{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hfi1/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cfad037c6d305876b877abc39fd4d7e2185e44f3",
              "status": "affected",
              "version": "4730f4a6c6b2065589c0822af00aa45e639bbc36",
              "versionType": "git"
            },
            {
              "lessThan": "d1c91cb02e05fdd93411de707cc5c3c08375df9e",
              "status": "affected",
              "version": "4730f4a6c6b2065589c0822af00aa45e639bbc36",
              "versionType": "git"
            },
            {
              "lessThan": "10e5e37495096b58f07adc4020de2701efc3a9e0",
              "status": "affected",
              "version": "4730f4a6c6b2065589c0822af00aa45e639bbc36",
              "versionType": "git"
            },
            {
              "lessThan": "cd06c17afb08b37995f66cf560c2332a769b8f80",
              "status": "affected",
              "version": "4730f4a6c6b2065589c0822af00aa45e639bbc36",
              "versionType": "git"
            },
            {
              "lessThan": "149a14ec70887ad14e820a7ca15738ded3d2d493",
              "status": "affected",
              "version": "4730f4a6c6b2065589c0822af00aa45e639bbc36",
              "versionType": "git"
            },
            {
              "lessThan": "83fe4e4f4fbf01d3832a24511c0ddfaccf5df9d8",
              "status": "affected",
              "version": "4730f4a6c6b2065589c0822af00aa45e639bbc36",
              "versionType": "git"
            },
            {
              "lessThan": "8e17e101e04a3dc062e2719da57ff78c1c060632",
              "status": "affected",
              "version": "4730f4a6c6b2065589c0822af00aa45e639bbc36",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hfi1/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hfi1: Free RX data on late probe failure\n\nhfi1_init_dd() allocates the shared AIP/VNIC RX support before returning.\nIf hfi1_init() or hfi1_register_ib_device() later fails, init_one() tears\ndown the device data without calling hfi1_free_rx(). This leaks netdev_rx\nand its dummy netdev.\n\nFree the RX support after IB unregistration and before postinit_cleanup(),\nas done on normal device removal."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:05:35.200Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cfad037c6d305876b877abc39fd4d7e2185e44f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1c91cb02e05fdd93411de707cc5c3c08375df9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/10e5e37495096b58f07adc4020de2701efc3a9e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd06c17afb08b37995f66cf560c2332a769b8f80"
        },
        {
          "url": "https://git.kernel.org/stable/c/149a14ec70887ad14e820a7ca15738ded3d2d493"
        },
        {
          "url": "https://git.kernel.org/stable/c/83fe4e4f4fbf01d3832a24511c0ddfaccf5df9d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e17e101e04a3dc062e2719da57ff78c1c060632"
        }
      ],
      "title": "RDMA/hfi1: Free RX data on late probe failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93102",
    "datePublished": "2026-09-17T16:11:14.413Z",
    "dateReserved": "2026-09-17T16:02:15.085Z",
    "dateUpdated": "2026-10-19T09:05:35.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/igmp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2d0effadf8d2cc9d006e4c4ab0ab6737aed28d77",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "40d6360ccf9bcbe17b5cb248a84e8e004aac2faa",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f60ec3058a85447008b88b762c859d336163acb3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "95128dc74425ec19ed4f2077ccc651e791ff4b75",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/igmp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()\n\nWhen a timer is deleted and not re-armed in igmp_mod_timer(), or stopped\nin igmp_stop_timer(), the code currently decrements the reference counter\nof the multicast list entry @im using refcount_dec(\u0026im-\u003erefcnt).\n\nHowever, both functions can be called from the RCU reader path:\n- igmp_mod_timer() via igmp_heard_query() -\u003e for_each_pmc_rcu()\n- igmp_stop_timer() via igmp_rcv() -\u003e igmp_heard_report()\n\nIf the group im was concurrently removed from the list by ip_mc_dec_group(),\nits reference count might have already been decremented to 1.\n\nIn this case, timer_delete() succeeds, and refcount_dec() decrements\nthe refcount from 1 to 0. Since refcount_dec() does not free the object\nwhen it hits 0 (unlike ip_ma_put()), the im structure is leaked.\n\nFix this by using ip_ma_put(im) instead of refcount_dec(\u0026im-\u003erefcnt),\nand deferring the put until after the spinlock is released."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:44:32.954Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2d0effadf8d2cc9d006e4c4ab0ab6737aed28d77"
        },
        {
          "url": "https://git.kernel.org/stable/c/40d6360ccf9bcbe17b5cb248a84e8e004aac2faa"
        },
        {
          "url": "https://git.kernel.org/stable/c/f60ec3058a85447008b88b762c859d336163acb3"
        },
        {
          "url": "https://git.kernel.org/stable/c/95128dc74425ec19ed4f2077ccc651e791ff4b75"
        },
        {
          "url": "https://git.kernel.org/stable/c/3546deaa0c30a14c7cdb5dc8f2432cb428f0cd36"
        }
      ],
      "title": "ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72321",
    "datePublished": "2026-08-15T05:55:33.547Z",
    "dateReserved": "2026-08-09T03:40:39.919Z",
    "dateUpdated": "2026-10-21T12:44:32.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89541",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:23:27.526748Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:42.189Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/auth_gss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3691c4b3488d8ca046b9941e5be30c626dbbbb50",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "85fa6b12e8f439739ac36ef2aad925f37c8b976a",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "401f6a5b338d05bb1069ad814d9f77e3c367854f",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "81fd7654a8429718adfcb2a7e03496077f547ed0",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "89a15a50f84d32d4b99db86f957427fcbe20a99a",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "ebcbd2523a8524c3d24e111cdbed8e271d910269",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "d395c30d570ca6168f0297b191709927d1258273",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            },
            {
              "lessThan": "87831b92112c81db251d46756d65daa4f91af6a2",
              "status": "affected",
              "version": "2d2da60c63b67174add32f06e8d54c3a0c5cd9cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/auth_gss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.15"
            },
            {
              "lessThan": "2.6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: harden gss_unwrap_resp_priv length checks\n\ngss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with\n\n    offset = (u8 *)(p) - (u8 *)head-\u003eiov_base;\n    if (offset + opaque_len \u003e rcv_buf-\u003elen)\n            goto unwrap_failed;\n    maj_stat = gss_unwrap(ctx-\u003egc_gss_ctx, offset,\n                          offset + opaque_len, rcv_buf);\n\nBoth operands are u32 and the sum is computed in u32. A reply with\nopaque_len near 0xffffffff makes offset + opaque_len wrap to a small\nvalue that is below rcv_buf-\u003elen, so the bound check passes and\ngss_unwrap() is called with end \u003c begin. The check also lacks a\nlower bound, so any opaque_len in [0, GSS_KRB5_TOK_HDR_LEN) is\naccepted and forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt\nheader reads at ptr+4 and ptr+6 then run past the token.\n\nA krb5p NFS server returning a crafted RPCSEC_GSS reply can drive\nthe client into out-of-bounds reads in gss_krb5_unwrap_v2() and the\nrotate_left() loop that follows.\n\nFix by replacing the single combined check with three guards that\nare safe in u32 arithmetic and that enforce the RFC 4121 minimum\nouter token length:\n\n    if (offset \u003e rcv_buf-\u003elen)\n            goto unwrap_failed;\n    if (opaque_len \u003e rcv_buf-\u003elen - offset)\n            goto unwrap_failed;\n    if (opaque_len \u003c GSS_KRB5_TOK_HDR_LEN)\n            goto unwrap_failed;\n\nThe first guard makes the subtraction in the second guard\nunconditionally safe; offset is derived from a successful\nxdr_inline_decode() in the head kvec, so in practice it already\nsatisfies the bound. The floor mirrors the server-side check added\nin commit 5b757c2e57a5 (\"SUNRPC: svcauth_gss: enforce krb5 token\nminimum length\")."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - gss_unwrap_resp_priv() runs in the Linux NFS/SUNRPC client while decoding RPCSEC_GSS privacy (krb5p) replies; a malicious or compromised NFS server supplies the crafted opaque_len and wrap token over the existing TCP/UDP/RDMA RPC connection.\nAC:L - The attacker fully controls the reply, including opaque_len and the cleartext RFC 4121 header, and a single response can make offset+opaque_len wrap in u32 or fall below GSS_KRB5_TOK_HDR_LEN; no race or layout beyond the attacker\u2019s control is required.\nPR:N - The attacker is the remote RPC/NFS peer that already holds the GSS session keys needed to pass gss_validate(); no local account, user namespace, or capability on the victim client is required.\nUI:N - Once a krb5p NFS mount or other SUNRPC GSS-privacy client is already in use, normal client RPCs elicit replies the attacker can craft; no extra victim action is needed at attack time.\nS:U - Out-of-bounds reads, rotate/decrypt memory corruption, and crashes stay inside the victim kernel\u2019s SUNRPC client and do not cross a VM, IOMMU, or other security-authority boundary.\nC:H - A short or wrapped opaque_len makes gss_krb5_unwrap_v2() read past the token at ptr+4/ptr+6 and feeds rotate_left()/decrypt with wrapped lengths, disclosing adjacent kernel memory; unwrap cleanup can also memmove nearly UINT_MAX bytes.\nI:H - The same wrapped lengths drive rotate_left() writes, CBC/AEAD decrypt over an unbounded xdr subsegment (xdr_buf_subsegment\u2019s error is ignored), and gss_krb5_unwrap_v2()\u2019s unsigned movelen underflow into a near-4GiB memmove, enabling kernel memory corruption.\nA:H - rotate_left() can divide-by-zero on a zero-length subbuffer, spin in a multi-gigabyte kernel loop on a wrapped subsegment, or oops/panic on the huge memmove or out-of-bounds header access."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:48:32.929Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3691c4b3488d8ca046b9941e5be30c626dbbbb50"
        },
        {
          "url": "https://git.kernel.org/stable/c/85fa6b12e8f439739ac36ef2aad925f37c8b976a"
        },
        {
          "url": "https://git.kernel.org/stable/c/401f6a5b338d05bb1069ad814d9f77e3c367854f"
        },
        {
          "url": "https://git.kernel.org/stable/c/81fd7654a8429718adfcb2a7e03496077f547ed0"
        },
        {
          "url": "https://git.kernel.org/stable/c/89a15a50f84d32d4b99db86f957427fcbe20a99a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebcbd2523a8524c3d24e111cdbed8e271d910269"
        },
        {
          "url": "https://git.kernel.org/stable/c/d395c30d570ca6168f0297b191709927d1258273"
        },
        {
          "url": "https://git.kernel.org/stable/c/87831b92112c81db251d46756d65daa4f91af6a2"
        }
      ],
      "title": "SUNRPC: harden gss_unwrap_resp_priv length checks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89541",
    "datePublished": "2026-09-11T19:44:18.188Z",
    "dateReserved": "2026-09-11T19:38:34.721Z",
    "dateUpdated": "2026-10-19T08:48:32.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/rtrs/rtrs-srv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b1e26e70d7ca9f0906af2283558a530eeb1f066",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "2c52b2afded988233cd4ccc185cf5147bbc77a76",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "b042b4947752df0b3d16e683ac09fb4f7f0e33e0",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "24ad03bfeda05fca04c56677e57fd3d6bc3e9978",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "c76e9123ab91a903396d26e6ab1b5caae5c6b149",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            },
            {
              "lessThan": "54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5",
              "status": "affected",
