once the attacker induces the reset/recovery sequence; no victim login, configuration change, or other voluntary action is required.\nS:U - Impact is confined to kernel/driver state on the host running idpf; it does not cross a VM, container, or IOMMU security boundary into another authority.\nC:H - Using `spin_lock()` on an uninitialized (zeroed) lock allows concurrent, unsynchronized entry into `idpf_ptp_read_src_clk_reg_direct()` and shared PHC/MMIO read paths, creating a race on kernel/driver state that can be leveraged for information disclosure under the kernel CNA guidance for synchronization-breaking bugs.\nI:H - Concurrent unsynchronized callers can interleave `idpf_ptp_enable_shtime()` MMIO writes and cached PHC updates, corrupting device clock and driver timing state in ways that constitute exploitable integrity impact beyond a benign crash.\nA:H - Taking an uninitialized spinlock during HW-reset recovery can cause kernel deadlock, oops, or hang (lockdep \u201cnon-static key\u201d failure was observed in the fix commit\u2019s HW-reset trace), satisfying high availability impact for kernel stability bugs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:39:51.253Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eb5991d4c8ba2e8153dfcda3e66a9608377b7dce"
},
{
"url": "https://git.kernel.org/stable/c/3122d70b7c0101d897fb795658a7b93f854935f2"
},
{
"url": "https://git.kernel.org/stable/c/da4f76b6a84ede14a71282ef841768299ead0221"
}
],
"title": "idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64162",
"datePublished": "2026-07-19T15:40:48.461Z",
"dateReserved": "2026-07-19T07:54:57.038Z",
"dateUpdated": "2026-10-19T20:28:14.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31663 (GCVE-0-2026-31663)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-10-21 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: hold dev ref until after transport_finish NF_HOOK
After async crypto completes, xfrm_input_resume() calls dev_put()
immediately on re-entry before the skb reaches transport_finish.
The skb->dev pointer is then used inside NF_HOOK and its okfn,
which can race with device teardown.
Remove the dev_put from the async resumption entry and instead
drop the reference after the NF_HOOK call in transport_finish,
using a saved device pointer since NF_HOOK may consume the skb.
This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip
the okfn.
For non-transport exits (decaps, gro, drop) and secondary
async return points, release the reference inline when
async is set.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: acf568ee859f098279eadf551612f103afdacb4e Version: acf568ee859f098279eadf551612f103afdacb4e Version: acf568ee859f098279eadf551612f103afdacb4e Version: acf568ee859f098279eadf551612f103afdacb4e Version: acf568ee859f098279eadf551612f103afdacb4e Version: 69895c5ea0ca2e8d7de1e6d36965d0ab9730787f Version: 833760100588acfb267dac4d6a02ab9931237739 Version: e095ecaec6d94aa2156cceb98a85d409b51190f3 Version: 3.2.100 ≤ Version: 3.16.55 ≤ Version: 4.14.24 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.55.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.164.1.rt7.505.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.164.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.49.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s `xfrm` (IP eXtensible FRamework) subsystem. This vulnerability involves a race condition where a network device\u0027s reference is released too early during packet processing after asynchronous cryptography. This premature release can lead to the system attempting to access a deallocated device, potentially causing a system crash (Denial of Service)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-826",
"description": "Premature Release of Resource During Expected Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T12:04:43.702Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-31663"
},
{
"name": "RHBZ#2461462",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461462"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31663.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:67471"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:68570"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:68531"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:68532"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:67471: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:68570: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:68531: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:68532: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: xfrm: hold dev ref until after transport_finish NF_HOOK",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31663",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:11:47.294620Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:56:02.460Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/xfrm4_input.c",
"net/ipv6/xfrm6_input.c",
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94439cbe478b53f92223da9aae95fffb28623c3f",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"lessThan": "4236c30b437b80f673b9e08c8fae38b8d471ac9e",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"lessThan": "0f451b43c88bf2b9c038b414be580efee42e031b",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"lessThan": "5002beda5cac69d522dc54da0d5d463ed9c963d2",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"lessThan": "1c428b03840094410c5fb6a5db30640486bbbfcb",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"status": "affected",
"version": "69895c5ea0ca2e8d7de1e6d36965d0ab9730787f",
"versionType": "git"
},
{
"status": "affected",
"version": "833760100588acfb267dac4d6a02ab9931237739",
"versionType": "git"
},
{
"status": "affected",
"version": "e095ecaec6d94aa2156cceb98a85d409b51190f3",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.100",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.55",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.24",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/xfrm4_input.c",
"net/ipv6/xfrm6_input.c",
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.100",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold dev ref until after transport_finish NF_HOOK\n\nAfter async crypto completes, xfrm_input_resume() calls dev_put()\nimmediately on re-entry before the skb reaches transport_finish.\nThe skb-\u003edev pointer is then used inside NF_HOOK and its okfn,\nwhich can race with device teardown.\n\nRemove the dev_put from the async resumption entry and instead\ndrop the reference after the NF_HOOK call in transport_finish,\nusing a saved device pointer since NF_HOOK may consume the skb.\nThis covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip\nthe okfn.\n\nFor non-transport exits (decaps, gro, drop) and secondary\nasync return points, release the reference inline when\nasync is set."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The complete attacker-controlled path requires a local unprivileged user to create a user/net namespace, configure transport-mode XFRM state, send traffic, and tear down the namespace/device in parallel.\nAC:L - The race is attacker-controlled in the user-namespace scenario: the attacker controls packet injection and device/netns teardown and can repeat the sequence reliably.\nPR:L - XFRM and rtnetlink setup require CAP_NET_ADMIN, but these checks are against the network namespace user_ns and are reachable after unshare -Urn by an unprivileged local user.\nUI:N - No victim action is required once the attacker can run local code and create the namespace setup.\nS:U - The vulnerable component and impacted resource are the kernel itself; this is a standard kernel memory-safety issue rather than a VM or hardware boundary escape.\nC:H - This is a net_device use-after-free, and freed kernel heap objects can potentially be reclaimed and abused for kernel memory disclosure.\nI:H - Use-after-free in kernel networking code can potentially be shaped into control-flow or data-structure corruption, so high integrity impact is appropriate.\nA:H - The issue was reproduced as a KASAN slab-use-after-free in the async XFRM reinject path and can crash the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:39:39.754Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94439cbe478b53f92223da9aae95fffb28623c3f"
},
{
"url": "https://git.kernel.org/stable/c/4236c30b437b80f673b9e08c8fae38b8d471ac9e"
},
{
"url": "https://git.kernel.org/stable/c/0f451b43c88bf2b9c038b414be580efee42e031b"
},
{
"url": "https://git.kernel.org/stable/c/5002beda5cac69d522dc54da0d5d463ed9c963d2"
},
{
"url": "https://git.kernel.org/stable/c/1c428b03840094410c5fb6a5db30640486bbbfcb"
}
],
"title": "xfrm: hold dev ref until after transport_finish NF_HOOK",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31663",
"datePublished": "2026-04-24T14:45:13.239Z",
"dateReserved": "2026-03-09T15:48:24.129Z",
"dateUpdated": "2026-10-21T12:39:39.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89970 (GCVE-0-2026-89970)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-19 08:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-auth: Synchronize timeout work during SQ teardown
nvmet_auth_sq_free() cancels auth_expired_work with
cancel_delayed_work(). If the work has already started, cancellation does
not wait for the callback. Transport teardown can consequently free or
reuse the queue containing struct nvmet_sq while
nvmet_auth_expired_work() still accesses that SQ.
Add a teardown-specific helper that synchronously drains the delayed work
before freeing authentication state, and use it from nvmet_sq_destroy().
Keep the non-synchronous helper for in-band authentication state cleanup,
where the SQ owner remains alive.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1a70200f404ae210b4f0334e3936e84f8edb6bc8 Version: 1a70200f404ae210b4f0334e3936e84f8edb6bc8 Version: 1a70200f404ae210b4f0334e3936e84f8edb6bc8 Version: 1a70200f404ae210b4f0334e3936e84f8edb6bc8 Version: 1a70200f404ae210b4f0334e3936e84f8edb6bc8 Version: 1a70200f404ae210b4f0334e3936e84f8edb6bc8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/auth.c",
"drivers/nvme/target/core.c",
"drivers/nvme/target/nvmet.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "664022fa1c93f4eba09ef5ee02411b9709dd7a93",
"status": "affected",
"version": "1a70200f404ae210b4f0334e3936e84f8edb6bc8",
"versionType": "git"
},
{
"lessThan": "c3c126a6142a1335bc8c34a5607c39cf01daf295",
"status": "affected",
"version": "1a70200f404ae210b4f0334e3936e84f8edb6bc8",
"versionType": "git"
},
{
"lessThan": "c17c87bde6d6f5252a6a6f0a94b2430164aa28d5",
"status": "affected",
"version": "1a70200f404ae210b4f0334e3936e84f8edb6bc8",
"versionType": "git"
},
{
"lessThan": "7555ddd60af72df2862dd8f9b730a9848577edda",
"status": "affected",
"version": "1a70200f404ae210b4f0334e3936e84f8edb6bc8",
"versionType": "git"
},
{
"lessThan": "eb4f9127a2b8a152743f1ee597627e2f69cb54fe",
"status": "affected",
"version": "1a70200f404ae210b4f0334e3936e84f8edb6bc8",
"versionType": "git"
},
{
"lessThan": "eaa948c0e19b1bb2d93262207bca0c3d19cc3406",
"status": "affected",
"version": "1a70200f404ae210b4f0334e3936e84f8edb6bc8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/auth.c",
"drivers/nvme/target/core.c",
"drivers/nvme/target/nvmet.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-auth: Synchronize timeout work during SQ teardown\n\nnvmet_auth_sq_free() cancels auth_expired_work with\ncancel_delayed_work(). If the work has already started, cancellation does\nnot wait for the callback. Transport teardown can consequently free or\nreuse the queue containing struct nvmet_sq while\nnvmet_auth_expired_work() still accesses that SQ.\n\nAdd a teardown-specific helper that synchronously drains the delayed work\nbefore freeing authentication state, and use it from nvmet_sq_destroy().\nKeep the non-synchronous helper for in-band authentication state cleanup,\nwhere the SQ owner remains alive."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The UAF is in nvmet-auth timeout work reached via AUTH_SEND on NVMe-oF targets; nvmet-tcp (and nvmet-rdma) accept remote connections, so a network initiator can arm the timer and tear down the queue over TCP/RDMA.\nAC:L - The attacker controls both sides of the race: AUTH_SEND schedules auth_expired_work with an attacker-chosen KATO delay, and closing the connection runs nvmet_sq_destroy(); cancel_delayed_work() does not wait, so the race is repeatable.\nPR:N - AUTH_SEND is dispatched as a Fabrics command before nvmet_check_auth_status() and before DH-HMAC-CHAP credentials are verified; discovery accepts any host NQN, so no Linux privileges or verified secrets are required.\nUI:N - No victim user action is required; the attacker connects to an already-deployed NVMe-oF target, sends AUTH_SEND to arm the timeout, and disconnects when the work is due.\nS:U - The use-after-free corrupts the in-kernel nvmet_sq/queue object on the target host and does not cross a VM, hypervisor, or IOMMU security boundary.\nC:H - Transport teardown can free or reuse the queue containing struct nvmet_sq while nvmet_auth_expired_work() still accesses it; that UAF can be leveraged for kernel information disclosure via heap reuse.\nI:H - The delayed work writes dhchap_step and dhchap_tid into a potentially freed or reused queue object, giving a kernel UAF write primitive exploitable for memory corruption and control-flow hijacking.\nA:H - Racing the timeout callback against SQ teardown is a kernel UAF of the queue and can oops or panic; the work may also dereference sq-\u003ectrl after teardown has already cleared it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:55:43.826Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/664022fa1c93f4eba09ef5ee02411b9709dd7a93"
},
{
"url": "https://git.kernel.org/stable/c/c3c126a6142a1335bc8c34a5607c39cf01daf295"
},
{
"url": "https://git.kernel.org/stable/c/c17c87bde6d6f5252a6a6f0a94b2430164aa28d5"
},
{
"url": "https://git.kernel.org/stable/c/7555ddd60af72df2862dd8f9b730a9848577edda"
},
{
"url": "https://git.kernel.org/stable/c/eb4f9127a2b8a152743f1ee597627e2f69cb54fe"
},
{
"url": "https://git.kernel.org/stable/c/eaa948c0e19b1bb2d93262207bca0c3d19cc3406"
}
],
"title": "nvmet-auth: Synchronize timeout work during SQ teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89970",
"datePublished": "2026-09-16T10:32:50.306Z",
"dateReserved": "2026-09-11T19:38:34.778Z",
"dateUpdated": "2026-10-19T08:55:43.826Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68140 (GCVE-0-2026-68140)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-10-19 20:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/iucv: fix use-after-free of a severed iucv_path
af_iucv queues not-yet-received message notifications on iucv->message_q,
each holding a raw pointer to the connection's iucv_path. When the peer
severs the connection, iucv_sever_path() frees that path with
iucv_path_free() but leaves the notifications queued. A later recvmsg()
drains message_q via iucv_process_message_q() and hands the stale path to
message_receive() -- a use-after-free of the freed iucv_path.
Drop the queued notifications when the path is severed; once the path is
gone they can no longer be received. This also frees the notifications
leaked when a socket is closed with messages still queued.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f0703c80e5156406ad947cb67fe277725b48080f Version: f0703c80e5156406ad947cb67fe277725b48080f Version: f0703c80e5156406ad947cb67fe277725b48080f Version: f0703c80e5156406ad947cb67fe277725b48080f Version: f0703c80e5156406ad947cb67fe277725b48080f Version: f0703c80e5156406ad947cb67fe277725b48080f Version: f0703c80e5156406ad947cb67fe277725b48080f Version: f0703c80e5156406ad947cb67fe277725b48080f |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68140",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:44:34.964555Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:58:53.121Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/iucv/af_iucv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5f08c5e50bcb4680069bd3f9edd5728308816ded",
"status": "affected",
"version": "f0703c80e5156406ad947cb67fe277725b48080f",
"versionType": "git"
},
{
"lessThan": "c24faf11bd31bfe0500aca12cbdd5a573a954a5d",
"status": "affected",
"version": "f0703c80e5156406ad947cb67fe277725b48080f",
"versionType": "git"
},
{
"lessThan": "99ddb33748698296a6f17b9b34aa3d16a406bb3c",
"status": "affected",
"version": "f0703c80e5156406ad947cb67fe277725b48080f",
"versionType": "git"
},
{
"lessThan": "23658b350b4107e8292045c2044983fd426fa15d",
"status": "affected",
"version": "f0703c80e5156406ad947cb67fe277725b48080f",
"versionType": "git"
},
{
"lessThan": "a5bbaddf69853117f28173c3f5c8fc14c6b2ec82",
"status": "affected",
"version": "f0703c80e5156406ad947cb67fe277725b48080f",
"versionType": "git"
},
{
"lessThan": "900cd6d8119b7f3ae5c4bf82f922ff5957df43db",
"status": "affected",
"version": "f0703c80e5156406ad947cb67fe277725b48080f",
"versionType": "git"
},
{
"lessThan": "f579582c03ed526281a8450159baf1d35099a85f",
"status": "affected",
"version": "f0703c80e5156406ad947cb67fe277725b48080f",
"versionType": "git"
},
{
"lessThan": "be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a",
"status": "affected",
"version": "f0703c80e5156406ad947cb67fe277725b48080f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/iucv/af_iucv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix use-after-free of a severed iucv_path\n\naf_iucv queues not-yet-received message notifications on iucv-\u003emessage_q,\neach holding a raw pointer to the connection\u0027s iucv_path. When the peer\nsevers the connection, iucv_sever_path() frees that path with\niucv_path_free() but leaves the notifications queued. A later recvmsg()\ndrains message_q via iucv_process_message_q() and hands the stale path to\nmessage_receive() -- a use-after-free of the freed iucv_path.\n\nDrop the queued notifications when the path is severed; once the path is\ngone they can no longer be received. This also frees the notifications\nleaked when a socket is closed with messages still queued."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - An adjacent z/VM guest or LPAR peer can establish an AF_IUCV connection and deliver IUCV message_pending and path_severed events to a victim; exploitation requires same-CPC IUCV reachability, not Internet-wide access.\nAC:L - The attacker deterministically floods IUCV messages to fill message_q, severs the connection to free iucv_path, then victim recvmsg() drains the stale queue; no uncontrollable timing or memory-layout luck is required.\nPR:N - On the victim, no local Linux account or capability is needed; any unauthorized adjacent IUCV peer that completes the AF_IUCV handshake can flood messages and sever the path against a listening service.\nUI:N - No special victim action is required beyond normal server recvmsg() on an established IUCV session; the attacker drives connection setup, message flood, and path sever entirely from the peer side.\nS:U - Impact is kernel memory corruption within the victim Linux guest; it does not cross hypervisor, VM-escape, or IOMMU security boundaries.\nC:H - Queued notifications dereference a freed struct iucv_path in message_receive(), passing stale pathid and private fields into CP IUCV RECEIVE calls\u2014a classic UAF enabling attacker-controlled heap reuse and kernel memory disclosure.\nI:H - Use-after-free of iucv_path lets an attacker reclaim the freed object and supply forged pathid and list pointers used by __iucv_message_receive(), providing heap corruption primitives suitable for arbitrary kernel write or code execution.\nA:H - Processing the stale path in iucv_process_message_q() dereferences freed kernel memory during message_receive(), reliably causing kernel oops or panic and total loss of availability even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:57.127Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5f08c5e50bcb4680069bd3f9edd5728308816ded"
},
{
"url": "https://git.kernel.org/stable/c/c24faf11bd31bfe0500aca12cbdd5a573a954a5d"
},
{
"url": "https://git.kernel.org/stable/c/99ddb33748698296a6f17b9b34aa3d16a406bb3c"
},
{
"url": "https://git.kernel.org/stable/c/23658b350b4107e8292045c2044983fd426fa15d"
},
{
"url": "https://git.kernel.org/stable/c/a5bbaddf69853117f28173c3f5c8fc14c6b2ec82"
},
{
"url": "https://git.kernel.org/stable/c/900cd6d8119b7f3ae5c4bf82f922ff5957df43db"
},
{
"url": "https://git.kernel.org/stable/c/f579582c03ed526281a8450159baf1d35099a85f"
},
{
"url": "https://git.kernel.org/stable/c/be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a"
}
],
"title": "net/iucv: fix use-after-free of a severed iucv_path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68140",
"datePublished": "2026-08-10T11:59:03.761Z",
"dateReserved": "2026-07-30T09:28:09.370Z",
"dateUpdated": "2026-10-19T20:58:53.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63920 (GCVE-0-2026-63920)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-19 20:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: validate extension header length before copying to cmsg
ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}
cmsgs (and their IPV6_2292* legacy counterparts) by trusting the
on-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.
The length was validated only at parse time (ipv6_parse_hopopts(),
etc.). An nftables payload-write expression can rewrite hdrlen after
parsing and before the skb reaches recvmsg; the write itself is
in-bounds but put_cmsg() then reads up to ((hdrlen+1) << 3) = 2040
bytes from an 8-byte header. nftables is reachable from an
unprivileged user namespace, so this is an unprivileged
slab-out-of-bounds read:
BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540
put_cmsg+0x3ac/0x540
udpv6_recvmsg+0xca0/0x1250
sock_recvmsg+0xdf/0x190
____sys_recvmsg+0x1b1/0x620
Add ipv6_get_exthdr_len() which validates that at least two bytes
are accessible before reading the hdrlen field, then checks the
computed length against skb_tail_pointer(skb), returning 0 on
failure. Extension headers are kept in the linear skb area by
pskb_may_pull() during input, so skb_tail_pointer() is the correct
bound.
Use ipv6_get_exthdr_len() at all non-AH call sites: the five
standalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR)
and the three standard cases in the extension-header walk loop
(DSTOPTS, ROUTING, default). AH retains an inline bounds check
because its length formula differs ((ptr[1]+2)<<2).
The walk loop also gets a pre-read bounds check at the top to
validate ptr before any case accesses ptr[0] or ptr[1].