              "version": "9cb837480424e78ed585376f944088246685aec3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/rtrs/rtrs-srv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Fix integer underflow in process_read and process_write\n\nusr_len is read from a network-supplied message field (le16_to_cpu)\nand used to compute data_len = off - usr_len without validating that\nusr_len \u003c= off. A malicious RDMA client can send usr_len \u003e off causing\nan integer underflow, resulting in data_len wrapping to a huge size_t\nvalue which is then passed to the rdma_ev callback as a memory length,\nleading to out-of-bounds memory access.\n\nFix by reading and validating usr_len \u003c= off before rtrs_srv_get_ops_ids()\nin both process_read() and process_write(), ensuring the early return\npath acquires no reference and has no resource leak."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote peer RDMA-WRITE-WITH-IMM\u0027s a RTRS_MSG_READ or RTRS_MSG_WRITE carrying attacker-controlled usr_len; rtrs_srv_rdma_done() hands that buffer to process_io_req() then process_read()/process_write(). rtrs_srv_cm_init() listens with RDMA_PS_TCP on IPv6 port 1234 (RoCEv2/iWARP), which is IP-routable.\nAC:L - The peer sets le16 usr_len in the RTRS_MSG_READ/WRITE at chunk+off and the IMM payload that rtrs_srv_rdma_done() splits into msg_id and off. Choosing usr_len \u003e off makes size_t data_len = off - usr_len wrap on every call; there is no race and no victim-held state.\nPR:N - rtrs_rdma_connect() admits the RDMA_CM CONNECT_REQUEST after checking only RTRS_MAGIC, protocol major version, and cid/uuid; process_info_req() then publishes chunk rkeys and moves to RTRS_SRV_CONNECTED with no credentials, so process_read()/process_write() run unauthenticated.\nUI:N - The attacker posts the RDMA-WRITE-WITH-IMM that rtrs_srv_rdma_done() delivers to process_read()/process_write(); no local user must mount a volume, open a file, or otherwise interact.\nS:U - process_read()/process_write() invoke rnbd_srv_rdma_ev() in the same host kernel that owns the chunk pages; the OOB access stays inside that kernel and does not escape a VM, guest, or IOMMU domain.\nC:H - Underflowed data_len makes usr = page_address(chunk)+off-usr_len point before the chunk. rnbd_srv_rdma_ev() reads the RNBD header there; a sprayed RNBD_MSG_OPEN does unbounded strlen(dev_name), and process_rdma() bio_add_virt_nofail()s a ~4GiB WRITE bvec that copies following linear-map pages onto a device the peer can read back.\nI:H - process_rdma() truncates the wrapped size_t to u32 and bio_add_virt_nofail() installs a ~4GiB bvec from the chunk page; submit_bio() of an RNBD_OP_READ therefore writes device data through that bvec into subsequent kernel linear-map pages, an out-of-bounds kernel write.\nA:H - rnbd_srv_rdma_ev() immediately loads hdr-\u003etype from the wrapped usr pointer, process_msg_open() strlen()s that OOB name, and the ~4GiB bio_add_virt_nofail() bvec walks into holes or MMIO in the linear map; any of those oops/panic the completion path and can be repeated at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:58:05.684Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b1e26e70d7ca9f0906af2283558a530eeb1f066"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c52b2afded988233cd4ccc185cf5147bbc77a76"
        },
        {
          "url": "https://git.kernel.org/stable/c/b042b4947752df0b3d16e683ac09fb4f7f0e33e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/24ad03bfeda05fca04c56677e57fd3d6bc3e9978"
        },
        {
          "url": "https://git.kernel.org/stable/c/c76e9123ab91a903396d26e6ab1b5caae5c6b149"
        },
        {
          "url": "https://git.kernel.org/stable/c/54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5"
        }
      ],
      "title": "RDMA/rtrs-srv: Fix integer underflow in process_read and process_write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97413",
    "datePublished": "2026-09-24T16:03:21.010Z",
    "dateReserved": "2026-09-24T14:53:16.867Z",
    "dateUpdated": "2026-10-03T10:58:05.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/cls_flow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19f2ecf8ea564562c7e7a919cf38068dd9aa1c96",
              "status": "affected",
              "version": "e5dfb815181fcb186d6080ac3a091eadff2d98fe",
              "versionType": "git"
            },
            {
              "lessThan": "3d054001860270748405a3f9270c5fa0bf7ffc19",
              "status": "affected",
              "version": "e5dfb815181fcb186d6080ac3a091eadff2d98fe",
              "versionType": "git"
            },
            {
              "lessThan": "fb31fbe51c233f3bf47021121f63d2e42cac2d08",
              "status": "affected",
              "version": "e5dfb815181fcb186d6080ac3a091eadff2d98fe",
              "versionType": "git"
            },
            {
              "lessThan": "0a8b5b74f0e6b6b9ce453bcfa4baa502c4c7577a",
              "status": "affected",
              "version": "e5dfb815181fcb186d6080ac3a091eadff2d98fe",
              "versionType": "git"
            },
            {
              "lessThan": "6151159618198675e01c391676e579738286c135",
              "status": "affected",
              "version": "e5dfb815181fcb186d6080ac3a091eadff2d98fe",
              "versionType": "git"
            },
            {
              "lessThan": "f294fc71c4a0fa4964f6428a1b4e7929c1d83125",
              "status": "affected",
              "version": "e5dfb815181fcb186d6080ac3a091eadff2d98fe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/cls_flow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_flow: Dont expose folded kernel pointers\n\nThe flow classifier falls back to addr_fold() for fields that are missing\nfrom packet headers. In map mode, userspace controls mask, xor, rshift,\naddend and divisor, and can observe the resulting classid through class\nstatistics. This allows a tc classifier in a user/network namespace to\nrecover the 32-bit folded value of skb-\u003esk, skb_dst() or skb_nfct().\n\nAlign with standard kernel practices for pointer hashing and replace the\nXOR folding with a keyed siphash (which is cryptographically secure)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:16:36.420Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19f2ecf8ea564562c7e7a919cf38068dd9aa1c96"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d054001860270748405a3f9270c5fa0bf7ffc19"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb31fbe51c233f3bf47021121f63d2e42cac2d08"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a8b5b74f0e6b6b9ce453bcfa4baa502c4c7577a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6151159618198675e01c391676e579738286c135"
        },
        {
          "url": "https://git.kernel.org/stable/c/f294fc71c4a0fa4964f6428a1b4e7929c1d83125"
        }
      ],
      "title": "net/sched: cls_flow: Dont expose folded kernel pointers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74290",
    "datePublished": "2026-08-15T05:57:57.004Z",
    "dateReserved": "2026-08-15T05:44:03.881Z",
    "dateUpdated": "2026-08-17T05:16:36.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68477",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:49:38.524589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:09:12.031Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_app.c",
            "net/netfilter/ipvs/ip_vs_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "613ce63711b8d431bba90781f133c39a21684f87",
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "versionType": "git"
            },
            {
              "lessThan": "95d4511d81b2b37e5d2bdde5d912e48243eae517",
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "versionType": "git"
            },
            {
              "lessThan": "3a9dc9b55b53d94613a587604b77d3b20024090c",
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "versionType": "git"
            },
            {
              "lessThan": "a3f0d5b605cd5da5c95279969fb8cea4e55cee5b",
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "versionType": "git"
            },
            {
              "lessThan": "7350eb7ead172ae8024897d4b0f2e15c5318279c",
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "versionType": "git"
            },
            {
              "lessThan": "d4ec18f48ce78a3bf7c999ac908691007375fe99",
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "versionType": "git"
            },
            {
              "lessThan": "905d7a363ade96a19f214815361e11981142c547",
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "versionType": "git"
            },
            {
              "lessThan": "b3fe4cbd583895987935a9bdad01c8f9d3a02310",
              "status": "affected",
              "version": "2a3b791e6e1169f374224d164738e9f7be703d77",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_app.c",
            "net/netfilter/ipvs/ip_vs_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.28"
            },
            {
              "lessThan": "2.6.28",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix more places with wrong ipv6 transport offsets\n\nSashiko reports for more incorrect IPv6 transport offsets.\n\nThe app code for TCP was assuming IPv4 network header\neven after the ipvsh argument was provided. This can\ncause problems with apps over IPv6. As for the only\nofficial app in the kernel tree (FTP) this problem is\nharmless because we use Netfilter to mangle the FTP\nports and we do not adjust the TCP seq numbers.\n\nAlso, provide correct offset of the ICMPV6 header in\nip_vs_out_icmp_v6() for correct checksum checks when\nthe IPv6 packet has extension headers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered when remote IPv6 packets traverse IPVS netfilter hooks (NF_INET_LOCAL_IN/OUT/FORWARD) on an internet-facing load balancer; attackers send crafted IPv6 traffic with extension headers to a configured virtual service without local access.\nAC:L - The attacker fully controls IPv6 extension headers and TCP/ICMPv6 packet contents on connections they initiate to the VIP; no race or privileged victim state is required beyond normal IPVS load-balancer operation.\nPR:N - Exploitation requires only the ability to send network traffic to an IPVS-managed VIP; the attacker needs no account or capabilities on the target host (IPVS configuration is an environmental prerequisite, not attacker privilege).\nUI:N - No victim user interaction is required beyond the attacker sending malicious IPv6 packets over an established or new connection to the load-balanced service.\nS:U - Impact is confined to kernel memory corruption and packet handling within the load-balancer host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Using ip_hdrlen() on IPv6 skbs reads TCP sequence/ack fields from the wrong skb offset (into the IPv6 header or extension-header area), constituting an out-of-bounds read exploitable for information disclosure.\nI:H - In ip_vs_out_icmp_v6, passing sizeof(ipv6hdr) instead of ipvsh-\u003elen causes ip_vs_nat_icmp_v6 to write ICMP/address/port fields at the wrong skb offset, corrupting extension headers or adjacent packet data.\nA:H - Corrupting IPv6/ICMP/TCP header fields in the skb can cause kernel oops, panics, or connection disruption on the load balancer when malformed packets are processed or forwarded."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:19.469Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/613ce63711b8d431bba90781f133c39a21684f87"
        },
        {
          "url": "https://git.kernel.org/stable/c/95d4511d81b2b37e5d2bdde5d912e48243eae517"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a9dc9b55b53d94613a587604b77d3b20024090c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3f0d5b605cd5da5c95279969fb8cea4e55cee5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7350eb7ead172ae8024897d4b0f2e15c5318279c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4ec18f48ce78a3bf7c999ac908691007375fe99"
        },
        {
          "url": "https://git.kernel.org/stable/c/905d7a363ade96a19f214815361e11981142c547"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3fe4cbd583895987935a9bdad01c8f9d3a02310"
        }
      ],
      "title": "ipvs: fix more places with wrong ipv6 transport offsets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68477",
    "datePublished": "2026-08-15T05:51:32.820Z",
    "dateReserved": "2026-07-30T09:28:09.396Z",
    "dateUpdated": "2026-10-19T21:09:12.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74710",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:15:16.370467Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:16:11.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xdp_umem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21b8536aee819792f1b4b38b9aacf2a073025d49",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            },
            {
              "lessThan": "642c6e73fce17fdca93a5793c4d22359fda866d7",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            },
            {
              "lessThan": "cfb9d2976b277e554e28c165e3eff4b4a8ea10bd",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            },
            {
              "lessThan": "1bb30b181d9f0484e141f8411e15ed906d5c6780",
              "status": "affected",
              "version": "341ac980eab90ac1f6c22ee9f9da83ed9604d899",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xdp_umem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: require at least 16 bytes of TX metadata\n\nAF_XDP accepts a TX metadata length as small as eight bytes, but every\nsupported request needs the flags plus at least one eight-byte request\nfield. Such short metadata also lets the kernel read beyond the registered\narea.\n\nRequire 16 bytes rather than sizeof(struct xsk_tx_metadata) to preserve\ncompatibility with applications that do not use launch-time metadata."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local AF_XDP setup\u2014socket(AF_XDP), setsockopt(XDP_UMEM_REG) with tx_metadata_len=8, ring configuration, bind, and TX descriptor submission\u2014not via remote packet handling or network-facing services.\nAC:L - The attacker fully controls tx_metadata_len, descriptor addresses, metadata flags, and TX timing, and can place frames at chunk boundaries to reliably trigger kernel reads/writes past the declared 8-byte metadata headroom.\nPR:L - AF_XDP socket creation requires CAP_NET_RAW (xsk_create()); per kernel CNA guidance this is Low because unprivileged processes can obtain it inside user/network namespaces (e.g., unshare -Urn).\nUI:N - No victim action is required; the attacker configures their own AF_XDP socket, UMEM, rings, and TX descriptors to trigger the faulty metadata handling during transmit.\nS:U - Impact is confined to kernel processing of attacker-supplied AF_XDP metadata and pinned UMEM frames; it does not cross VM, hypervisor, or IOMMU isolation boundaries.\nC:H - With only 8 bytes registered, the kernel still dereferences xsk_tx_metadata request fields (checksum, launch time) beyond the metadata area; this out-of-bounds read can cross chunk/UMEM boundaries and expose adjacent memory.\nI:H - TX timestamp completion writes through meta-\u003ecompletion.tx_timestamp when only 8 bytes of metadata were reserved, causing an out-of-bounds write past the registered metadata headroom that can corrupt adjacent memory or be leveraged further.\nA:H - Reading or writing metadata fields beyond the registered length at chunk/UMEM edges can access unmapped pages and trigger kernel faults; out-of-bounds kernel accesses in this path can cause oops/panic-level denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:52.464Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21b8536aee819792f1b4b38b9aacf2a073025d49"
        },
        {
          "url": "https://git.kernel.org/stable/c/642c6e73fce17fdca93a5793c4d22359fda866d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfb9d2976b277e554e28c165e3eff4b4a8ea10bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bb30b181d9f0484e141f8411e15ed906d5c6780"
        }
      ],
      "title": "xsk: require at least 16 bytes of TX metadata",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74710",
    "datePublished": "2026-08-22T15:33:07.172Z",
    "dateReserved": "2026-08-15T05:44:03.928Z",
    "dateUpdated": "2026-10-16T19:16:11.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72066",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:51:15.720754Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:19:26.150Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/cpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "27481cf4365a6ff5c9be3590143e7ed434000266",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "2408be459c70ef4250da1a9e50f5478e6b250d61",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "998f66e9ce320f3433f60b948e3698b744754a46",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "61a73a123ac7a7fbc57382531f8cb7092d569aba",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "6cb15b81ff545840048fb0e1a6e827d560dbf367",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "631d53102da9f469c96b882b770336bec095b833",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            },
            {
              "lessThan": "86f436567f2516a0083b210bedc933544826a2c3",
              "status": "affected",
              "version": "98f8cdce1db580b99fce823a48eea2cb2bdb261e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/cpu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpu: hotplug: Bound hotplug states sysfs output\n\nstates_show() adds CPU hotplug state names into a single sysfs buffer\nusing sprintf(). With enough registered states, this can write past the\nend of the PAGE_SIZE buffer.\n\nUse sysfs_emit_at() so output is bounded."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in states_show() on the read path for /sys/devices/system/cpu/hotplug/states, reached only via a local sysfs/VFS read() syscall. No network packet handler, adjacent protocol, or physical attach path invokes this CPU hotplug sysfs callback.\nAC:L - Once enough CPU hotplug states are registered (plausible on cloud servers, KVM hosts, Android, and heavily configured distros with hundreds of cpuhp_setup_state() users), a single read deterministically executes unbounded sprintf() past the PAGE_SIZE buffer with no race or attacker-uncontrollable timing.\nPR:L - states is DEVICE_ATTR_RO (mode 0444), so any unprivileged local user can open and read /sys/devices/system/cpu/hotplug/states. states_show() performs no capability, namespace, or credential check before formatting output into the sysfs buffer.\nUI:N - Exploitation requires only the attacker reading the sysfs attribute; no victim mount, driver bind, module load, or other interactive action is needed beyond the attacker\u0027s own read once sufficient hotplug states exist at boot.\nS:U - The out-of-bounds write corrupts kernel heap memory within the same OS/kernel security authority. This is standard kernel memory corruption, not a KVM guest-to-host escape, IOMMU boundary bypass, or other cross-scope boundary violation.\nC:H - Unbounded sprintf() writes past the fixed PAGE_SIZE buffer allocated by sysfs_kf_seq_show(), corrupting adjacent kmalloc heap memory. Per kernel guidance, this class of memory-corruption OOB write can be leveraged for arbitrary kernel memory disclosure.\nI:H - The vulnerable loop advances buf and repeatedly sprintf()s without bounds, producing a kernel heap out-of-bounds write that can corrupt adjacent objects and enable control-flow hijacking or arbitrary kernel writes per OOB-write scoring guidance.\nA:H - Writing past the PAGE_SIZE sysfs show buffer corrupts adjacent kernel heap objects and can cause immediate kernel oops/panic during the read path or when corrupted adjacent allocations are later used, satisfying High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:35:55.630Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/27481cf4365a6ff5c9be3590143e7ed434000266"
        },
        {
          "url": "https://git.kernel.org/stable/c/2408be459c70ef4250da1a9e50f5478e6b250d61"
        },
        {
          "url": "https://git.kernel.org/stable/c/de4d3d8ae17dc8b4cf8c59436c4b7e2dc2491635"
        },
        {
          "url": "https://git.kernel.org/stable/c/998f66e9ce320f3433f60b948e3698b744754a46"
        },
        {
          "url": "https://git.kernel.org/stable/c/61a73a123ac7a7fbc57382531f8cb7092d569aba"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cb15b81ff545840048fb0e1a6e827d560dbf367"
        },
        {
          "url": "https://git.kernel.org/stable/c/631d53102da9f469c96b882b770336bec095b833"
        },
        {
          "url": "https://git.kernel.org/stable/c/86f436567f2516a0083b210bedc933544826a2c3"
        }
      ],
      "title": "cpu: hotplug: Bound hotplug states sysfs output",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72066",
    "datePublished": "2026-08-15T05:52:19.527Z",
    "dateReserved": "2026-08-09T03:40:39.903Z",
    "dateUpdated": "2026-10-19T21:19:26.150Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72129",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:42:24.250750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T18:44:58.318Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c2106ba1b14d644a5203bea1a50dbe25dcad713c",
              "status": "affected",
              "version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
              "versionType": "git"
            },
            {
              "lessThan": "bf8bcc1c137d54a62a428b00051fdbb13660673b",
              "status": "affected",
              "version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
              "versionType": "git"
            },
            {
              "lessThan": "11401371152b228448a41d79c6de1c938f93049a",
              "status": "affected",
              "version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
              "versionType": "git"
            },
            {
              "lessThan": "7c96581169c9d9a7d0726e554313acfbead6141c",
              "status": "affected",
              "version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
              "versionType": "git"
            },
            {
              "lessThan": "42a8ea3acd883f4f210d9e54e0975b1e2292b529",
              "status": "affected",
              "version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
              "versionType": "git"
            },
            {
              "lessThan": "2944113ad5fbcdf5d349d857c03d2a44b6de75b8",
              "status": "affected",
              "version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
              "versionType": "git"
            },
            {
              "lessThan": "98bcdfa619150b2f41fa15bac140dbaf2584ad05",
              "status": "affected",
              "version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
              "versionType": "git"
            },
            {
              "lessThan": "48c0162f647bb47e6084ffbc71b8f213f5e2f4f8",
              "status": "affected",
              "version": "0d5ee2b2ab4f6776c361bc975c2323bc8b5cf349",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-rdma: handle inline data with a nonzero offset\n\nnvmet_rdma_use_inline_sg() maps the host-controlled inline data offset\ninto the per-command inline scatterlist.  The bounds check admits any\noffset with off + len \u003c= inline_data_size, but the mapping still assumes\nthe data begins in the first inline page:\n\n\tsg-\u003eoffset = off;\n\tsg-\u003elength = min_t(int, len, PAGE_SIZE - off);\n\nWhen a port is configured with inline_data_size \u003e PAGE_SIZE (settable up\nto max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size]\nmakes \"PAGE_SIZE - off\" underflow, so sg-\u003elength is set to ~4 GiB and\nthe block backend reads far past the first inline page.  num_pages(len)\nalso ignores the offset, so an in-bounds offset whose [off, off+len)\nspan crosses a page boundary under-counts the scatterlist.\n\nMap the offset properly: split it into a page index and an in-page\noffset, start the scatterlist at that page, and size the page count from\npage_off + len.  Because the request scatterlist may now start at\ninline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL\nidentity test in nvmet_rdma_release_rsp() to a range test; otherwise the\npersistent inline scatterlist is mistaken for an allocated one and\nnvmet_req_free_sgls() frees an inline page (and warns in\nfree_large_kmalloc())."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nvmet-rdma is an in-kernel NVMe-oF target that processes NVMe commands and inline data from remote initiators over RDMA (RoCE/IB) via RDMA RECV completions, placing it in the same network-reachable class as nvmet-tcp and other remote fabric targets.\nAC:L - In deployments using inline_data_size above PAGE_SIZE (up to 16KB), a remote initiator fully controls the inline SGL offset and length in write commands and can deterministically trigger the integer underflow and multi-gigabyte scatterlist length without races or victim-specific timing.\nPR:N - Exploitation requires only remote NVMe-oF RDMA connectivity to a configured target subsystem; no local UNIX privileges or Linux capabilities on the victim host are needed, and the vulnerable recv/command path is reachable before or without mandatory DH-HMAC-CHAP on I/O queues.\nUI:N - Triggering the bug requires only sending crafted NVMe write commands with malicious inline SGL offsets over an established RDMA connection; no end-user actions such as mounting filesystems or opening files are required.\nS:U - The vulnerability corrupts kernel heap memory and backing storage on the NVMe target host itself; it does not cross a VM, container, or IOMMU security boundary to impact a separate security authority.\nC:H - The integer underflow sets scatterlist entries to ~4 GiB, causing the block backend to read far beyond the inline DMA buffer pages into adjacent kernel memory, and the erroneous sgl_free of inline pages creates use-after-free conditions enabling further information disclosure.\nI:H - Out-of-bounds kernel memory is incorporated into block write bios corrupting exported backing storage, and the erroneous freeing of inline scatterlist pages enables heap corruption primitives that can be leveraged for arbitrary memory writes or control-flow hijacking.\nA:H - Out-of-bounds access from multi-gigabyte scatterlist lengths, warnings from free_large_kmalloc() on freed inline pages, and nvmet fatal error handling can cause kernel oops, hung I/O, or panic on the storage target."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:41.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c2106ba1b14d644a5203bea1a50dbe25dcad713c"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf8bcc1c137d54a62a428b00051fdbb13660673b"
        },
        {
          "url": "https://git.kernel.org/stable/c/11401371152b228448a41d79c6de1c938f93049a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c96581169c9d9a7d0726e554313acfbead6141c"
        },
        {
          "url": "https://git.kernel.org/stable/c/42a8ea3acd883f4f210d9e54e0975b1e2292b529"
        },
        {
          "url": "https://git.kernel.org/stable/c/2944113ad5fbcdf5d349d857c03d2a44b6de75b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/98bcdfa619150b2f41fa15bac140dbaf2584ad05"
        },
        {
          "url": "https://git.kernel.org/stable/c/48c0162f647bb47e6084ffbc71b8f213f5e2f4f8"
        }
      ],
      "title": "nvmet-rdma: handle inline data with a nonzero offset",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72129",
    "datePublished": "2026-08-15T05:53:05.874Z",
    "dateReserved": "2026-08-09T03:40:39.907Z",
    "dateUpdated": "2026-10-16T18:44:58.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/gntdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "52dc40ef0cfee6ae89b7524967e73f0ba37906d7",
              "status": "affected",
              "version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
              "versionType": "git"
            },
            {
              "lessThan": "1dd9cb98fe228e017fff9efb33862ff38c741b65",
              "status": "affected",
              "version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
              "versionType": "git"
            },
            {
              "lessThan": "6df926130aee6cab9b5d2e5b7862e49ccac348dc",
              "status": "affected",
              "version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
              "versionType": "git"
            },