When the walk loop detects a corrupted header, return from the
function instead of continuing to process later socket options.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63920",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:33:23.448048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:56.265Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/datagram.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81394827dfb72772c50d0ae3bdfa094428a5d76d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "931b4a1f13408c2507719890f78f7227c34a0282",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "08464413e628803bd10cb1df68d0138665f2f885",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a29768d56eb3798c052ad3281b05596e695a17af",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0d330eff318c0f44d4fb0ad2c2aef38f87f24c90",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a35daeabb433686234b010ebf7b53778dbd6c9b8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "eb18a1b1644e4cad978df2131e2bb9a2e6886992",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "dd433671fef381fdaf7b530c631e6b782d66e224",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/datagram.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: validate extension header length before copying to cmsg\n\nip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR}\ncmsgs (and their IPV6_2292* legacy counterparts) by trusting the\non-wire hdrlen byte (ptr[1]) when computing the put_cmsg() length.\nThe length was validated only at parse time (ipv6_parse_hopopts(),\netc.). An nftables payload-write expression can rewrite hdrlen after\nparsing and before the skb reaches recvmsg; the write itself is\nin-bounds but put_cmsg() then reads up to ((hdrlen+1) \u003c\u003c 3) = 2040\nbytes from an 8-byte header. nftables is reachable from an\nunprivileged user namespace, so this is an unprivileged\nslab-out-of-bounds read:\n\n BUG: KASAN: slab-out-of-bounds in put_cmsg+0x3ac/0x540\n put_cmsg+0x3ac/0x540\n udpv6_recvmsg+0xca0/0x1250\n sock_recvmsg+0xdf/0x190\n ____sys_recvmsg+0x1b1/0x620\n\nAdd ipv6_get_exthdr_len() which validates that at least two bytes\nare accessible before reading the hdrlen field, then checks the\ncomputed length against skb_tail_pointer(skb), returning 0 on\nfailure. Extension headers are kept in the linear skb area by\npskb_may_pull() during input, so skb_tail_pointer() is the correct\nbound.\n\nUse ipv6_get_exthdr_len() at all non-AH call sites: the five\nstandalone cmsg blocks (HbH, 2292HbH, 2292DSTOPTS x2, 2292RTHDR)\nand the three standard cases in the extension-header walk loop\n(DSTOPTS, ROUTING, default). AH retains an inline bounds check\nbecause its length formula differs ((ptr[1]+2)\u003c\u003c2).\n\nThe walk loop also gets a pre-read bounds check at the top to\nvalidate ptr before any case accesses ptr[0] or ptr[1].\n\nWhen the walk loop detects a corrupted header, return from the\nfunction instead of continuing to process later socket options."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscalls (nftables netlink to install a payload-set rule, setsockopt for IPV6_RECV* options, and recvmsg). Although the trigger packet is received over IPv6, the mandatory nftables corruption step is classified as Local per kernel guidance.\nAC:L - The attacker fully controls the nftables payload-set rule, the on-wire extension header, socket receive options, and the recvmsg call, making the slab out-of-bounds read reliably reproducible without races or external conditions.\nPR:L - An unprivileged local user can create a user+network namespace, obtain CAP_NET_ADMIN there, configure nftables, open a UDPv6/raw socket with extension-header cmsg options, and trigger the bug without real root in the initial namespace.\nUI:N - No victim interaction is required; the attacker can send the crafted IPv6 datagram and call recvmsg on their own socket to trigger the out-of-bounds read.\nS:U - Impact is confined to kernel memory disclosure and potential kernel instability within the same kernel security domain; it does not cross a VM/host or IOMMU boundary.\nC:H - put_cmsg() can copy up to 2040 bytes past the actual extension header into userspace ancillary data, leaking adjacent slab/kernel memory (confirmed by KASAN slab-out-of-bounds in put_cmsg).\nI:N - The bug is an out-of-bounds read that copies kernel data to userspace; it does not modify kernel memory, corrupt control structures, or provide a write primitive.\nA:H - The out-of-bounds slab read can provoke a KASAN fault/kernel oops during put_cmsg(), and repeated triggering can deny availability of the affected system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:14.814Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81394827dfb72772c50d0ae3bdfa094428a5d76d"
},
{
"url": "https://git.kernel.org/stable/c/931b4a1f13408c2507719890f78f7227c34a0282"
},
{
"url": "https://git.kernel.org/stable/c/08464413e628803bd10cb1df68d0138665f2f885"
},
{
"url": "https://git.kernel.org/stable/c/a29768d56eb3798c052ad3281b05596e695a17af"
},
{
"url": "https://git.kernel.org/stable/c/0d330eff318c0f44d4fb0ad2c2aef38f87f24c90"
},
{
"url": "https://git.kernel.org/stable/c/a35daeabb433686234b010ebf7b53778dbd6c9b8"
},
{
"url": "https://git.kernel.org/stable/c/eb18a1b1644e4cad978df2131e2bb9a2e6886992"
},
{
"url": "https://git.kernel.org/stable/c/dd433671fef381fdaf7b530c631e6b782d66e224"
}
],
"title": "ipv6: validate extension header length before copying to cmsg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63920",
"datePublished": "2026-07-19T14:55:22.813Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-10-19T20:17:56.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89689 (GCVE-0-2026-89689)
Vulnerability from cvelistv5
Published
2026-09-11 19:46
Modified
2026-10-19 08:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfsd: don't free session slots that are still in use
nfsd4_sequence() can free the very slot it is currently processing.
When the session shrinker has reduced se_target_maxslots below
se_fchannel.maxreqs, the shrink path checks three conditions before
calling free_session_slots():
1. se_target_maxslots < maxreqs (shrink was advertised)
2. slot->sl_generation == se_slot_gen (slot is up-to-date)
3. seq->maxslots <= se_target_maxslots (client acknowledges)
However, seq->slotid is never checked against se_target_maxslots.
A client using a slot in the range [se_target_maxslots, maxreqs) can
satisfy all three conditions: its slot has the current generation
(set by a prior SEQUENCE), and it sends sa_highest_slotid <=
se_target_maxslots to acknowledge the reduction.
free_session_slots() then kfrees every slot at index >=
se_target_maxslots, including the caller's own slot. The function
continues to write sl_seqid, sl_flags, sl_generation, and stores the
dangling pointer in cstate->slot. Later, nfsd4_store_cache_entry()
copies up to maxresp_cached bytes of the compound reply into the freed
sl_data[] array, corrupting whatever slab object now occupies that
address.
Additionally, a concurrent thread processing SEQUENCE on a different
high-numbered slot can have its slot freed out from under it.
NFSD4_SLOT_INUSE is set under nn->client_lock before the lock is
released, so any concurrent thread past SEQUENCE will have its slot
marked. However, free_session_slots() does not check NFSD4_SLOT_INUSE
before freeing.
Fix both problems by:
1. Checking that the current request's slotid is below the shrink
boundary.
2. Scanning slots in the to-be-freed range for NFSD4_SLOT_INUSE and
deferring the shrink if any are active.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "72d40b103bb03f0124d3a3c8f71a30cbafaf6afa",
"status": "affected",
"version": "fc8738c68d0bbf5033dd98b4f63d277ecbd49fd7",
"versionType": "git"
},
{
"lessThan": "b449b134e7762ddf98653a4b1d3e76d2d212ea64",
"status": "affected",
"version": "fc8738c68d0bbf5033dd98b4f63d277ecbd49fd7",
"versionType": "git"
},
{
"lessThan": "f5d22e372f4ac3eb287037a488c29691d52a6330",
"status": "affected",
"version": "fc8738c68d0bbf5033dd98b4f63d277ecbd49fd7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: don\u0027t free session slots that are still in use\n\nnfsd4_sequence() can free the very slot it is currently processing.\nWhen the session shrinker has reduced se_target_maxslots below\nse_fchannel.maxreqs, the shrink path checks three conditions before\ncalling free_session_slots():\n\n 1. se_target_maxslots \u003c maxreqs (shrink was advertised)\n 2. slot-\u003esl_generation == se_slot_gen (slot is up-to-date)\n 3. seq-\u003emaxslots \u003c= se_target_maxslots (client acknowledges)\n\nHowever, seq-\u003eslotid is never checked against se_target_maxslots.\nA client using a slot in the range [se_target_maxslots, maxreqs) can\nsatisfy all three conditions: its slot has the current generation\n(set by a prior SEQUENCE), and it sends sa_highest_slotid \u003c=\nse_target_maxslots to acknowledge the reduction.\n\nfree_session_slots() then kfrees every slot at index \u003e=\nse_target_maxslots, including the caller\u0027s own slot. The function\ncontinues to write sl_seqid, sl_flags, sl_generation, and stores the\ndangling pointer in cstate-\u003eslot. Later, nfsd4_store_cache_entry()\ncopies up to maxresp_cached bytes of the compound reply into the freed\nsl_data[] array, corrupting whatever slab object now occupies that\naddress.\n\nAdditionally, a concurrent thread processing SEQUENCE on a different\nhigh-numbered slot can have its slot freed out from under it.\nNFSD4_SLOT_INUSE is set under nn-\u003eclient_lock before the lock is\nreleased, so any concurrent thread past SEQUENCE will have its slot\nmarked. However, free_session_slots() does not check NFSD4_SLOT_INUSE\nbefore freeing.\n\nFix both problems by:\n 1. Checking that the current request\u0027s slotid is below the shrink\n boundary.\n 2. Scanning slots in the to-be-freed range for NFSD4_SLOT_INUSE and\n deferring the shrink if any are active."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in nfsd4_sequence() in the in-kernel NFSv4.1 server (fs/nfsd/nfs4state.c). A remote client reaches it by sending COMPOUND RPCs with OP_SEQUENCE over TCP/2049 after EXCHANGE_ID/CREATE_SESSION; no local access to the NFS server is required.\nAC:L - After CREATE_SESSION with multiple slots, the attacker can grow the slot table and consume DRC memory so the nfsd-DRC-slot shrinker lowers se_target_maxslots, which SEQUENCE replies report. A SEQUENCE on a high slotid with sa_highest_slotid acknowledging the shrink then kfree\u0027s that in-use slot. Slotid, maxslots, cachethis, and concurrent COMPOUNDs are attacker-controlled.\nPR:N - Typical nfsd deployments accept AUTH_SYS/AUTH_NULL without cryptographic authentication. Any host allowed by the export ACL can EXCHANGE_ID/CREATE_SESSION and then SEQUENCE (ALLOWED_WITHOUT_FH, no filehandle or OPEN required); no local account or capability on the NFS server is needed.\nUI:N - The attacking NFS client sends the EXCHANGE_ID, CREATE_SESSION, and crafted SEQUENCE compounds itself. No victim user or administrator action on the NFS server, such as mounting an export or opening a file, is required.\nS:U - The use-after-free corrupts nfsd session-slot heap objects inside the NFS server host kernel. Impact stays in that kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - free_session_slots() kfree\u0027s the nfsd4_slot still referenced by cstate-\u003eslot. Later nfsd4_store_cache_entry() and SEQUENCE processing read the freed object, including sl_cred. Slab reuse of the DRC slot (up to 2048-byte sl_data) enables arbitrary kernel memory disclosure per UAF guidance.\nI:H - After the kfree, nfsd4_sequence() writes sl_seqid, sl_flags, and sl_generation through the dangling pointer, and nfsd4_store_cache_entry() copies up to maxresp_cached bytes of the compound reply into freed sl_data[] and runs free_svc_cred() on reused memory, yielding a kernel heap write/arbitrary-free primitive.\nA:H - Use-after-free of the in-use session slot oopses or panics nfsd when the dangling cstate-\u003eslot is dereferenced or when concurrent SEQUENCE threads hit a freed slot. The attacker can repeat the SEQUENCE compounds to deny NFS service and take down the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:51:02.559Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/72d40b103bb03f0124d3a3c8f71a30cbafaf6afa"
},
{
"url": "https://git.kernel.org/stable/c/b449b134e7762ddf98653a4b1d3e76d2d212ea64"
},
{
"url": "https://git.kernel.org/stable/c/f5d22e372f4ac3eb287037a488c29691d52a6330"
}
],
"title": "nfsd: don\u0027t free session slots that are still in use",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89689",
"datePublished": "2026-09-11T19:46:09.976Z",
"dateReserved": "2026-09-11T19:38:34.749Z",
"dateUpdated": "2026-10-19T08:51:02.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64508 (GCVE-0-2026-64508)
Vulnerability from cvelistv5
Published
2026-07-25 08:52
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Support for hardening against JIT spraying
The BPF JIT allocator packs many small programs into larger executable
allocations and reuses space within those allocations as programs are
loaded and freed. When fresh code is written into space that a previous
program occupied, an indirect jump into the new program can reuse a branch
prediction left behind by the old one.
Flush the indirect branch predictors before reusing JIT memory so that
indirect jumps into a newly written program don't reuse predictions from an
old program that occupied the same space.
Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush
static call for flushing the branch predictors on JIT memory reuse.
Architectures that need a flush, can update it to a predictor flush
function. By default, its a NOP and does not emit any CALL.