            {
              "lessThan": "311011f8cc206c5af2877b03e3f627ee1b8fe024",
              "status": "affected",
              "version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
              "versionType": "git"
            },
            {
              "lessThan": "18a693733f7ad004e1ab0466693121ca70cd95dd",
              "status": "affected",
              "version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
              "versionType": "git"
            },
            {
              "lessThan": "16d3ccdabb8dee9be2cdcd6d3f9a125572ec0454",
              "status": "affected",
              "version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
              "versionType": "git"
            },
            {
              "lessThan": "6883269a323609f68f6faa903f8f8ff3d191cec8",
              "status": "affected",
              "version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
              "versionType": "git"
            },
            {
              "lessThan": "45ca1afe2fd14c04e37227e79d3f8455831d8408",
              "status": "affected",
              "version": "68b025c813c2eb41ff25628e3d4952d5185eb1a4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/gntdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/gntdev: fix error handling in ioctl\n\nWhen gntdev_ioctl_map_grant_ref() fails to copy the operation result\nback to userspace after successfully adding the mapping to the list,\nthe error path returns -EFAULT without releasing the reference\nacquired by gntdev_alloc_map(). The mapping remains in priv-\u003emaps\nwith a refcount of 1, causing a memory leak and a dangling list\nentry.\n\nAdditionally, gntdev_add_map() may modify map-\u003eindex to avoid overlap\nwith existing mappings. Therefore, the index returned to userspace\nmust be obtained after gntdev_add_map() completes.\n\nFix this by holding the mutex across gntdev_add_map(), retrieving\nthe correct index, and copy_to_user(). If copy_to_user() fails,\nremove the mapping from the list and release the reference while\nstill holding the lock.\n\n\nFix these issues by properly handling all error cases."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:08:56.108Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/52dc40ef0cfee6ae89b7524967e73f0ba37906d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/1dd9cb98fe228e017fff9efb33862ff38c741b65"
        },
        {
          "url": "https://git.kernel.org/stable/c/6df926130aee6cab9b5d2e5b7862e49ccac348dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/311011f8cc206c5af2877b03e3f627ee1b8fe024"
        },
        {
          "url": "https://git.kernel.org/stable/c/18a693733f7ad004e1ab0466693121ca70cd95dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/16d3ccdabb8dee9be2cdcd6d3f9a125572ec0454"
        },
        {
          "url": "https://git.kernel.org/stable/c/6883269a323609f68f6faa903f8f8ff3d191cec8"
        },
        {
          "url": "https://git.kernel.org/stable/c/45ca1afe2fd14c04e37227e79d3f8455831d8408"
        }
      ],
      "title": "xen/gntdev: fix error handling in ioctl",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72138",
    "datePublished": "2026-08-15T05:53:12.549Z",
    "dateReserved": "2026-08-09T03:40:39.908Z",
    "dateUpdated": "2026-08-17T05:08:56.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74630",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:02:57.486583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:06:03.622Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/addrconf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "785d908f8d21c8bc78b6fb2c2932ab662bf6918a",
              "status": "affected",
              "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
              "versionType": "git"
            },
            {
              "lessThan": "aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8",
              "status": "affected",
              "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
              "versionType": "git"
            },
            {
              "lessThan": "145812b678de9f3b59780173be3c0d22ed60dd93",
              "status": "affected",
              "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
              "versionType": "git"
            },
            {
              "lessThan": "cc5bd568f9b7683e60841b6fd02c10d64535bd6e",
              "status": "affected",
              "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
              "versionType": "git"
            },
            {
              "lessThan": "1c206d461c680c3151daa3c89fc26eaf5bf98a7f",
              "status": "affected",
              "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
              "versionType": "git"
            },
            {
              "lessThan": "680fbd7942185448eadb990a3d10a53eb946b702",
              "status": "affected",
              "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
              "versionType": "git"
            },
            {
              "lessThan": "14e812ab41df0cac033479da835ec9a5de633404",
              "status": "affected",
              "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
              "versionType": "git"
            },
            {
              "lessThan": "0e243671bc7b8eaf00f83dd2f4367436dc0cff98",
              "status": "affected",
              "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/addrconf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent in6_dev_get() from resurrecting inet6_dev\n\nin6_dev_get() reads dev-\u003eip6_ptr under RCU and then unconditionally\nincrements its refcount. Device teardown can clear the pointer and drop\nthe last reference between these operations. The increment then\nresurrects an object whose RCU free has already been queued, so callers\ncan use it after it is freed.\n\nUse refcount_inc_not_zero() and return NULL when the object has already\nreached zero. RCU keeps the memory accessible through the attempted\nreference acquisition, and a successful increment pins the object for\nthe caller.\n\nAn independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)\nkernel reproduced the invalid reference acquisition as UID 1000:\n\n  refcount_t: addition on 0; use-after-free.\n  ip6_mc_source+0xef4/0x17e0\n\nIt was followed by the corresponding reference underflow in\nip6_mc_source(). The supplied trace from the same unpatched revision\nadditionally shows the access after the RCU read-side section ends:\n\n  BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0\n  Write of size 8 at addr ffff888015b50240 by task poc/1219\n\nBug found and triaged by OpenAI Security Research and\nvalidated by Trail of Bits."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The reliable path is local setsockopt(2) on IPv6 MCAST source-filter options (ipv6_setsockopt \u2192 do_ipv6_mcast_group_source \u2192 ip6_mc_source \u2192 in6_dev_get), reproduced as UID 1000; concurrent netdev unregister is also a local rtnetlink syscall, not remote packet delivery.\nAC:L - An attacker in their own user+network namespace controls both sides of the race\u2014hammering MCAST_JOIN/BLOCK/UNBLOCK_SOURCE setsockopt while deleting the bound veth via RTM_DELLINK\u2014so the ip6_ptr clear and final in6_dev_put window is attacker-driven and retryable.\nPR:L - Multicast setsockopt needs no capability, but hitting the unregister teardown that drops the last inet6_dev reference requires CAP_NET_ADMIN for RTM_DELLINK; that is ns_capable() in the netns user_ns and is obtainable by an unprivileged user via unshare -Urn, not init-namespace root.\nUI:N - Exploitation uses only the attacker\u0027s own IPv6 sockets, setsockopt calls, and netdev create/delete in their namespace; no victim mount, click, or other cooperation is required.\nS:U - The resurrected inet6_dev UAF corrupts kernel heap state within the host kernel authority (mutex_lock on freed mc_lock); it is standard local kernel memory corruption, not a VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - Resurrecting a zero-refcount inet6_dev whose RCU free is already queued is a slab use-after-free; KASAN reported UAF on freed inet6_dev memory, and such heap UAFs enable disclosure via controlled reuse of the freed object.\nI:H - After resurrection the caller locks idev-\u003emc_lock and mutates multicast state on freed memory (KASAN write in mutex_lock), giving attacker-influenced heap corruption that can be turned into arbitrary write or control-flow hijack.\nA:H - The PoC triggers refcount_t addition-on-0 warnings, refcount underflow, and KASAN slab-use-after-free in mutex_lock, demonstrating immediate kernel memory corruption that can oops/panic and be repeated by re-running the race."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:54.475Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/785d908f8d21c8bc78b6fb2c2932ab662bf6918a"
        },
        {
          "url": "https://git.kernel.org/stable/c/aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/145812b678de9f3b59780173be3c0d22ed60dd93"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc5bd568f9b7683e60841b6fd02c10d64535bd6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c206d461c680c3151daa3c89fc26eaf5bf98a7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/680fbd7942185448eadb990a3d10a53eb946b702"
        },
        {
          "url": "https://git.kernel.org/stable/c/14e812ab41df0cac033479da835ec9a5de633404"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e243671bc7b8eaf00f83dd2f4367436dc0cff98"
        }
      ],
      "title": "ipv6: prevent in6_dev_get() from resurrecting inet6_dev",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74630",
    "datePublished": "2026-08-22T15:32:11.596Z",
    "dateReserved": "2026-08-15T05:44:03.921Z",
    "dateUpdated": "2026-10-16T19:06:03.622Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80585",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:17:56.710913Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:28.485Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/fastopen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f75f174edc865738522e514d042cf5627f084859",
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "versionType": "git"
            },
            {
              "lessThan": "fca7e444c04689fe4cc6b56f2725f804a4bb1ef9",
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "versionType": "git"
            },
            {
              "lessThan": "75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5",
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "versionType": "git"
            },
            {
              "lessThan": "72b4a0c51a4b550d40301d60a366b429b8c8e78d",
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "versionType": "git"
            },
            {
              "lessThan": "e00b63056fb4f261455b3e5df5268a1f8ce47a87",
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/fastopen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fastopen: only mark MPTFO subflows with SYN data\n\nPassive TCP Fast Open accepts a valid-cookie SYN even when it carries\nno data. In that case the child socket\u0027s receive queue is intentionally\nleft empty.\n\nmptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking\nfor queued SYN data. That made data-less TFO SYNs hit a WARN and, if\nthe warning was non-fatal, left stale MPTFO state behind. The stale\nflag could later trigger a state-confusion bug in\ncheck_fully_established().\n\nOnly mark the subflow as MPTFO after confirming that an SKB was queued.\nReturn quietly when the receive queue is empty.\n\nNote that mptcp_subflow_context\u0027s is_mptfo field is now not just about\nsubflows where the TFO was present, but about MPTFO subflow that\nconsumed SYN data. Only having a valid cookie but not carrying data is\nnot really \"doing TFO\"."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached by sending crafted TCP/MPTCP segments to a listening socket over the network (ip4/ip6 receive -\u003e tcp_conn_request/tcp_rcv_state_process -\u003e subflow_prep_synack or mptcp_incoming_options -\u003e check_fully_established); per kernel CNA guidance, net stack packet-handling paths are Network.\nAC:L - In the intended passive-MPTFO deployment (MPTCP listener with net.ipv4.tcp_fastopen server bit set), the attacker controls obtaining a valid TFO cookie and then sending a data-less SYN followed by an out-of-order MPC_ACK to deterministically hit the stale is_mptfo path in check_fully_established().\nPR:N - Exploitation requires only unauthenticated inbound TCP connections to an MPTCP listener; the attacker obtains the TFO cookie from their own prior connection and needs no local account, capability, or namespace privileges on the target host.\nUI:N - No victim interaction is required beyond the server normally accepting TCP connections; the attacker programmatically sends the SYN and follow-up MPC_ACK packets without anyone opening files, clicking links, or performing other actions.\nS:U - Impact is confined to kernel MPTCP/TCP connection state on the target host and does not cross VM, container, IOMMU, or other security boundaries; it is not a sandbox or guest-to-host escape.\nC:L - Premature fully_established with attacker-chosen MPTCP keys desynchronizes handshake and DSS/map state, enabling misdelivery or premature exposure of connection-level data/metadata to the remote peer before normal MP_CAPABLE validation completes.\nI:H - Stale is_mptfo lets an out-of-order MPC_ACK force __mptcp_subflow_fully_established(), writing attacker-controlled sndr_key/ack_seq into msk and subflow crypto state and corrupting subsequent DSS/ACK handling on the server multipath socket.\nA:H - Data-less passive-TFO SYNs hit WARN_ON_ONCE(!skb) on every trigger, and the resulting inconsistent is_mptfo/fully_established state can cause repeatable kernel WARN/oops (panic_on_warn panic) plus connection reset storms against internet-facing MPTCP servers."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:02:06.112Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f75f174edc865738522e514d042cf5627f084859"
        },
        {
          "url": "https://git.kernel.org/stable/c/fca7e444c04689fe4cc6b56f2725f804a4bb1ef9"
        },
        {
          "url": "https://git.kernel.org/stable/c/75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/72b4a0c51a4b550d40301d60a366b429b8c8e78d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e00b63056fb4f261455b3e5df5268a1f8ce47a87"
        }
      ],
      "title": "mptcp: fastopen: only mark MPTFO subflows with SYN data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80585",
    "datePublished": "2026-08-26T14:37:40.901Z",
    "dateReserved": "2026-08-26T14:34:25.769Z",
    "dateUpdated": "2026-10-16T19:26:28.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/pnfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f52188118d319b47d49ee91a897f6afda4879c59",
              "status": "affected",
              "version": "fb700ef026766c95578aafc0db1b208946e7ad4f",
              "versionType": "git"
            },
            {
              "lessThan": "ad3e41855325e55623276660ef20fbc3b8ba087f",
              "status": "affected",
              "version": "fb700ef026766c95578aafc0db1b208946e7ad4f",
              "versionType": "git"
            },
            {
              "lessThan": "a080bb69d30f11738d753a60d1eb733d627c2093",
              "status": "affected",
              "version": "fb700ef026766c95578aafc0db1b208946e7ad4f",
              "versionType": "git"
            },
            {
              "lessThan": "7c5b0e813efd9124760d5fd1bfc6b229f03fb1a2",
              "status": "affected",
              "version": "fb700ef026766c95578aafc0db1b208946e7ad4f",
              "versionType": "git"
            },
            {
              "lessThan": "36e3f13bf0728f4ce11ee8904cec82a783222f62",
              "status": "affected",
              "version": "fb700ef026766c95578aafc0db1b208946e7ad4f",
              "versionType": "git"
            },
            {
              "lessThan": "32ac1b0b7f1cfa0d1a1faf9c72f4154046101070",
              "status": "affected",
              "version": "fb700ef026766c95578aafc0db1b208946e7ad4f",
              "versionType": "git"
            },
            {
              "lessThan": "ee5a386cfe60f3f8286de16a9db8e1a08f0bc124",
              "status": "affected",
              "version": "fb700ef026766c95578aafc0db1b208946e7ad4f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/pnfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path\n\nWhen the server returns a new layout stateid while a valid one is still\nheld, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on\nthe on-stack free_me list and jumps to out_forget. Segments whose\nreference count drops to zero are unlinked from lo-\u003eplh_segs and moved\nto free_me by mark_lseg_invalid(); for an idle cached segment the layout\nheader holds the only reference, so this happens on the first decrement.\n\nout_forget never drains free_me -- only the success path calls\npnfs_free_lseg_list().\n\nCommit 814b84971388 (\"pNFS/NFSv4: Fix a layout segment leak in\npnfs_layout_process()\") added the drain; commit 08bd8dbe8882\n(\"pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()\")\nremoved it while switching the destination to lo-\u003eplh_return_segs, which\nis drained elsewhere. Commit fb700ef02676 (\"NFSv4.1: Simplify layout\nreturn in pnfs_layout_process()\") switched the destination back to\nfree_me without restoring the drain.\n\nRestore the pnfs_free_lseg_list() call."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:51:23.214Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f52188118d319b47d49ee91a897f6afda4879c59"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad3e41855325e55623276660ef20fbc3b8ba087f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a080bb69d30f11738d753a60d1eb733d627c2093"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c5b0e813efd9124760d5fd1bfc6b229f03fb1a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/36e3f13bf0728f4ce11ee8904cec82a783222f62"
        },
        {
          "url": "https://git.kernel.org/stable/c/32ac1b0b7f1cfa0d1a1faf9c72f4154046101070"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee5a386cfe60f3f8286de16a9db8e1a08f0bc124"
        }
      ],
      "title": "NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89710",
    "datePublished": "2026-09-11T19:46:25.534Z",
    "dateReserved": "2026-09-11T19:38:34.751Z",
    "dateUpdated": "2026-10-19T08:51:23.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80580",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:17:49.806822Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:28.187Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbsysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "873a1aa15c313263f2e18b38cf525623cc4fabf6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d15d51fb26e830af58f3f21964f1c09c239077ea",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbsysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: bound mode sysfs output to the sysfs buffer\n\nmode_string() uses snprintf() which can return a value larger than the\nremaining buffer space. show_modes() accumulates the return value into i\nwithout checking whether i has reached PAGE_SIZE, causing the offset to\nadvance past the sysfs buffer if the modelist is long enough.\n\nAdd a size parameter to mode_string() and use scnprintf() to return\nonly the bytes actually written. Add an early return when offset\nalready exceeds the buffer. In show_modes(), stop accumulating once\nthe buffer is full."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only by a local read(2) on /sys/class/graphics/fbN/modes, which flows through sysfs/kernfs into show_modes(); there is no network, adjacent-network, or physical-device packet path to this framebuffer sysfs handler.\nAC:L - Once the framebuffer modelist is long enough to fill PAGE_SIZE, snprintf\u0027s oversized return value deterministically pushes the offset past the buffer and subsequent writes use a wrapped huge size; an attacker can also grow the list via repeated FBIOPUT_VSCREENINFO or a privileged store_modes write.\nPR:L - The modes sysfs attribute is DEVICE_ATTR_RW with mode 0644, so any unprivileged local user can open and read it without capabilities; only populating an unusually long modelist may require root or membership in the video group for /dev/fb0 ioctl access.\nUI:N - Exploitation requires only the attacker reading the modes sysfs file themselves; no separate victim action such as mounting a filesystem or opening a file is needed.\nS:U - The overflow corrupts kernel heap memory within the same OS security boundary and can enable local privilege escalation, but it does not cross VM, IOMMU, or sandbox isolation boundaries.\nC:H - Writing past the PAGE_SIZE sysfs seq_file buffer is an out-of-bounds kernel heap write; once the offset exceeds PAGE_SIZE the remaining-length underflow gives snprintf an enormous size, corrupting adjacent kmalloc objects and enabling information disclosure.\nI:H - The unchecked offset advance causes repeated out-of-bounds writes into kernel heap memory beyond the sysfs buffer, a memory-corruption primitive that can be leveraged for arbitrary kernel writes or control-flow hijacking.\nA:H - Corrupting heap objects adjacent to the sysfs read buffer can trigger immediate kernel oops/panic or later crashes when those objects are used, satisfying High availability impact for kernel memory corruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:02:01.683Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/873a1aa15c313263f2e18b38cf525623cc4fabf6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d15d51fb26e830af58f3f21964f1c09c239077ea"
        }
      ],
      "title": "fbdev: bound mode sysfs output to the sysfs buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80580",
    "datePublished": "2026-08-26T14:37:37.917Z",
    "dateReserved": "2026-08-26T14:34:25.769Z",
    "dateUpdated": "2026-10-16T19:26:28.187Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/sctp/sctp.h",
            "net/sctp/diag.c",
            "net/sctp/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f98c294a9369b6fe89e652c06357ee594be4dfa2",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "8b38e3dcfde3077dbc03eb8ef88e03cc19f70b8a",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "ec3c2d59a192e17e1014ba71afc368ba162ecac3",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "722576aba0a6d9423714550b1c03239b0f0def77",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "abe7f8828e6ac8be858870c2bf836258844f97d5",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "207bb4ce8fe7de961ae7bb33569ad2cd61f44954",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "f09a245f33e567b604efa1960b7a2d25dd9c8713",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            },
            {
              "lessThan": "7d8297e26b4e20b5d1c3c3fe51fe81a1c7fbc823",
              "status": "affected",
              "version": "8f840e47f190cbe61a96945c13e9551048d42cef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/sctp/sctp.h",
            "net/sctp/diag.c",
            "net/sctp/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: hold socket lock when dumping endpoints in sctp_diag\n\nSCTP_DIAG endpoint dumping was traversing endpoint address lists without\nholding lock_sock(), while those lists could change concurrently via\nsocket operations (e.g., bindx changes). This creates a race where\nnla_reserve() counts addresses under RCU protection, but the subsequent\ncopy may see fewer entries, potentially leaking uninitialized memory to\nuserspace.\n\nFix this by:\n\n- Taking a reference on each endpoint during hash traversal\n- Moving socket operations (lock_sock()) outside read_lock_bh()\n- Serializing address list access during dump\n- Reworking sctp_for_each_endpoint() to support restart-based traversal\n  with (net, pos) tracking\n\nAlso:\n\n- Add WARN_ON_ONCE() for inconsistent address counts\n- Fix idiag_states filtering for LISTEN vs association cases\n- Skip dumping endpoints being freed (ep-\u003ebase.dead)\n- Move dump position tracking into iterator, removing cb-\u003eargs[4] and\n  its comment for sctp_ep_dump().,\n- Update the comment for cb-\u003eargs[4] and remove the comment for unused\n  cb-\u003eargs[5] for sctp_sock_dump().\n\nNote: traversal is restart-based and may re-scan buckets multiple times,\nbut this is acceptable due to small bucket sizes and required to support\nsleeping-safe callbacks.\n\nThis issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero\nDay Initiative."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:14:49.557Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f98c294a9369b6fe89e652c06357ee594be4dfa2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b38e3dcfde3077dbc03eb8ef88e03cc19f70b8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec3c2d59a192e17e1014ba71afc368ba162ecac3"
        },
        {
          "url": "https://git.kernel.org/stable/c/722576aba0a6d9423714550b1c03239b0f0def77"
        },
        {
          "url": "https://git.kernel.org/stable/c/abe7f8828e6ac8be858870c2bf836258844f97d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/207bb4ce8fe7de961ae7bb33569ad2cd61f44954"
        },
        {
          "url": "https://git.kernel.org/stable/c/f09a245f33e567b604efa1960b7a2d25dd9c8713"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d8297e26b4e20b5d1c3c3fe51fe81a1c7fbc823"
        }
      ],
      "title": "sctp: hold socket lock when dumping endpoints in sctp_diag",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72447",
    "datePublished": "2026-08-15T05:56:57.089Z",
    "dateReserved": "2026-08-09T03:40:39.931Z",
    "dateUpdated": "2026-08-17T05:14:49.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/igc/igc_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad6e0df267dc96edb7de1fa0a2fb2a70645bff86",
              "status": "affected",
              "version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
              "versionType": "git"
            },
            {
              "lessThan": "605585a8d89aaeb0122e9016fdaa92376897a705",
              "status": "affected",
              "version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
              "versionType": "git"
            },
            {
              "lessThan": "a0f16c337691813f8d8f014c01fff5a368e08898",
              "status": "affected",
              "version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
              "versionType": "git"
            },
            {
              "lessThan": "f929a6fe5b7ae1e72d2c6d18cd69ab90dcf689d2",
              "status": "affected",
              "version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
              "versionType": "git"
            },
            {
              "lessThan": "3b5aee6fcbf6b58112d40d19c8d31fa3f78ee668",
              "status": "affected",
              "version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
              "versionType": "git"
            },
            {
              "lessThan": "9a2b637aef4e515c2179774888441d00e8a5ae95",
              "status": "affected",
              "version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
              "versionType": "git"
            },
            {