Allocations larger than a pack are not covered by this flush. That is safe
because cBPF programs (the unprivileged attack surface) are bounded well
below a pack size. Issue a warning if this assumption is ever violated
while the flush is active.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/filter.h",
"kernel/bpf/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1fbafd5235ca897b322161659ebe8ba651b00b3b",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "6e52c240c43a601b681e3a4e58fc5685114d4726",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "eed774da601268dae674e14d54a15e3624691f52",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "8ff183ee4d8c452960df58175a094828c0513b2e",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "7a6c171c6a1ac6d1509752dac131d941a3de0b37",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "96cce16e26dd02a8678f1e87f88a4b5cdb63b995",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/filter.h",
"kernel/bpf/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Support for hardening against JIT spraying\n\nThe BPF JIT allocator packs many small programs into larger executable\nallocations and reuses space within those allocations as programs are\nloaded and freed. When fresh code is written into space that a previous\nprogram occupied, an indirect jump into the new program can reuse a branch\nprediction left behind by the old one.\n\nFlush the indirect branch predictors before reusing JIT memory so that\nindirect jumps into a newly written program don\u0027t reuse predictions from an\nold program that occupied the same space.\n\nIntroduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush\nstatic call for flushing the branch predictors on JIT memory reuse.\nArchitectures that need a flush, can update it to a predictor flush\nfunction. By default, its a NOP and does not emit any CALL.\n\nAllocations larger than a pack are not covered by this flush. That is safe\nbecause cBPF programs (the unprivileged attack surface) are bounded well\nbelow a pack size. Issue a warning if this assumption is ever violated\nwhile the flush is active."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:20.972Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1fbafd5235ca897b322161659ebe8ba651b00b3b"
},
{
"url": "https://git.kernel.org/stable/c/6e52c240c43a601b681e3a4e58fc5685114d4726"
},
{
"url": "https://git.kernel.org/stable/c/eed774da601268dae674e14d54a15e3624691f52"
},
{
"url": "https://git.kernel.org/stable/c/8ff183ee4d8c452960df58175a094828c0513b2e"
},
{
"url": "https://git.kernel.org/stable/c/7a6c171c6a1ac6d1509752dac131d941a3de0b37"
},
{
"url": "https://git.kernel.org/stable/c/96cce16e26dd02a8678f1e87f88a4b5cdb63b995"
}
],
"title": "bpf: Support for hardening against JIT spraying",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64508",
"datePublished": "2026-07-25T08:52:01.732Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-08-19T16:28:20.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89894 (GCVE-0-2026-89894)
Vulnerability from cvelistv5
Published
2026-09-16 10:31
Modified
2026-10-19 08:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: cx231xx: reject geometry changes while the VBI queue is busy
vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide
dev->width / dev->norm but only refuse the change when the *video* queue
(dev->vidq) is busy. The VBI queue (dev->vbiq) shares that same geometry:
cx231xx_init_vbi_isoc() latches dma_q->lines_per_field from dev->norm,
the VBI videobuf2 plane is sized from dev->width / dev->norm in
vbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then
recomputes the destination offset from the *live* dev->width and the
latched lines_per_field on every URB completion:
offset = lines_completed * (dev->width << 1) + ...;
if (dma_q->current_field == 2)
offset += dev->width * 2 * dma_q->lines_per_field;
memcpy(plane + offset, p_buffer, lencopy);
Because the VBI node shares video_ioctl_ops with the video node, an
application can size a small VBI plane (REQBUFS/QBUF with a small width,
or with the NTSC standard), then enlarge dev->width (or switch dev->norm
to PAL) through the video node while the VBI stream is running -- the
change is allowed because only dev->vidq is checked -- and let the device
deliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the
offset with the larger geometry and memcpy()s past the end of the smaller
plane that was already allocated, a heap out-of-bounds write whose offset
is attacker-chosen and whose contents come from the device. The
per-field guard in cx231xx_copy_vbi_line() does not help: it bounds the
copy against the latched lines_per_field, not the plane's real capacity,
and vb2 does not re-run buf_prepare() for an already prepared buffer.
Refuse the format/standard change when the VBI queue is busy as well, so
the geometry cannot change underneath an allocated VBI buffer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab Version: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab Version: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab Version: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab Version: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab Version: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab Version: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab Version: 7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/cx231xx/cx231xx-video.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aa3314506deb9703bcf0e889db08959440228fbf",
"status": "affected",
"version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
"versionType": "git"
},
{
"lessThan": "90d50648af36a1fbf5dbc99238de6fd0e58a13e0",
"status": "affected",
"version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
"versionType": "git"
},
{
"lessThan": "a5dd3d7fba358ff9486f3f51b2a9038348c0970a",
"status": "affected",
"version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
"versionType": "git"
},
{
"lessThan": "54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d",
"status": "affected",
"version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
"versionType": "git"
},
{
"lessThan": "1d1079db8d1807e259a1d2679ed314949797aad9",
"status": "affected",
"version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
"versionType": "git"
},
{
"lessThan": "7087bef6510c7df5df0b19192633b8ecc0f33a6f",
"status": "affected",
"version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
"versionType": "git"
},
{
"lessThan": "a636c72c7f522d984fa498fc0631f33a2d0be3fd",
"status": "affected",
"version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
"versionType": "git"
},
{
"lessThan": "627a121c15fe05a541f44d86016294b80bada75d",
"status": "affected",
"version": "7c617138b8254a6bb60bfb5b8fc53eb8b3d6c3ab",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/cx231xx/cx231xx-video.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.110",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx231xx: reject geometry changes while the VBI queue is busy\n\nvidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide\ndev-\u003ewidth / dev-\u003enorm but only refuse the change when the *video* queue\n(dev-\u003evidq) is busy. The VBI queue (dev-\u003evbiq) shares that same geometry:\ncx231xx_init_vbi_isoc() latches dma_q-\u003elines_per_field from dev-\u003enorm,\nthe VBI videobuf2 plane is sized from dev-\u003ewidth / dev-\u003enorm in\nvbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then\nrecomputes the destination offset from the *live* dev-\u003ewidth and the\nlatched lines_per_field on every URB completion:\n\n\toffset = lines_completed * (dev-\u003ewidth \u003c\u003c 1) + ...;\n\tif (dma_q-\u003ecurrent_field == 2)\n\t\toffset += dev-\u003ewidth * 2 * dma_q-\u003elines_per_field;\n\tmemcpy(plane + offset, p_buffer, lencopy);\n\nBecause the VBI node shares video_ioctl_ops with the video node, an\napplication can size a small VBI plane (REQBUFS/QBUF with a small width,\nor with the NTSC standard), then enlarge dev-\u003ewidth (or switch dev-\u003enorm\nto PAL) through the video node while the VBI stream is running -- the\nchange is allowed because only dev-\u003evidq is checked -- and let the device\ndeliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the\noffset with the larger geometry and memcpy()s past the end of the smaller\nplane that was already allocated, a heap out-of-bounds write whose offset\nis attacker-chosen and whose contents come from the device. The\nper-field guard in cx231xx_copy_vbi_line() does not help: it bounds the\ncopy against the latched lines_per_field, not the plane\u0027s real capacity,\nand vb2 does not re-run buf_prepare() for an already prepared buffer.\n\nRefuse the format/standard change when the VBI queue is busy as well, so\nthe geometry cannot change underneath an allocated VBI buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The overflow is reached only through local V4L2 ioctls (VIDIOC_S_FMT/VIDIOC_S_STD plus REQBUFS/QBUF/STREAMON) on the cx231xx /dev/videoN and /dev/vbiN nodes. A USB capture stick being present is a hardware precondition; the attacker does not inject USB packets, so the path is Local rather than Physical.\nAC:L - The attacker fully controls the sequence: shrink width via VIDIOC_S_FMT, allocate a small VBI plane, STREAMON, then enlarge width or switch standard on the video node while only vidq was checked. Subsequent URB completions copy field-2 VBI with the new geometry into the old plane with no race or layout outside the attacker\u0027s control.\nPR:L - cx231xx_v4l2_open(), vidioc_s_fmt_vid_cap(), and vidioc_s_std() perform no capability checks. Triggering the bug needs only an unprivileged local user who can open the V4L2 nodes, which udev grants via the video group and uaccess/logind (or the Android camera context), not init-namespace root.\nUI:N - The attacking process opens /dev/videoN and /dev/vbiN and issues the ioctl sequence itself. No separate victim action such as plugging in a device, mounting a filesystem, or running a privileged helper is required.\nS:U - The out-of-bounds memcpy corrupts kernel vmalloc memory belonging to the same host kernel. Impact is local privilege-escalation or denial of service within one security authority, not a VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - cx231xx_do_vbi_copy() memcpy()s past the undersized VBI plane at an attacker-chosen offset derived from the new width and latched lines_per_field. That heap out-of-bounds write can smash adjacent vmalloc objects and is leverageable for a kernel read primitive.\nI:H - The same attacker-chosen-offset heap out-of-bounds write overwrites kernel memory after the VBI buffer on every field-2 URB completion. An out-of-bounds write of this form is sufficient for control-flow hijacking and an arbitrary write primitive.\nA:H - memcpy() past the allocated VBI plane faults on a vmalloc guard page or corrupts adjacent kernel memory, producing a kernel oops or panic from URB completion context and taking down the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:54:27.208Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aa3314506deb9703bcf0e889db08959440228fbf"
},
{
"url": "https://git.kernel.org/stable/c/90d50648af36a1fbf5dbc99238de6fd0e58a13e0"
},
{
"url": "https://git.kernel.org/stable/c/a5dd3d7fba358ff9486f3f51b2a9038348c0970a"
},
{
"url": "https://git.kernel.org/stable/c/54ac6df8b8d97eddc3ae97fd2045bdedc8541b6d"
},
{
"url": "https://git.kernel.org/stable/c/1d1079db8d1807e259a1d2679ed314949797aad9"
},
{
"url": "https://git.kernel.org/stable/c/7087bef6510c7df5df0b19192633b8ecc0f33a6f"
},
{
"url": "https://git.kernel.org/stable/c/a636c72c7f522d984fa498fc0631f33a2d0be3fd"
},
{
"url": "https://git.kernel.org/stable/c/627a121c15fe05a541f44d86016294b80bada75d"
}
],
"title": "media: cx231xx: reject geometry changes while the VBI queue is busy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89894",
"datePublished": "2026-09-16T10:31:56.101Z",
"dateReserved": "2026-09-11T19:38:34.773Z",
"dateUpdated": "2026-10-19T08:54:27.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43332 (GCVE-0-2026-43332)
Vulnerability from cvelistv5
Published
2026-05-08 13:31
Modified
2026-10-19 19:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
thermal: core: Fix thermal zone device registration error path
If thermal_zone_device_register_with_trips() fails after registering
a thermal zone device, it needs to wait for the tz->removal completion
like thermal_zone_device_unregister(), in case user space has managed
to take a reference to the thermal zone device's kobject, in which case
thermal_release() may not be called by the error path itself and tz may
be freed prematurely.