              "lessThan": "5ffab5b9589c50e4cfc0cf36ffd76c89422d4019",
              "status": "affected",
              "version": "fc9df2a0b520d7d439ecf464794d53e91be74b93",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/igc/igc_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: remove napi_synchronize() in igc_down()\n\nWhen an AF_XDP zero-copy application is killed abruptly, the XSK pool is\ntorn down but NAPI keeps polling. igc_clean_rx_irq_zc() then returns the\nfull budget on every poll, so napi_complete_done() never clears\nNAPI_STATE_SCHED.\n\nigc_down() calls napi_synchronize() before napi_disable(), so it spins\nforever waiting for that bit and the interface never goes down. Drop the\nnapi_synchronize() and let napi_disable() do the job -- it sets\nNAPI_STATE_DISABLE, which forces the stuck poll to complete. Reorder it\nahead of igc_set_queue_napi() so the NAPI mapping is cleared only after\npolling has stopped, matching the recent igb fix b1e067240379."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T06:53:13.683Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad6e0df267dc96edb7de1fa0a2fb2a70645bff86"
        },
        {
          "url": "https://git.kernel.org/stable/c/605585a8d89aaeb0122e9016fdaa92376897a705"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0f16c337691813f8d8f014c01fff5a368e08898"
        },
        {
          "url": "https://git.kernel.org/stable/c/f929a6fe5b7ae1e72d2c6d18cd69ab90dcf689d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b5aee6fcbf6b58112d40d19c8d31fa3f78ee668"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a2b637aef4e515c2179774888441d00e8a5ae95"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ffab5b9589c50e4cfc0cf36ffd76c89422d4019"
        }
      ],
      "title": "igc: remove napi_synchronize() in igc_down()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80715",
    "datePublished": "2026-08-28T06:53:13.683Z",
    "dateReserved": "2026-08-26T14:34:25.788Z",
    "dateUpdated": "2026-08-28T06:53:13.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b45b91db41379ee5fb36c187d6d7c37b725cbe8e",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "62978cf6347972c04130e4e841ba404504d92b32",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "7568e9e717e7540bd05bcc007f5d76fcaff3cdff",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "bf98d7b0d5a99991e47e66cee4eb1d3fa514be97",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Prevent subbuf order change when resizing is disabled\n\nBecause ring_buffer_subbuf_order_set() frees buffer pages, we can\u0027t\nallow it when resizing is disabled. A non-consuming reader is at risk of\nuse-after-free (rb_advance_iter()).\n\nReturn -EBUSY on resize_disabled, matching ring_buffer_resize()\nbehaviour."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local tracefs operations: write() to buffer_subbuf_size_kb (buffer_subbuf_size_write) while a non-consuming ring_buffer_read_start() iterator is active from reading trace/per_cpu/cpuN/trace. No network, adjacent-radio, or physical-device path reaches ring_buffer_subbuf_order_set().\nAC:L - The attacker controls both sides: one thread holds trace open for read (sets resize_disabled via ring_buffer_read_start) while another writes buffer_subbuf_size_kb to free pages still referenced by iter-\u003ehead_page. rb_advance_iter()/rb_inc_iter then dereferences freed memory; the race is reliably retried.\nPR:L - tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC with no capability check. tracefs buffer_subbuf_size_kb and trace are mode 0640 and are routinely delegated via gid=/mode= to tracing-group members on Android/Perfetto, ChromeOS, and developer systems, matching prior CNA tracefs UAF scores (CVE-2024-50207, CVE-2025-38101).\nUI:N - Exploitation uses the attacker\u0027s own tracefs file descriptors and threads (open trace for read, write buffer_subbuf_size_kb). No separate victim mount, click, or configuration action is required beyond the attacker holding tracefs access.\nS:U - The use-after-free corrupts kernel ring-buffer heap pages and metadata within the same OS security authority. It enables local privilege escalation but does not cross VM, IOMMU, container, or hardware trust boundaries.\nC:H - ring_buffer_subbuf_order_set() frees buffer_page data pages while iterators retain head_page pointers; rb_iter_head_event() memcpy() and rb_inc_iter() read iter-\u003ehead_page-\u003epage after free_pages(), leaking recycled kernel heap contents to userspace through trace reads.\nI:H - Freed sub-buffer pages and buffer_page structures can be reused while iterators and splice paths still perform stores and list operations on them. This UAF heap corruption is exploitable for arbitrary kernel writes and control-flow hijack, not merely a crash.\nA:H - Concurrent page frees with active iterators corrupt ring-buffer lists and cause use-after-free dereferences in rb_advance_iter(), producing kernel oopses/panics. syzbot reported this failure mode and the attacker can retrigger it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:58.185Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b45b91db41379ee5fb36c187d6d7c37b725cbe8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/62978cf6347972c04130e4e841ba404504d92b32"
        },
        {
          "url": "https://git.kernel.org/stable/c/7568e9e717e7540bd05bcc007f5d76fcaff3cdff"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf98d7b0d5a99991e47e66cee4eb1d3fa514be97"
        }
      ],
      "title": "ring-buffer: Prevent subbuf order change when resizing is disabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74634",
    "datePublished": "2026-08-22T15:32:14.547Z",
    "dateReserved": "2026-08-15T05:44:03.922Z",
    "dateUpdated": "2026-08-25T05:40:58.185Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbsysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "26135631ed8e487bc6aef70cc41934e258d09bbe",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbsysfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.11",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: serialize mode sysfs access with lock_fb_info()\n\nshow_mode(), show_modes(), and store_mode() access fb_info-\u003emodelist\nand fb_info-\u003emode without holding lock_fb_info(). store_modes() takes\nlock_fb_info() while replacing the modelist and freeing the old one.\n\nA concurrent reader or writer can load a pointer to an old modelist\nentry before store_modes() frees it, then dereference freed memory or\nstore a stale freed pointer in fb_info-\u003emode.\n\nTake lock_fb_info() in show_mode(), show_modes(), and store_mode() to\nserialize with store_modes(). In show_mode(), copy the mode to the\nstack and format after dropping the lock. In store_mode(), split\nactivate() into a _locked variant to avoid double-locking, and hold\nthe locks for the modelist walk, mode conversion, activation, and\nfb_info-\u003emode assignment together."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T14:21:08.600Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/26135631ed8e487bc6aef70cc41934e258d09bbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/061db6b7a910b8378f3b2df64f8c0a3ddc6e85f2"
        }
      ],
      "title": "fbdev: serialize mode sysfs access with lock_fb_info()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80785",
    "datePublished": "2026-09-04T15:12:57.076Z",
    "dateReserved": "2026-08-26T14:34:25.793Z",
    "dateUpdated": "2026-09-07T14:21:08.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72045",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:50:38.118771Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-862",
                "description": "CWE-862 Missing Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:19:24.462Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "04c014e49b9f53d58a8f94adece8a0af3ae1b85c",
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "versionType": "git"
            },
            {
              "lessThan": "6967dd944be2a71eddab3a2ae1a1a4dd9e5f8eed",
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "versionType": "git"
            },
            {
              "lessThan": "e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11",
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "versionType": "git"
            },
            {
              "lessThan": "54535692bec9ef464adc714108eb19e49e38b5a2",
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "versionType": "git"
            },
            {
              "lessThan": "c73b8795b45f4ad5a95120d2e9b435ea4616e08e",
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "versionType": "git"
            },
            {
              "lessThan": "59da37fee81a8d76079313348ca13c5bc90dd6ae",
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "versionType": "git"
            },
            {
              "lessThan": "8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915",
              "status": "affected",
              "version": "893ae97214c385be02f8ec097298cc48c7f0d905",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF\n\nrvu_mbox_handler_lmtst_tbl_setup() uses req-\u003ebase_pcifunc as a direct\nindex into the LMT map table to read another function\u0027s LMTLINE\nphysical base address and copy it into the caller\u0027s own LMT map table\nentry. The mailbox dispatcher authenticates req-\u003ehdr.pcifunc from the\nIRQ source, but req-\u003ebase_pcifunc is a separate payload field and is\nnot sanitized.\n\nReject the request with -EPERM when a VF caller\u0027s base_pcifunc is not a\nvalid function under its own PF. is_pf_func_valid() bounds the FUNC field\nto the PF\u0027s configured VF count, keeping the computed index inside the\ncaller\u0027s own slot block."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local control of an assigned Marvell CN10K/OCTEONTX2 SR-IOV VF and sending a crafted LMTST_TBL_SETUP mailbox message over the PCI VF\u2192AF control path (rvu_afvf_mbox_handler\u2192rvu_mbox_handler_lmtst_tbl_setup); it is not reachable via remote packet delivery.\nAC:L - Once a VF is assigned, the attacker fully controls the unsanitized base_pcifunc payload field and can trigger the flaw deterministically with a single mailbox message; no race, special memory layout, or victim timing is required.\nPR:L - Only control of an assigned VF is needed (typical cloud/tenant VM or container with SR-IOV passthrough, or guest root/CAP_NET_ADMIN managing the VF); host init-namespace root is not required and unprivileged host users cannot reach this hardware mailbox without the VF device.\nUI:N - No victim user action is required; the attacker directly sends the malicious LMTST_TBL_SETUP mailbox request from their VF to the AF handler.\nS:C - A malicious VF tenant can retarget hardware LMTLINE stores to another PF/VF\u0027s memory region, crossing the SR-IOV tenant isolation boundary and enabling guest-to-host or guest-to-guest impact on shared CN10K NIC deployments.\nC:H - Redirecting a VF\u0027s LMT map entry to another function\u0027s LMTLINE region lets the attacker read victim in-flight packet/crypto submission metadata and buffer pointers from shared hardware LMT memory, constituting cross-tenant information disclosure beyond the attacker\u0027s scope.\nI:H - After the map-table redirect, the attacker\u0027s LMTST flush operations (packet TX SQE submission, NPA aura free, CPT enqueue) are hardware-written into the victim\u0027s LMTLINE physical pages, enabling arbitrary cross-tenant memory corruption and potential control of victim I/O submission state.\nA:H - Corrupting another PF/VF\u0027s LMTLINE submission buffers can crash or hang the victim\u0027s networking/crypto stack (guest kernel oops/panic or persistent TX failure) and the attack can be repeated on demand by resending mailbox requests."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:33.156Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/04c014e49b9f53d58a8f94adece8a0af3ae1b85c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6967dd944be2a71eddab3a2ae1a1a4dd9e5f8eed"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9c5b03208507dd6d58b0c23a2c60b5c2f4c1b11"
        },
        {
          "url": "https://git.kernel.org/stable/c/54535692bec9ef464adc714108eb19e49e38b5a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c73b8795b45f4ad5a95120d2e9b435ea4616e08e"
        },
        {
          "url": "https://git.kernel.org/stable/c/59da37fee81a8d76079313348ca13c5bc90dd6ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cdcf3d2caacdee7ddd363705fb4d93b0c1a0915"
        }
      ],
      "title": "octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72045",
    "datePublished": "2026-08-15T05:52:04.038Z",
    "dateReserved": "2026-08-09T03:40:39.902Z",
    "dateUpdated": "2026-10-19T21:19:24.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80731",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:21:14.341917Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:36.020Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netdevice.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "53fd7f912c0877647d6a1e1877f5ea8535ee0b4a",
              "status": "affected",
              "version": "b5518429e70cd783b8ca52335456172c1a0589f6",
              "versionType": "git"
            },
            {
              "lessThan": "fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6",
              "status": "affected",
              "version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
              "versionType": "git"
            },
            {
              "lessThan": "8fc9816404166a90ed8d544dc52482fafffb6d9f",
              "status": "affected",