Add the missing wait_for_completion() call to the thermal zone device
registration error path.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 335176dd8ebaca6493807dceea33c478305667fa Version: 04e6ccfc93c5a1aa1d75a537cf27e418895e20ea Version: 04e6ccfc93c5a1aa1d75a537cf27e418895e20ea Version: 04e6ccfc93c5a1aa1d75a537cf27e418895e20ea Version: 04e6ccfc93c5a1aa1d75a537cf27e418895e20ea Version: 02871710b93058eb1249d5847c0b2d1c2c3c98ae Version: 6.6.14 ≤ Version: 6.7.2 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-43332",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:16:27.233039Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:16:26.610Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thermal/thermal_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9e796001af97a1f7368d5114b7a8533dd98d797a",
"status": "affected",
"version": "335176dd8ebaca6493807dceea33c478305667fa",
"versionType": "git"
},
{
"lessThan": "604da9c04c218362e1c1457304ebeb9c199d537c",
"status": "affected",
"version": "04e6ccfc93c5a1aa1d75a537cf27e418895e20ea",
"versionType": "git"
},
{
"lessThan": "c4c7219e93319bba9ba0765dee597784c78f63c5",
"status": "affected",
"version": "04e6ccfc93c5a1aa1d75a537cf27e418895e20ea",
"versionType": "git"
},
{
"lessThan": "4d390f0e507dfb16d58f83a58d78d1150dc8b9d7",
"status": "affected",
"version": "04e6ccfc93c5a1aa1d75a537cf27e418895e20ea",
"versionType": "git"
},
{
"lessThan": "9e07e3b81807edd356e1f794cffa00a428eff443",
"status": "affected",
"version": "04e6ccfc93c5a1aa1d75a537cf27e418895e20ea",
"versionType": "git"
},
{
"status": "affected",
"version": "02871710b93058eb1249d5847c0b2d1c2c3c98ae",
"versionType": "git"
},
{
"lessThan": "6.6.134",
"status": "affected",
"version": "6.6.14",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thermal/thermal_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "6.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Fix thermal zone device registration error path\n\nIf thermal_zone_device_register_with_trips() fails after registering\na thermal zone device, it needs to wait for the tz-\u003eremoval completion\nlike thermal_zone_device_unregister(), in case user space has managed\nto take a reference to the thermal zone device\u0027s kobject, in which case\nthermal_release() may not be called by the error path itself and tz may\nbe freed prematurely.\n\nAdd the missing wait_for_completion() call to the thermal zone device\nregistration error path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is thermal zone registration/error handling exposed through local kernel device/sysfs activity, not through remote packets or an adjacent/physical protocol.\nAC:L - The race is between local userspace taking a sysfs/kobject reference and the registration error path dropping the device reference; a local attacker can influence the reference side and resource pressure, so under the overestimate rule this is low complexity.\nPR:L - No capability is needed to take references to readable thermal sysfs objects, and a basic local user can race that exposure; root-only debugfs testing paths also exist, but the higher-severity defensible metric is low privileges.\nUI:N - Exploitation does not require a separate victim to open a file or mount anything; the attacker can run local code to monitor/open the thermal sysfs object during registration failure.\nS:U - The corrupted object is in the kernel thermal core and impacts the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossing.\nC:H - The missing wait can free the thermal zone while a kobject reference keeps release deferred, producing a use-after-free on a kernel object; such memory corruption can be leveraged for kernel memory disclosure.\nI:H - The delayed release path dereferences and frees fields from the prematurely freed thermal zone, giving exploitable heap corruption/use-after-free conditions that can support arbitrary modification or code execution.\nA:H - Even without full exploitation, the use-after-free in the device release path can cause kernel oops/panic or heap corruption, resulting in high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:17.446Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9e796001af97a1f7368d5114b7a8533dd98d797a"
},
{
"url": "https://git.kernel.org/stable/c/604da9c04c218362e1c1457304ebeb9c199d537c"
},
{
"url": "https://git.kernel.org/stable/c/c4c7219e93319bba9ba0765dee597784c78f63c5"
},
{
"url": "https://git.kernel.org/stable/c/4d390f0e507dfb16d58f83a58d78d1150dc8b9d7"
},
{
"url": "https://git.kernel.org/stable/c/9e07e3b81807edd356e1f794cffa00a428eff443"
}
],
"title": "thermal: core: Fix thermal zone device registration error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43332",
"datePublished": "2026-05-08T13:31:19.460Z",
"dateReserved": "2026-05-01T14:12:56.002Z",
"dateUpdated": "2026-10-19T19:16:26.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63917 (GCVE-0-2026-63917)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-19 20:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: Use ip6_tnl.net in vti6_changelink().
ip netns add ns1
ip netns add ns2
ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7
ip -n ns1 link set vti6_test netns ns2
ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9
ip netns del ns2
ip netns del ns1
[ 132.495484] ------------[ cut here ]------------
[ 132.497609] kernel BUG at net/core/dev.c:12376!
Commit 61220ab34948 ("vti6: Enable namespace changing") dropped
NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then
move through IFLA_NET_NS_FD. After the move dev_net(dev) points
at the new netns while t->net stays at the creation netns.
vti6_changelink() and vti6_update() still use dev_net(dev) and
dev_net(t->dev). They unlink from one per netns hash and relink
into another. The creation netns is left with a stale entry.
cleanup_net() of that netns later walks freed memory.
Reachable from an unprivileged user namespace (unshare --user
--map-root-user --net). Cross tenant scope on container hosts.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63917",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:33:18.521375Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:55.945Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0cdce7618464f7fb06f461e8f4ad575cb1d570f4",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "f5c68875e25f331e497ddfbe81e2d8163a87f136",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "d9c5eecdb3c740e65038651db7c686b10d76d1bc",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "f1e89a943ee574d0f2f16246eb3f2d7330fdeb03",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "225b467e3b631f38be22e4b38062a1fed02fdd21",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "fc32be9ac2788524c6b24efd681cce7a6e731a92",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "ee1778ba0f5cb53be771f97017d01eb356c797bf",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_changelink().\n\nip netns add ns1\nip netns add ns2\nip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7\nip -n ns1 link set vti6_test netns ns2\nip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9\nip netns del ns2\nip netns del ns1\n[ 132.495484] ------------[ cut here ]------------\n[ 132.497609] kernel BUG at net/core/dev.c:12376!\n\nCommit 61220ab34948 (\"vti6: Enable namespace changing\") dropped\nNETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then\nmove through IFLA_NET_NS_FD. After the move dev_net(dev) points\nat the new netns while t-\u003enet stays at the creation netns.\n\nvti6_changelink() and vti6_update() still use dev_net(dev) and\ndev_net(t-\u003edev). They unlink from one per netns hash and relink\ninto another. The creation netns is left with a stale entry.\ncleanup_net() of that netns later walks freed memory.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through rtnetlink configuration (RTM_NEWLINK changelink and RTM_SETLINK netns move via `ip link`), not through remote packet handling on the vti6 tunnel itself.\nAC:L - Exploitation is a deterministic, attacker-controlled sequence (create vti6, move netns, changelink, delete netns) with no races or external victim state required.\nPR:L - The fix commit and rtnetlink path confirm reachability with CAP_NET_ADMIN inside an unprivileged user+network namespace (`unshare --user --map-root-user --net`), not init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug entirely through their own netlink operations.\nS:C - On container hosts, an unprivileged tenant can corrupt namespace teardown and panic the host kernel, impacting resources outside the attacker\u0027s security scope (other tenants and the host).\nC:H - The stale per-netns hash leaves `cleanup_net()`/`vti6_exit_rtnl_net()` walking freed `ip6_tnl` list nodes, constituting a use-after-free with arbitrary kernel memory read potential.\nI:H - Cross-netns hash corruption can leave dangling pointers and drive `unregister_netdevice_queue()` on already-freed devices (kernel BUG at net/core/dev.c:12376), enabling memory corruption exploitable for control-flow hijacking.\nA:H - The published reproducer reliably triggers a kernel BUG during namespace cleanup, causing host-wide denial of service via kernel panic/oops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:11.588Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0cdce7618464f7fb06f461e8f4ad575cb1d570f4"
},
{
"url": "https://git.kernel.org/stable/c/f5c68875e25f331e497ddfbe81e2d8163a87f136"
},
{
"url": "https://git.kernel.org/stable/c/d9c5eecdb3c740e65038651db7c686b10d76d1bc"
},
{
"url": "https://git.kernel.org/stable/c/f1e89a943ee574d0f2f16246eb3f2d7330fdeb03"
},
{
"url": "https://git.kernel.org/stable/c/225b467e3b631f38be22e4b38062a1fed02fdd21"
},
{
"url": "https://git.kernel.org/stable/c/fc32be9ac2788524c6b24efd681cce7a6e731a92"
},
{
"url": "https://git.kernel.org/stable/c/ee1778ba0f5cb53be771f97017d01eb356c797bf"
},
{
"url": "https://git.kernel.org/stable/c/11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe"
}
],
"title": "ip6: vti: Use ip6_tnl.net in vti6_changelink().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63917",
"datePublished": "2026-07-19T14:55:20.703Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-10-19T20:17:55.945Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74705 (GCVE-0-2026-74705)
Vulnerability from cvelistv5
Published
2026-08-22 15:33
Modified
2026-10-16 19:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
udp: fix potential use-after-free in tunnel segmentation
__skb_udp_tunnel_segment() gets the UDP header before ensuring the
tunnel header is in the skb head. If the pull reallocates skb->head,
the saved UDP header pointer is no longer valid.
Get the UDP header after the pull to avoid a potential use-after-free.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 Version: dbef491ebe7f3a4fb1b9111878b86a426fd540b7 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74705",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:15:04.524382Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:10.609Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp_offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6a733a38b983d8c2e222f13968209010cf44de87",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "19d89b13a43640b2da2f277ee462d919d988cb6f",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "b3df61bb745eb5201eac22679a2839d4ccbf3442",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "1ae134c012e10384cdac420b5cc6e0615cde0b55",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "5161e67c561c4f28a5d9335a6e859b02511de92b",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "64d322c288577793eedd352b96ef75234ed380fe",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "588d4a6795d99d080f74ef0b5f391ea8c453ae5d",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
},
{
"lessThan": "d0f86fb36eb260abd10007b62c9dcc1028e03e61",
"status": "affected",
"version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/udp_offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: fix potential use-after-free in tunnel segmentation\n\n__skb_udp_tunnel_segment() gets the UDP header before ensuring the\ntunnel header is in the skb head. If the pull reallocates skb-\u003ehead,\nthe saved UDP header pointer is no longer valid.\n\nGet the UDP header after the pull to avoid a potential use-after-free."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Remote peers reach __skb_udp_tunnel_segment on egress when GRO-coalesced VXLAN/Geneve/FOU GSO superpackets are forwarded or re-encapsulated through dev_queue_xmit, and malicious virtio-net/cloud tenants can inject VIRTIO_NET_HDR_GSO_UDP_TUNNEL frames the host later segments on physical or overlay NICs.\nAC:L - Triggering is deterministic once a GSO UDP-tunnel skb has tunnel headers beyond skb_headlen so pskb_may_pull reallocates skb-\u003ehead; attackers control that layout via fragmented or GRO-built outer/encap headers and can repeat crafted sends until segmentation dereferences the stale UDP pointer.\nPR:N - No host authentication or credentials are required to send UDP tunnel traffic to listening overlay ports on cloud/DC nodes, and co-resident virtio-net guests or tenant VMs can emit GSO UDP-tunnel frames into the host datapath without CAP_NET_ADMIN on the victim host.\nUI:N - Exploitation needs only crafted encapsulated GSO traffic into an already-running overlay, bridge, IPVS, OVS, or virtio forwarding path; no victim file open, mount, link click, or other interactive action beyond normal network or VM I/O.\nS:C - In cloud/Kubernetes and virtio-net multitenant deployments, remote or guest/tenant senders can corrupt hypervisor kernel heap during host-side UDP-tunnel GSO segmentation on egress, crossing the VM/container-to-host security boundary rather than staying within the attacker\u0027s own namespace.\nC:H - After pskb_may_pull reallocates skb-\u003ehead, the pre-pull udp_hdr pointer is stale yet uh-\u003elen and uh-\u003echeck are read for checksum adjustment, yielding a classic heap use-after-free read primitive that can disclose kernel memory and support further exploitation.\nI:H - UAF on the UDP header allows attacker-influenced heap reuse and corruption of header fields and checksum state during tunnel GSO segmentation, providing a write/control primitive suitable for kernel code execution rather than a benign checksum miscalculation.\nA:H - Dereferencing the freed UDP header during GSO segmentation can immediately oops or panic the kernel, and repeated exploitation attempts against this UAF commonly crash or hang the host even when full control is not achieved."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:48.767Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87"
},
{
"url": "https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f"
},
{
"url": "https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442"
},
{
"url": "https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55"
},
{
"url": "https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b"
},
{
"url": "https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe"
},
{
"url": "https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d"
},
{
"url": "https://git.kernel.org/stable/c/d0f86fb36eb260abd10007b62c9dcc1028e03e61"
}
],
"title": "udp: fix potential use-after-free in tunnel segmentation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74705",
"datePublished": "2026-08-22T15:33:04.110Z",
"dateReserved": "2026-08-15T05:44:03.927Z",
"dateUpdated": "2026-10-16T19:16:10.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74574 (GCVE-0-2026-74574)
Vulnerability from cvelistv5
Published
2026-08-15 12:28
Modified
2026-10-16 19:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
The failed_dev_add and failed_dev_name paths drop the file-device
reference while wq->wq_lock is still held. If put_device(fdev) drops the
last reference, idxd_file_dev_release() runs synchronously and tries to
take wq->wq_lock again, deadlocking.
Those paths also fall through into the later ctx cleanup labels even
though idxd_file_dev_release() owns that cleanup and frees ctx. This can
make idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context.
Move idxd_wq_get() before file-device setup can fail, since the release
callback always calls idxd_wq_put(). Then unlock wq->wq_lock before
put_device(fdev) and return directly from the file-device setup failure
path, leaving ctx cleanup to the release callback.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:00:43.194808Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:05:57.115Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/cdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "778ccbded2c8749c5be7f0dfa04fc9977a36fb7e",
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"versionType": "git"
},
{
"lessThan": "8d5d28285728be47c82fdf1c48be4268293c90e7",
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"versionType": "git"
},
{
"lessThan": "0679c0c189d2548f00e1bac95be28e2df5c6c7f7",
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"versionType": "git"
},
{
"lessThan": "6e26a41c4c1a706edaaa7c7dffc6b3b945707a55",
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"versionType": "git"
},
{
"lessThan": "ee1d7274102285d78a53161fc705a8d8cd40b066",
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/cdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.151",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()\n\nThe failed_dev_add and failed_dev_name paths drop the file-device\nreference while wq-\u003ewq_lock is still held. If put_device(fdev) drops the\nlast reference, idxd_file_dev_release() runs synchronously and tries to\ntake wq-\u003ewq_lock again, deadlocking.\n\nThose paths also fall through into the later ctx cleanup labels even\nthough idxd_file_dev_release() owns that cleanup and frees ctx. This can\nmake idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context.\n\nMove idxd_wq_get() before file-device setup can fail, since the release\ncallback always calls idxd_wq_put(). Then unlock wq-\u003ewq_lock before\nput_device(fdev) and return directly from the file-device setup failure\npath, leaving ctx cleanup to the release callback."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached only through the local open() syscall on an Intel DSA/IDXD user workqueue character device (/dev/dsa/wq* or /dev/iax/wq*); idxd_cdev_open() is the cdev .open handler and is not reachable from any network-facing kernel service.\nAC:L - An attacker who can open the cdev can reliably hit the failed_dev_name/failed_dev_add cleanup by inducing GFP_KERNEL allocation failures (e.g., memory pressure) during device setup; no race or victim-controlled state beyond that is required.\nPR:L - Exploitation requires only local permission to open the configured user-type DSA workqueue cdev, which on DSA-equipped servers is commonly granted to unprivileged workload/service accounts via udev group ACLs after one-time admin WQ setup, not init-namespace root.\nUI:N - The attacker triggers the bug by opening the character device themselves; no additional end-user or administrator interaction is required at exploitation time beyond prior WQ enablement.\nS:U - The deadlock, use-after-free, and double-free corrupt kernel/IDXD driver heap state and block the affected workqueue; impact does not cross VM, IOMMU/DMA, or other security boundaries into a separate authority.\nC:H - On the error path put_device() synchronously runs idxd_file_dev_release(), which kfree()s ctx while idxd_cdev_open() still references it via filp-\u003eprivate_data, and the fall-through path can call idxd_xa_pasid_remove()/kfree() again\u2014classic kernel heap UAF enabling memory disclosure.\nI:H - Double-free and use-after-free of the kmalloc-backed idxd_user_context can corrupt slab metadata and be developed into arbitrary kernel memory writes and privilege escalation, not merely a controlled error return.\nA:H - Calling put_device() while holding wq-\u003ewq_lock deadlocks when idxd_file_dev_release() re-acquires that mutex, hanging the opener and blocking all other users of the workqueue; heap corruption can additionally panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T05:48:53.873Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/778ccbded2c8749c5be7f0dfa04fc9977a36fb7e"
},
{
"url": "https://git.kernel.org/stable/c/8d5d28285728be47c82fdf1c48be4268293c90e7"
},
{
"url": "https://git.kernel.org/stable/c/0679c0c189d2548f00e1bac95be28e2df5c6c7f7"
},
{
"url": "https://git.kernel.org/stable/c/6e26a41c4c1a706edaaa7c7dffc6b3b945707a55"
},
{
"url": "https://git.kernel.org/stable/c/ee1d7274102285d78a53161fc705a8d8cd40b066"
}
],
"title": "dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74574",
"datePublished": "2026-08-15T12:28:12.558Z",
"dateReserved": "2026-08-15T05:44:03.917Z",
"dateUpdated": "2026-10-16T19:05:57.115Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45859 (GCVE-0-2026-45859)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-10-21 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation
Ulrich reports a regression with nfqueue:
If an application did not set the 'F_GSO' capability flag and a gso
packet with an unconfirmed nf_conn entry is received all packets are
now dropped instead of queued, because the check happens after
skb_gso_segment(). In that case, we did have exclusive ownership
of the skb and its associated conntrack entry. The elevated use
count is due to skb_clone happening via skb_gso_segment().
Move the check so that its peformed vs. the aggregated packet.
Then, annotate the individual segments except the first one so we
can do a 2nd check at reinject time.
For the normal case, where userspace does in-order reinjects, this avoids
packet drops: first reinjected segment continues traversal and confirms
entry, remaining segments observe the confirmed entry.
While at it, simplify nf_ct_drop_unconfirmed(): We only care about
unconfirmed entries with a refcnt > 1, there is no need to special-case
dying entries.
This only happens with UDP. With TCP, the only unconfirmed packet will
be the TCP SYN, those aren't aggregated by GRO.
Next patch adds a udpgro test case to cover this scenario.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 74e6eb7fd27ef1ccc68041dbc66e6d80d2e4a1a0 Version: 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb Version: 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb Version: 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb Version: 7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb Version: 6c4a0ba674f410ab99a30a16f32dac0ebfed5cd3 Version: 6dcc8ba8a6074bb79040f502dc66ad23a58a1c86 Version: 025b3326c5c409b372d0103ad30f174e55adbd1b Version: 6.6.48 ≤ Version: 5.15.166 ≤ Version: 6.1.107 ≤ Version: 6.10.7 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45859",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:18:05.838159Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:26:38.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_queue.h",
"net/netfilter/nfnetlink_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aead84bdacd77e08357fd718e5dcaffaf387f3c3",
"status": "affected",
"version": "74e6eb7fd27ef1ccc68041dbc66e6d80d2e4a1a0",
"versionType": "git"
},
{
"lessThan": "79b713ef4261a8ead96af4703f89d0b5f25532e2",
"status": "affected",
"version": "7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb",
"versionType": "git"
},
{
"lessThan": "23901aa6b8a2f294c4b774436b4691f3ff863a8f",
"status": "affected",
"version": "7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb",
"versionType": "git"
},
{
"lessThan": "b740e7ddd7ca0dbfeafca3f5e52717206cf28524",
"status": "affected",
"version": "7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb",
"versionType": "git"
},
{
"lessThan": "207b3ebacb6113acaaec0d171d5307032c690004",
"status": "affected",
"version": "7d8dc1c7be8d3509e8f5164dd5df64c8e34d7eeb",
"versionType": "git"
},
{
"status": "affected",
"version": "6c4a0ba674f410ab99a30a16f32dac0ebfed5cd3",
"versionType": "git"
},
{
"status": "affected",
"version": "6dcc8ba8a6074bb79040f502dc66ad23a58a1c86",
"versionType": "git"
},
{
"status": "affected",
"version": "025b3326c5c409b372d0103ad30f174e55adbd1b",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.48",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.166",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.107",
"versionType": "semver"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_queue.h",
"net/netfilter/nfnetlink_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.107",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation\n\nUlrich reports a regression with nfqueue:\n\nIf an application did not set the \u0027F_GSO\u0027 capability flag and a gso\npacket with an unconfirmed nf_conn entry is received all packets are\nnow dropped instead of queued, because the check happens after\nskb_gso_segment(). In that case, we did have exclusive ownership\nof the skb and its associated conntrack entry. The elevated use\ncount is due to skb_clone happening via skb_gso_segment().\n\nMove the check so that its peformed vs. the aggregated packet.\n\nThen, annotate the individual segments except the first one so we\ncan do a 2nd check at reinject time.\n\nFor the normal case, where userspace does in-order reinjects, this avoids\npacket drops: first reinjected segment continues traversal and confirms\nentry, remaining segments observe the confirmed entry.\n\nWhile at it, simplify nf_ct_drop_unconfirmed(): We only care about\nunconfirmed entries with a refcnt \u003e 1, there is no need to special-case\ndying entries.\n\nThis only happens with UDP. With TCP, the only unconfirmed packet will\nbe the TCP SYN, those aren\u0027t aggregated by GRO.\n\nNext patch adds a udpgro test case to cover this scenario."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable nfnetlink_queue path processes packets that hit an NFQUEUE netfilter verdict; GRO-aggregated UDP traffic received from the network reaches it, so the dropping condition is triggered by remote network packets.\nAC:L - Once an nfqueue without F_GSO exists, an attacker reliably triggers the drop by sending a UDP burst that GRO coalesces into a GSO skb for a new (unconfirmed) flow; no uncontrollable condition is required.\nPR:N - Triggering the condition requires only sending network traffic to the host; no authentication or privileges are needed by the remote sender.\nUI:N - The packet drop occurs automatically during kernel packet processing with no victim interaction.\nS:U - The impact is confined to the kernel\u0027s own network packet processing; no security boundary is crossed.\nC:N - The bug only causes packets to be dropped; no kernel memory is read or disclosed.\nI:N - No data is modified or written; dropped packets are simply not delivered, which is an availability rather than integrity effect.\nA:H - All GSO-aggregated UDP packets of new (unconfirmed) conntrack flows are dropped on a non-F_GSO nfqueue, denying establishment/processing of those new flows \u2014 a sustained, network-triggerable denial of that traffic class."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:40:52.386Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aead84bdacd77e08357fd718e5dcaffaf387f3c3"
},
{
"url": "https://git.kernel.org/stable/c/79b713ef4261a8ead96af4703f89d0b5f25532e2"
},
{
"url": "https://git.kernel.org/stable/c/23901aa6b8a2f294c4b774436b4691f3ff863a8f"
},
{
"url": "https://git.kernel.org/stable/c/b740e7ddd7ca0dbfeafca3f5e52717206cf28524"
},
{
"url": "https://git.kernel.org/stable/c/207b3ebacb6113acaaec0d171d5307032c690004"
}
],
"title": "netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45859",
"datePublished": "2026-05-27T12:15:39.322Z",
"dateReserved": "2026-05-13T15:03:33.079Z",
"dateUpdated": "2026-10-21T12:40:52.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89811 (GCVE-0-2026-89811)
Vulnerability from cvelistv5
Published
2026-09-16 10:30
Modified
2026-10-21 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Add TLB flush after MES queue eviction/suspension
MES (Micro Engine Scheduler) does not perform heavy-weight TLB
invalidation after unmapping queues, unlike HWS which does this
automatically. This causes a race condition where in-flight DMA
descriptors can access memory that has been unmapped, leading to page
faults and GPU queue hangs during SVM page migration.