              "version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
              "versionType": "git"
            },
            {
              "lessThan": "b0f92a5731dc82556a9ae005cc35f71ab136307b",
              "status": "affected",
              "version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
              "versionType": "git"
            },
            {
              "lessThan": "99df6b7a713f96eda206680d100b76e15f9d9b69",
              "status": "affected",
              "version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
              "versionType": "git"
            },
            {
              "lessThan": "74e035f07f53feca09e2352e77fccb09cad5e208",
              "status": "affected",
              "version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
              "versionType": "git"
            },
            {
              "lessThan": "dbb30dc943a93e083f1e531bfdc6779e57de40d0",
              "status": "affected",
              "version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
              "versionType": "git"
            },
            {
              "lessThan": "fc902f52a02298c7432b2334c0c82a2885a1a8b6",
              "status": "affected",
              "version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
              "versionType": "git"
            },
            {
              "lessThan": "3b9a324e646d3657a8d9806dfbfe4f3e4066e882",
              "status": "affected",
              "version": "2793a23aacbd754dbbb5cb75093deb7e4103bace",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f58a6c08ebdfa978178bbca78c2ba744a2665912",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1df16498dfd0d5a129bdf2982d9a08df73e8923d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b8d278aa4de9335682bbd4a3bb619af015c859e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6804052fa9d86e9a512c88b24a5debbfc1a490fc",
              "versionType": "git"
            },
            {
              "lessThan": "3.2.81",
              "status": "affected",
              "version": "3.2.80",
              "versionType": "semver"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.36",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.28",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.8",
              "versionType": "semver"
            },
            {
              "lessThan": "4.6",
              "status": "affected",
              "version": "4.5.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netdevice.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.2.*",
              "status": "unaffected",
              "version": "3.2.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.81",
                  "versionStartIncluding": "3.2.80",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: remove CAP_SYS_RAWIO zero-padding in dev_validate_header\n\ndev_validate_header() reads dev-\u003ehard_header_len directly when\nzero-padding short link layer headers for CAP_SYS_RAWIO holders:\n\n    if (capable(CAP_SYS_RAWIO)) {\n        memset(ll_header + len, 0, dev-\u003ehard_header_len - len);\n        return true;\n    }\n\nPacket send paths call dev_validate_header() on skbs whose headroom was\nallocated from an earlier hard_header_len read. If the device is\nreconfigured so that dev-\u003ehard_header_len increases before validation,\nthe memset writes past the reserved buffer, an out-of-bounds write.\n\nThis out-of-bounds write is masked in some SOCK_RAW paths today because\nthe same concurrent increase can first make skb_push() exceed the\nreserved headroom and trigger skb_under_panic(). Remove the zero-padding\nbranch before making those hard_header_len reads consistent, so the\nsnapshot fixes do not turn a loud panic into a silent overwrite.\n\nThis path is only reached for variable length L2 protocols, where\nlen \u003c hard_header_len but len \u003e= min_header_len. No remaining in-tree\nvariable length L2 protocol implements header_ops-\u003evalidate, and the\nCAP_SYS_RAWIO bypass that zero-pads and accepts short headers has no\nreal value beyond allowing testing of intentionally malformed input.\n\nDrop the CAP_SYS_RAWIO branch. The remaining reads of\ndev-\u003ehard_header_len in dev_validate_header() are comparisons only and\nhave no memory safety impact."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local sendmsg() on a PF_PACKET SOCK_RAW socket; dev_validate_header() is only reached from af_packet transmit paths (packet_snd, packet_sendmsg_spkt, tpacket_fill_skb), not from remote packet receive.\nAC:L - The attacker can reliably win the TOCTOU race by concurrently sending PF_PACKET frames while changing netdev hard_header_len (e.g., PPP channel attach or bonding slave updates via rtnetlink), controlling both allocation and validation sides.\nPR:L - PF_PACKET creation requires CAP_NET_RAW and the memset bypass requires CAP_SYS_RAWIO; both are granted to user-namespace root (CAP_FULL_SET via unshare -Urn), so a basic unprivileged local user can obtain the needed privileges without init-namespace root.\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through socket creation, concurrent device reconfiguration, and crafted sendmsg() calls.\nS:U - Impact is kernel heap memory corruption and local privilege escalation within the same kernel security domain, not a VM escape, IOMMU bypass, or other cross-authority boundary violation.\nC:H - The bug is an out-of-bounds write via memset() past skb link-layer headroom when hard_header_len grows between allocation and validation; such heap corruption can be groomed into arbitrary kernel memory read primitives.\nI:H - Writing past the reserved skb headroom corrupts adjacent kernel heap objects and is a standard exploitable primitive for arbitrary kernel writes, control-flow hijacking, and privilege escalation.\nA:H - The out-of-bounds memset can corrupt critical kernel structures and trigger oops/panic; the commit notes this can silently overwrite memory where other SOCK_RAW paths would have panicked via skb_under_panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-04T04:58:17.510Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/53fd7f912c0877647d6a1e1877f5ea8535ee0b4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa6d98dd925e72fc028b26a0cbbff9d2f0601ff6"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fc9816404166a90ed8d544dc52482fafffb6d9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0f92a5731dc82556a9ae005cc35f71ab136307b"
        },
        {
          "url": "https://git.kernel.org/stable/c/99df6b7a713f96eda206680d100b76e15f9d9b69"
        },
        {
          "url": "https://git.kernel.org/stable/c/74e035f07f53feca09e2352e77fccb09cad5e208"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbb30dc943a93e083f1e531bfdc6779e57de40d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc902f52a02298c7432b2334c0c82a2885a1a8b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b9a324e646d3657a8d9806dfbfe4f3e4066e882"
        }
      ],
      "title": "net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80731",
    "datePublished": "2026-09-03T08:21:48.924Z",
    "dateReserved": "2026-08-26T14:34:25.789Z",
    "dateUpdated": "2026-10-16T19:26:36.020Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca428e597f12b278bf158356e34641e6386cfa82",
              "status": "affected",
              "version": "6898d1c661d79f4707d8ba82991b2195822780ca",
              "versionType": "git"
            },
            {
              "lessThan": "59d60e04afd012f07e996d2e34cb90a4ec6f5cff",
              "status": "affected",
              "version": "6898d1c661d79f4707d8ba82991b2195822780ca",
              "versionType": "git"
            },
            {
              "lessThan": "2f946e7839f677fa14574b6babad14b37ae0bbbe",
              "status": "affected",
              "version": "6898d1c661d79f4707d8ba82991b2195822780ca",
              "versionType": "git"
            },
            {
              "lessThan": "4be7810ba70291abb2f68cc6db0ae1b93ee9c76a",
              "status": "affected",
              "version": "6898d1c661d79f4707d8ba82991b2195822780ca",
              "versionType": "git"
            },
            {
              "lessThan": "7babc25d8dd5b7642920fbc0737cfd1469e7025b",
              "status": "affected",
              "version": "6898d1c661d79f4707d8ba82991b2195822780ca",
              "versionType": "git"
            },
            {
              "lessThan": "4664368b9bd9d5d79ebad24056b98c34b9fed20f",
              "status": "affected",
              "version": "6898d1c661d79f4707d8ba82991b2195822780ca",
              "versionType": "git"
            },
            {
              "lessThan": "e37cdd75f8d61c1123d324ae5667ac3da562290e",
              "status": "affected",
              "version": "6898d1c661d79f4707d8ba82991b2195822780ca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Drain RCU callbacks during module teardown\n\ndevx_free_subscription() can remain queued after the last DevX event file\ndrops its module reference or an auxiliary driver detaches its devices.\nmlx5_ib can then unload before the callback runs.\n\nRegistration error unwind has the same risk because driver registration\ncan attach existing devices before failing. Wait after all drivers have\nstopped."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:05:41.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca428e597f12b278bf158356e34641e6386cfa82"
        },
        {
          "url": "https://git.kernel.org/stable/c/59d60e04afd012f07e996d2e34cb90a4ec6f5cff"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f946e7839f677fa14574b6babad14b37ae0bbbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/4be7810ba70291abb2f68cc6db0ae1b93ee9c76a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7babc25d8dd5b7642920fbc0737cfd1469e7025b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4664368b9bd9d5d79ebad24056b98c34b9fed20f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e37cdd75f8d61c1123d324ae5667ac3da562290e"
        }
      ],
      "title": "RDMA/mlx5: Drain RCU callbacks during module teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93109",
    "datePublished": "2026-09-17T16:11:19.135Z",
    "dateReserved": "2026-09-17T16:02:15.085Z",
    "dateUpdated": "2026-10-19T09:05:41.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89580",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:24:29.219775Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:44.895Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/stackmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "719e69421de28829c72bf8a2722ab48a1c5a59ad",
              "status": "affected",
              "version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
              "versionType": "git"
            },
            {
              "lessThan": "8c5ba022f2085ea42d011497a6e92e527d123b9b",
              "status": "affected",
              "version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
              "versionType": "git"
            },
            {
              "lessThan": "dbfecc8a6631c0d3626c14ba1f1a485a4498445a",
              "status": "affected",
              "version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
              "versionType": "git"
            },
            {
              "lessThan": "9a23747909fcae707990c8466c381a0e7acfaa4e",
              "status": "affected",
              "version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
              "versionType": "git"
            },
            {
              "lessThan": "b1a47b2708d4e95dbd23aee2ec83752190897b3f",
              "status": "affected",
              "version": "c195651e565ae7f41a68acb7d4aa7390ad215de1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/stackmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable preemption in __bpf_get_stack\n\nget_perf_callchain() returns a per-CPU perf_callchain_entry buffer and\nreleases its recursion slot via put_callchain_entry() before returning,\nso nothing keeps the entry reserved while __bpf_get_stack() consumes\nit below.\n\nA preemptible BPF program (e.g. a non-sleepable raw tracepoint program\non a PREEMPT kernel, which runs under migrate_disable() but not\npreempt_disable()) can be scheduled out between obtaining the entry\nand the copy. Another task scheduled on the same CPU then reuses the\nsame per-CPU buffer and overwrites trace-\u003enr with a larger value.\ncopy_len is then computed from the inflated trace-\u003enr and can exceed\nthe caller\u0027s buffer, causing an out-of-bounds write in the memcpy()\nand in the build_id path.\n\nThe rcu_read_lock() taken here alone does not prevent this. It is\nonly taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does\nnot disable preemption; it merely keeps perf\u0027s callchain buffer array\nalive (freed via call_rcu()) and does nothing to stop another task\nfrom reusing the entry.\n\nDisable preemption around obtaining the callchain entry and copying\nit into the caller\u0027s buffer, so the entry cannot be reused underneath\nus and trace-\u003enr stays bounded by max_depth. Build ID resolution may\nfault and is therefore deferred until after preemption is re-enabled;\nby then the instruction pointers have already been copied into buf,\nso it operates only on that private copy. Note, preempt_disable() also\nsubsumes the buffer-lifetime guarantee the rcu_read_lock() provided,\nsince a preempt-disabled section is an RCU read-side critical section\nfor the callchain buffers\u0027 call_rcu() reclaim.\n\n\n[ changed Fixes: commit ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in __bpf_get_stack(), reached only from bpf_get_stack/bpf_get_task_stack helpers in locally loaded tracing BPF (kprobe, tracepoint, raw_tp, perf_event, tracing) via bpf(2); kernel CNA guidance classifies BPF as Local, not a network path.