The issue manifests as KFDSVMRangeTest.MultiThreadMigrationTest
failures on gfx1151 (Strix Point) with XNACK mode 1 enabled - the GPU
compute queue hangs with packets submitted but never consumed.
Add kfd_flush_tlb() calls after MES queue removal in two locations:
- evict_process_queues_cpsch(): after all queues removed during eviction
- suspend_queues(): after debug/criu queue suspension (with mem_fence barrier)
This ensures all in-flight memory accesses from unmapped queues are
flushed before memory is freed or migrated.
(cherry picked from commit f5c4f88e0f9c45a8fb9dfac0c1df726c95e41b77)
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5bbd7f283312d0209a0fedcc9d2d33b5afa5a7b1",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "bbf5ad5268f36d7ebb7e99ae78fc73cffe98d372",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "e230c546ed93741833ab5babb0b202f9c2052b45",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "6aae545c87087e4dc96e205452243813bfa73ba2",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Add TLB flush after MES queue eviction/suspension\n\nMES (Micro Engine Scheduler) does not perform heavy-weight TLB\ninvalidation after unmapping queues, unlike HWS which does this\nautomatically. This causes a race condition where in-flight DMA\ndescriptors can access memory that has been unmapped, leading to page\nfaults and GPU queue hangs during SVM page migration.\n\nThe issue manifests as KFDSVMRangeTest.MultiThreadMigrationTest\nfailures on gfx1151 (Strix Point) with XNACK mode 1 enabled - the GPU\ncompute queue hangs with packets submitted but never consumed.\n\nAdd kfd_flush_tlb() calls after MES queue removal in two locations:\n- evict_process_queues_cpsch(): after all queues removed during eviction\n- suspend_queues(): after debug/criu queue suspension (with mem_fence barrier)\n\nThis ensures all in-flight memory accesses from unmapped queues are\nflushed before memory is freed or migrated.\n\n(cherry picked from commit f5c4f88e0f9c45a8fb9dfac0c1df726c95e41b77)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local /dev/kfd paths: AMDKFD_IOC_CREATE_QUEUE plus SVM/userptr activity (AMDKFD_IOC_SVM, munmap of USERPTR BOs) or KFD_IOC_DBG_TRAP_SUSPEND_QUEUES, which call evict_process_queues_cpsch()/suspend_queues(); there is no network, adjacent-wireless, or physical-device path.\nAC:L - The attacker controls both sides of the race: they keep DMA in flight on their own MES compute/SDMA queues while concurrently forcing eviction or suspend via SVM migration, userptr MMU notifiers, TTM pressure, or self-debug suspend, matching the MultiThreadMigrationTest trigger with no victim timing or uncontrollable layout required.\nPR:L - kfd_open() and the CREATE_QUEUE/SVM/DBG_TRAP ioctls perform no capability checks; a local unprivileged user with typical render/video-group access to /dev/kfd and /dev/dri/renderD* on desktops, ROCm nodes, and multi-tenant AMD GPU clouds is sufficient, not init-namespace root.\nUI:N - The attacker opens their own KFD and DRM render-node descriptors, submits compute work, and triggers queue eviction or suspend in that same process; no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:C - MES queue removal omits the heavyweight PASID TLB invalidation HWS performs, so in-flight GPU DMA can use stale GPUVM translations to physical pages after they are unmapped, freed, or migrated, bypassing the GPUVM/PASID DMA isolation boundary that is supposed to confine GPU access.\nC:H - In-flight GPU DMA through stale GPUVM TLB entries can read physical pages after they leave the process mapping and are recycled to the page allocator, kernel, or another process, giving an arbitrary memory-disclosure primitive.\nI:H - The same stale translations allow GPU DMA writes into those recycled physical pages, enabling arbitrary memory corruption and control-flow hijacking through a device DMA write primitive.\nA:H - The issue is documented to cause GPU page faults and compute-queue hangs (packets submitted but never consumed), which can stall the shared GPU and force amdgpu reset, denying compute service to all co-located workloads."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:48:51.404Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5bbd7f283312d0209a0fedcc9d2d33b5afa5a7b1"
},
{
"url": "https://git.kernel.org/stable/c/bbf5ad5268f36d7ebb7e99ae78fc73cffe98d372"
},
{
"url": "https://git.kernel.org/stable/c/e230c546ed93741833ab5babb0b202f9c2052b45"
},
{
"url": "https://git.kernel.org/stable/c/6aae545c87087e4dc96e205452243813bfa73ba2"
},
{
"url": "https://git.kernel.org/stable/c/94e25cb6ab7f4f025bcdcd8ea79fda30f12843a4"
}
],
"title": "drm/amdkfd: Add TLB flush after MES queue eviction/suspension",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89811",
"datePublished": "2026-09-16T10:30:44.274Z",
"dateReserved": "2026-09-11T19:38:34.768Z",
"dateUpdated": "2026-10-21T12:48:51.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63921 (GCVE-0-2026-63921)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-10-19 20:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
After patch 1/2 in this series, vti6_update() unlinks and relinks
the tunnel through t->net. vti6_siocdevprivate() still uses
dev_net(dev) for the collision lookup. For a tunnel moved through
IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net.
SIOCCHGTUNNEL on a migrated tunnel then runs:
net = dev_net(dev) /* migrated netns */
t = vti6_locate(net, &p1, false) /* misses target in t->net */
...
t = netdev_priv(dev)
vti6_update(t, &p1, false) /* mutates t->net's hash */
A caller in the migrated netns picks params that match a tunnel
in the creation netns. The lookup in dev_net(dev) finds nothing.
vti6_update() prepends the migrated tunnel at the head of the
creation netns hash bucket for those params. Later lookups in
the creation netns resolve to the migrated device. xfrm receive
delivers the matched packets through a device the caller controls.
Reachable from an unprivileged user namespace (unshare --user
--map-root-user --net). Cross tenant scope on container hosts.
Switch the SIOCCHGTUNNEL path on a non fallback device to use
t->net for the lookup. The lookup now matches the netns
vti6_update() operates on.
Also add ns_capable(self->net->user_ns, CAP_NET_ADMIN) before
the lookup. The check at the top of the case is against
dev_net(dev)->user_ns, which after migration is the attacker's
netns. A caller there can pick params absent from self->net,
the lookup returns NULL, t becomes self, and vti6_update()
inserts the device into the creation netns hash. The new check
requires CAP_NET_ADMIN in the creation netns user_ns too.
SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep
dev_net(dev), which equals init_net there.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63921",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:33:25.874966Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:17:56.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94ff740a7f9ef5c010784a325dca00cbf228f941",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "df42ac708acc3399bbb6dc5ca16e0540adda7bbf",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "44d2ff7d2178503b93151140a45dfa2ad49c9906",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "1acfb7d9c6fc7e209ed7789392697e97e03edd33",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "d2236348414bdd6558385f35aa7fdc9bf5634011",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "853f6ea482dfcd3404bbef458ab4d68364eed838",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "596f6354c96a891e58c04a09cbfb7b0d1ec00dab",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "8b484efd5cb4eeef9021a661e198edc5349dacf6",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().\n\nAfter patch 1/2 in this series, vti6_update() unlinks and relinks\nthe tunnel through t-\u003enet. vti6_siocdevprivate() still uses\ndev_net(dev) for the collision lookup. For a tunnel moved through\nIFLA_NET_NS_FD, dev_net(dev) is the new netns, not t-\u003enet.\n\nSIOCCHGTUNNEL on a migrated tunnel then runs:\n\n net = dev_net(dev) /* migrated netns */\n t = vti6_locate(net, \u0026p1, false) /* misses target in t-\u003enet */\n ...\n t = netdev_priv(dev)\n vti6_update(t, \u0026p1, false) /* mutates t-\u003enet\u0027s hash */\n\nA caller in the migrated netns picks params that match a tunnel\nin the creation netns. The lookup in dev_net(dev) finds nothing.\nvti6_update() prepends the migrated tunnel at the head of the\ncreation netns hash bucket for those params. Later lookups in\nthe creation netns resolve to the migrated device. xfrm receive\ndelivers the matched packets through a device the caller controls.\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net). Cross tenant scope on container hosts.\n\nSwitch the SIOCCHGTUNNEL path on a non fallback device to use\nt-\u003enet for the lookup. The lookup now matches the netns\nvti6_update() operates on.\n\nAlso add ns_capable(self-\u003enet-\u003euser_ns, CAP_NET_ADMIN) before\nthe lookup. The check at the top of the case is against\ndev_net(dev)-\u003euser_ns, which after migration is the attacker\u0027s\nnetns. A caller there can pick params absent from self-\u003enet,\nthe lookup returns NULL, t becomes self, and vti6_update()\ninserts the device into the creation netns hash. The new check\nrequires CAP_NET_ADMIN in the creation netns user_ns too.\n\nSIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep\ndev_net(dev), which equals init_net there."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires a local ioctl(SIOCCHGTUNNEL) on a migrated vti6 netdev via socket/dev_ioctl; the bug is in vti6_siocdevprivate(), not in remote packet reception.\nAC:L - The attacker fully controls namespace creation, tunnel migration (IFLA_NET_NS_FD), and ioctl parameters to collide with a victim tunnel; the commit documents a deterministic, reproducible sequence with no uncontrollable race.\nPR:L - Only CAP_NET_ADMIN in the migrated (attacker) network namespace is required, obtainable via unprivileged user namespaces (unshare --user --map-root-user --net); the missing check against the creation namespace\u0027s user_ns is the core flaw.\nUI:N - No victim interaction is needed; the attacker performs all setup steps (create/migrate tunnel, issue SIOCCHGTUNNEL) autonomously.\nS:C - The attack hijacks IPsec/XFRM traffic destined for tunnels in a different tenant\u0027s network namespace on container hosts, crossing container/tenant security boundaries rather than staying within the attacker\u0027s own scope.\nC:H - After hash poisoning, xfrm receive delivers matched/decapsulated packets to the attacker-controlled netdev, enabling interception of victim VPN/IPsec traffic including potentially sensitive plaintext after decryption.\nI:H - The attacker gains control over which netdev receives victim tunnel traffic and can read, drop, or forward/modify decapsulated packets, constituting unauthorized manipulation of another tenant\u0027s network data path.\nA:H - Hijacking the creation-namespace hash bucket causes the legitimate victim tunnel to stop receiving matched traffic, producing denial of service to the victim\u0027s IPsec connectivity."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:15.900Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94ff740a7f9ef5c010784a325dca00cbf228f941"
},
{
"url": "https://git.kernel.org/stable/c/df42ac708acc3399bbb6dc5ca16e0540adda7bbf"
},
{
"url": "https://git.kernel.org/stable/c/44d2ff7d2178503b93151140a45dfa2ad49c9906"
},
{
"url": "https://git.kernel.org/stable/c/1acfb7d9c6fc7e209ed7789392697e97e03edd33"
},
{
"url": "https://git.kernel.org/stable/c/d2236348414bdd6558385f35aa7fdc9bf5634011"
},
{
"url": "https://git.kernel.org/stable/c/853f6ea482dfcd3404bbef458ab4d68364eed838"
},
{
"url": "https://git.kernel.org/stable/c/596f6354c96a891e58c04a09cbfb7b0d1ec00dab"
},
{
"url": "https://git.kernel.org/stable/c/8b484efd5cb4eeef9021a661e198edc5349dacf6"
}
],
"title": "ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63921",
"datePublished": "2026-07-19T14:55:23.539Z",
"dateReserved": "2026-07-19T07:54:57.020Z",
"dateUpdated": "2026-10-19T20:17:56.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68278 (GCVE-0-2026-68278)
Vulnerability from cvelistv5
Published
2026-08-10 12:01
Modified
2026-08-23 12:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/dp/mst: fix buffer overflows in sideband chunk accumulation
drm_dp_sideband_append_payload() has three related bugs when processing
device-provided sideband reply data:
1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken
directly from the DP sideband header. If a device sends msg_len=0,
curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len)
is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).
drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()
writes 255 bytes into msg[], both far out of bounds.
2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is
only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks
until curchunk_idx reaches curchunk_len, writing up to 15 bytes past
the end of chunk[] into msg[].
3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to
msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256],
so the memcpy can spill into adjacent struct fields.
All three are reachable from any DP MST device that can forge sideband
reply messages on a physical connection.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd Version: ad7f8a1f9ced7f049f9b66d588723f243a7034cd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/display/drm_dp_mst_topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ef2ecb6cf268debf3890df99fea01b6452dcf78e",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "d4e05dedb252ed3e540a0c9be511e427f098110a",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "4d5109075a787de28c9e89940f9dee45269f91fa",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "53937a2787d29c7a460e984dc4f20ff6ac91dc65",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "ef0dbcc200c3389f1f781ab181932a97e54b51af",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "1e5827839ad0ceb0079d1560c321fa3656b54f21",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "a6366b551079c79bf7bdbadd74c97358bcfe2d58",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
},
{
"lessThan": "55bd5e685bda455b9b50c835f8c8442d52a344a3",
"status": "affected",
"version": "ad7f8a1f9ced7f049f9b66d588723f243a7034cd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/display/drm_dp_mst_topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/dp/mst: fix buffer overflows in sideband chunk accumulation\n\ndrm_dp_sideband_append_payload() has three related bugs when processing\ndevice-provided sideband reply data:\n\n1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken\n directly from the DP sideband header. If a device sends msg_len=0,\n curchunk_len is set to zero. The condition (curchunk_idx \u003e= curchunk_len)\n is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow).\n drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy()\n writes 255 bytes into msg[], both far out of bounds.\n\n2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is\n only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks\n until curchunk_idx reaches curchunk_len, writing up to 15 bytes past\n the end of chunk[] into msg[].\n\n3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to\n msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256],\n so the memcpy can spill into adjacent struct fields.\n\nAll three are reachable from any DP MST device that can forge sideband\nreply messages on a physical connection."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:46:15.450Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ef2ecb6cf268debf3890df99fea01b6452dcf78e"
},
{
"url": "https://git.kernel.org/stable/c/d4e05dedb252ed3e540a0c9be511e427f098110a"
},
{
"url": "https://git.kernel.org/stable/c/4d5109075a787de28c9e89940f9dee45269f91fa"
},
{
"url": "https://git.kernel.org/stable/c/53937a2787d29c7a460e984dc4f20ff6ac91dc65"
},
{
"url": "https://git.kernel.org/stable/c/ef0dbcc200c3389f1f781ab181932a97e54b51af"
},
{
"url": "https://git.kernel.org/stable/c/1e5827839ad0ceb0079d1560c321fa3656b54f21"
},
{
"url": "https://git.kernel.org/stable/c/a6366b551079c79bf7bdbadd74c97358bcfe2d58"
},
{
"url": "https://git.kernel.org/stable/c/55bd5e685bda455b9b50c835f8c8442d52a344a3"
}
],
"title": "drm/dp/mst: fix buffer overflows in sideband chunk accumulation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68278",
"datePublished": "2026-08-10T12:01:54.285Z",
"dateReserved": "2026-07-30T09:28:09.379Z",
"dateUpdated": "2026-08-23T12:46:15.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93207 (GCVE-0-2026-93207)
Vulnerability from cvelistv5
Published
2026-09-24 15:10
Modified
2026-10-19 09:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
svcauth_gss_decode_credbody() writes the caller's
rpc_gss_wire_cred field by field and assigns gc_ctx.len only on
the success tail. The caller storage is svcdata->clcred, which
lives in the per-svc_rqst gss_svc_data and is reused across
requests. Early decode failures leave partially decoded state
mixed with residue from the prior request.
The trailing body_len tightness check is the sharpest case:
xdr_stream_decode_opaque_inline() has already written gc_ctx.data
with a borrowed inline pointer into the current request's XDR
pages, but gc_ctx.len retains its prior value. Once the request
pages are released the pooled clcred carries a dangling pointer
paired with a stale length.
Zero the caller's rpc_gss_wire_cred at function entry so that
every early-return path leaves a deterministic all-zero cred.
On the trailing tightness-check path, gc_ctx.len is now zero
instead of stale, which neuters length-driven consumers such as
gss_svc_searchbyctx() that would otherwise walk the dangling
data pointer.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/auth_gss/svcauth_gss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "56b29d62017c7dd1718d060dd5b3a2ce61095d0c",
"status": "affected",
"version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
"versionType": "git"
},
{
"lessThan": "0e18641708eaa8bc3c1ff338cd844aeadbd52bac",
"status": "affected",
"version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
"versionType": "git"
},
{
"lessThan": "e0778464049b0238f2915a40007a4154f86cf351",
"status": "affected",
"version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
"versionType": "git"
},
{
"lessThan": "0fa8a8acae57e6373962741d5b06d13f44aba6a9",
"status": "affected",
"version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
"versionType": "git"
},
{
"lessThan": "11539e8fcce0b0af062ae5fecf7b3676c2f7aeed",
"status": "affected",
"version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/auth_gss/svcauth_gss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\n\nsvcauth_gss_decode_credbody() writes the caller\u0027s\nrpc_gss_wire_cred field by field and assigns gc_ctx.len only on\nthe success tail. The caller storage is svcdata-\u003eclcred, which\nlives in the per-svc_rqst gss_svc_data and is reused across\nrequests. Early decode failures leave partially decoded state\nmixed with residue from the prior request.\n\nThe trailing body_len tightness check is the sharpest case:\nxdr_stream_decode_opaque_inline() has already written gc_ctx.data\nwith a borrowed inline pointer into the current request\u0027s XDR\npages, but gc_ctx.len retains its prior value. Once the request\npages are released the pooled clcred carries a dangling pointer\npaired with a stale length.\n\nZero the caller\u0027s rpc_gss_wire_cred at function entry so that\nevery early-return path leaves a deterministic all-zero cred.\nOn the trailing tightness-check path, gc_ctx.len is now zero\ninstead of stale, which neuters length-driven consumers such as\ngss_svc_searchbyctx() that would otherwise walk the dangling\ndata pointer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote NFS/SUNRPC peer sends an RPC Call with flavor RPC_AUTH_GSS whose rpc_gss_cred_t fails the body_len tightness check in svcauth_gss_decode_credbody(); those cred bytes arrive on nfsd TCP/UDP 2049 via svc_recv \u2192 svc_tcp_recvfrom/svc_udp_recvfrom \u2192 svc_process \u2192 svc_process_common \u2192 svc_authenticate \u2192 svcauth_gss_accept.\nAC:L - The attacker first sends a well-formed RPCSEC_GSS cred so decode assigns gc_ctx.len, then a second Call where xdr_stream_decode_opaque_inline() succeeds but body_len != XDR_UNIT*5+xdr_align_size(handle_len). Both hit the same nfsd thread\u0027s reused gss_svc_data.clcred; the tightness failure is deterministic with no race.\nPR:N - svcauth_gss_decode_credbody() is the RPC_AUTH_GSS credential decoder inside svcauth_gss_accept(), reached before gss_svc_searchbyctx(), gss_verify_mic(), or nfsd export/client checks. Flavor 6 with auth_rpcgss registered (RPCSEC_GSS_KRB5 defaults y) needs no Kerberos ticket, uid, or capability.\nUI:N - nfsd processes each inbound RPC in the service thread via svc_process with no local user or administrator action; the attacker alone sends the residue-planting Call and the tightness-fail Call.\nS:U - The dangling gc_ctx pointer, consume_skb() of the UDP receive skb, and any later kmemdup of that pointer occur in the host nfsd/SUNRPC kernel. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - On tightness failure, xdr_stream_decode_opaque_inline() writes gc_ctx.data into the UDP in-place skb (svc_udp_recvfrom) while gc_ctx.len stays the prior handle length. svc_udp_release_ctxt() consume_skb() then frees that skb; gss_svc_searchbyctx()\u2192dup_to_netobj() kmemdups handle-\u003elen bytes from the dangling pointer, a UAF read of reclaimed kernel memory.\nI:H - The leftover clcred.gc_ctx is a use-after-free of skb-backed memory with an attacker-chosen stale length planted by the prior GSS handle. Spraying the consumed skb lets length-driven consumers of that netobj treat attacker bytes as kernel objects, so integrity impact is High as for other kernel UAFs.\nA:H - Walking gc_ctx.data after consume_skb() oopses the nfsd thread when the skb is reused or unmapped, and the attacker can repeat tightness-fail Calls to kill service threads or panic the host where panic_on_oops is set."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:07:19.480Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/56b29d62017c7dd1718d060dd5b3a2ce61095d0c"
},
{
"url": "https://git.kernel.org/stable/c/0e18641708eaa8bc3c1ff338cd844aeadbd52bac"
},
{
"url": "https://git.kernel.org/stable/c/e0778464049b0238f2915a40007a4154f86cf351"
},
{
"url": "https://git.kernel.org/stable/c/0fa8a8acae57e6373962741d5b06d13f44aba6a9"
},
{
"url": "https://git.kernel.org/stable/c/11539e8fcce0b0af062ae5fecf7b3676c2f7aeed"
}
],
"title": "SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93207",
"datePublished": "2026-09-24T15:10:30.942Z",
"dateReserved": "2026-09-17T16:02:15.093Z",
"dateUpdated": "2026-10-19T09:07:19.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…