\nAC:L - The attacker controls both sides of the race: a preemptible tracing program with a small bpf_get_stack buffer and a same-CPU helper/perf callchain with larger max_depth that reuses the per-CPU entry after put_callchain_entry(); pinning and retries make the window reliably hittable on PREEMPT kernels (e.g. Android).\nPR:L - Loading and attaching the required tracing programs needs CAP_BPF and CAP_PERFMON at bpf_prog_load(); per kernel CNA guidance these are Low because BPF tokens and user namespaces can delegate them to non-init-namespace users, not only real root.\nUI:N - The attacker loads their own BPF program, attaches it, and invokes the helper through their own syscalls or pinned threads; no victim mount, file open, or other user action is required.\nS:U - The out-of-bounds write corrupts kernel stack or slab inside the same host kernel security authority, enabling local privilege escalation; it does not cross a VM, IOMMU, or other distinct trust boundary.\nC:H - Inflated trace-\u003enr drives memcpy/build-id copies of kernel instruction pointers past the caller buffer (BPF stack or map value), which is kernel memory corruption that can be turned into an arbitrary read primitive.\nI:H - copy_len is taken from the reused per-CPU trace-\u003enr with no remaining size cap, so the memcpy or bpf_stack_build_id loop is an attacker-sized kernel OOB write (up to PERF_MAX_STACK_DEPTH frames) that can smash stack/heap and hijack control flow.\nA:H - The same unbounded kernel write past a small helper buffer causes a kernel oops or panic even when not fully weaponized, matching CNA guidance that any kernel crash or memory-corrupting OOB write is Availability High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:47:57.787Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/719e69421de28829c72bf8a2722ab48a1c5a59ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c5ba022f2085ea42d011497a6e92e527d123b9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbfecc8a6631c0d3626c14ba1f1a485a4498445a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a23747909fcae707990c8466c381a0e7acfaa4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1a47b2708d4e95dbd23aee2ec83752190897b3f"
        }
      ],
      "title": "bpf: Disable preemption in __bpf_get_stack",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89580",
    "datePublished": "2026-09-11T19:44:46.846Z",
    "dateReserved": "2026-09-11T19:38:34.728Z",
    "dateUpdated": "2026-10-21T12:47:57.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8a496aaa3da6e8d545896c2370c7e617cc931ae2",
              "status": "affected",
              "version": "8e7b58c27b3c567316a51079b375b846f9223bba",
              "versionType": "git"
            },
            {
              "lessThan": "6fcb0b745a0b80df62eae4a93ce52a2d061f4ac2",
              "status": "affected",
              "version": "8e7b58c27b3c567316a51079b375b846f9223bba",
              "versionType": "git"
            },
            {
              "lessThan": "bf242baf58de03467f226c8e29554c9495dca7fc",
              "status": "affected",
              "version": "8e7b58c27b3c567316a51079b375b846f9223bba",
              "versionType": "git"
            },
            {
              "lessThan": "24974bd0da1b47fd56c975533ead50abf754e74d",
              "status": "affected",
              "version": "8e7b58c27b3c567316a51079b375b846f9223bba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Hold cpu_buffer::lock when resizing a subbuf\n\nBecause, ring_buffer_subbuf_order_set() can clear cpu_buffer-\u003efree_page,\nhold cpu_buffer-\u003elock to prevent races with\nring_buffer_alloc_read_page() and ring_buffer_free_read_page()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local tracefs syscalls: write() to buffer_subbuf_size_kb (ring_buffer_subbuf_order_set) racing with read()/close() on per_cpu/*/trace_pipe_raw (ring_buffer_alloc_read_page and ring_buffer_free_read_page). No network, adjacent-radio, or physical path reaches this free_page steal.\nAC:L - The attacker controls both sides of the race: one thread toggles buffer_subbuf_size_kb to copy and NULL cpu_buffer-\u003efree_page without cpu_buffer-\u003elock, while another reads or closes trace_pipe_raw, which takes or caches that page under the lock. Success does not depend on an uninfluenced victim state.\nPR:L - tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC with no capable() check. buffer_subbuf_size_kb and trace_pipe_raw are mode 0640 and are routinely delegated via tracefs gid=/mode= to tracing-group members on Android/Perfetto, ChromeOS, and developer kernels, matching prior CNA tracefs UAF scores.\nUI:N - Exploitation uses the attacker\u2019s own tracefs file descriptors and threads (open/read/close trace_pipe_raw while writing buffer_subbuf_size_kb). No separate victim mount, click, or configuration action is required.\nS:U - The use-after-free and double-free corrupt kernel ring-buffer pages and metadata within the same OS security authority. This enables local privilege escalation but does not cross VM, IOMMU, container-hypervisor, or hardware trust boundaries.\nC:H - ring_buffer_subbuf_order_set() can free the cached free_page after alloc_read_page has already claimed it, including after ring_buffer_read_page swaps it into the live reader page. Recycled heap contents are then copied to userspace via tracing_buffers_read, giving a high-impact disclosure primitive.\nI:H - The same race double-frees the page or installs a freed page as the live ring-buffer reader page, so later tracing writes and free_read_page hit attacker-reclaimable heap. This UAF/double-free is exploitable for arbitrary kernel writes and control-flow hijack, not merely a crash.\nA:H - Concurrent free of a still-in-use reader or spare page corrupts ring-buffer lists and causes kernel oops/panic on UAF or double-free. The attacker can retrigger the race at will through repeated subbuf resizes and raw-buffer reads."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:47:52.839Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8a496aaa3da6e8d545896c2370c7e617cc931ae2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fcb0b745a0b80df62eae4a93ce52a2d061f4ac2"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf242baf58de03467f226c8e29554c9495dca7fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/24974bd0da1b47fd56c975533ead50abf754e74d"
        }
      ],
      "title": "ring-buffer: Hold cpu_buffer::lock when resizing a subbuf",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89501",
    "datePublished": "2026-09-11T19:43:50.063Z",
    "dateReserved": "2026-09-11T19:38:34.715Z",
    "dateUpdated": "2026-10-19T08:47:52.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7cc974799fde846eda2d8f00ad4f8e1810eb0499",
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "versionType": "git"
            },
            {
              "lessThan": "8de1e23bd91fe3a6683e4bc574e2d6bcb0eef920",
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "versionType": "git"
            },
            {
              "lessThan": "72be1fd5d256dde748c0905c5e1749a119cad5bd",
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "versionType": "git"
            },
            {
              "lessThan": "c622bbc212207d7c6bbd69dd88f0c3a3f5853d16",
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "versionType": "git"
            },
            {
              "lessThan": "eca54a092d5f7b497b458ff5a6f66d4f7bfb6674",
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "versionType": "git"
            },
            {
              "lessThan": "9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5",
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "versionType": "git"
            },
            {
              "lessThan": "513f7b16ed0cffae9348151c72bed17c7073096f",
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "versionType": "git"
            },
            {
              "lessThan": "5d4d985957434867bbe85e4fa5e638f3e48ad522",
              "status": "affected",
              "version": "a425b6e1c69ba907b72b737a4d44f8cfbc43ce3c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/huawei/hinic/hinic_hw_mbox.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hinic: fix mailbox segment buffer overflow\n\ncheck_mbox_seq_id_and_seg_len() validates that seq_id does not\nexceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed\nMBOX_SEG_LEN (48).  However, this allows the last segment\n(seq_id=42) to carry a full 48-byte payload, writing to offset\n42*48=2016 for 48 bytes (ending at byte 2064).  The receive\nbuffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a\n16-byte heap buffer overflow.\n\nThe hinic3 driver already handles this correctly by defining\nMBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it\nexceeds the remaining buffer space.  Apply the same fix to the\nhinic driver."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed input is a mailbox header (SEQID/SEG_LEN) and 48-byte body that a VF driver writes into its own mailbox registers. The hardware delivers it to the PF\u0027s hinic_mbox_func_aeqe_handler() -\u003e recv_mbox_handler(). The attacker is code running in a guest that owns an SR-IOV VF (or a local driver), not a remote network peer, so this is local access.\nAC:L - The attacker sends segments seq_id 0..42 in order, each with seg_len=48. check_mbox_seq_id_and_seg_len() accepts all of them, and the memcpy at offset 42*48 overflows every time. The only setup is a VF assigned to the attacker\u0027s VM, which is the standard SR-IOV passthrough deployment. Nothing depends on timing or state outside the attacker\u0027s control.\nPR:L - Writing raw mailbox headers needs kernel control of the VF, i.e. root inside the guest. A VM tenant always has that, and it gives no privilege on the host whose PF driver is corrupted. The random id checked by check_vf_mbox_random_id() is given to every genuine VF, so it does not stop a hostile VF driver.\nUI:N - The PF host processes the mailbox message on its own from the AEQ handler. Nobody on the host has to do anything.\nS:C - The bug is in a guest-controlled VF\u0027s messages, but the overflow corrupts the host kernel heap in the PF driver (recv_mbox-\u003embox, kzalloc(2048)). That crosses the guest-to-host boundary, like a VM escape.\nC:H - Overwriting the first 16 bytes of the neighbouring kmalloc-2048 object with attacker-chosen data can corrupt pointers or length fields in that object. That is a normal route to reading arbitrary host kernel memory.\nI:H - recv_mbox_handler() copies 16 attacker-chosen bytes from the mailbox body past the end of the 2048-byte receive buffer. This is a controlled heap out-of-bounds write in the host kernel, which can lead to control-flow hijack.\nA:H - The guest can repeat the corruption of the neighbouring host heap object at will, crashing or panicking the host kernel. That takes down every tenant on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:11:23.333Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7cc974799fde846eda2d8f00ad4f8e1810eb0499"
        },
        {
          "url": "https://git.kernel.org/stable/c/8de1e23bd91fe3a6683e4bc574e2d6bcb0eef920"
        },
        {
          "url": "https://git.kernel.org/stable/c/72be1fd5d256dde748c0905c5e1749a119cad5bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/c622bbc212207d7c6bbd69dd88f0c3a3f5853d16"
        },
        {
          "url": "https://git.kernel.org/stable/c/eca54a092d5f7b497b458ff5a6f66d4f7bfb6674"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f6ad383901d0cb1c8ea5f7f3160fabfe1540eb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/513f7b16ed0cffae9348151c72bed17c7073096f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d4d985957434867bbe85e4fa5e638f3e48ad522"
        }
      ],
      "title": "net: hinic: fix mailbox segment buffer overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97957",
    "datePublished": "2026-09-25T10:23:03.153Z",
    "dateReserved": "2026-09-25T10:18:58.205Z",
    "dateUpdated": "2026-10-19T09:11:23.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74538",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T18:59:35.716308Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:05:54.312Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0e830354c120954ccb9ca15880245912722c4031",
              "status": "affected",
              "version": "168d9bf9c7f01df71e6404cfff66d9c2a8e968fb",
              "versionType": "git"
            },
            {
              "lessThan": "e8e9cff6d80eeec28dec4cf7cc18662986945391",
              "status": "affected",
              "version": "168d9bf9c7f01df71e6404cfff66d9c2a8e968fb",
              "versionType": "git"
            },
            {
              "lessThan": "9bee7e476534f27e830658dad962d85da9edf6bf",
              "status": "affected",
              "version": "168d9bf9c7f01df71e6404cfff66d9c2a8e968fb",
              "versionType": "git"
            },
            {
              "lessThan": "4311fd6f429065a8ba208660360a895627a00cf3",
              "status": "affected",
              "version": "168d9bf9c7f01df71e6404cfff66d9c2a8e968fb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "489efc9ae36f164423f5fa7ace772a7ab8131cd8",
              "versionType": "git"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: lock sk in iso_connect_ind\n\nAccessing iso_pi(sk)-\u003econn requires lock_sock, which is not taken in the\n\"ev3\" part of iso_connect_ind.  It may also be NULL if socket has\ntransitioned away from the LISTEN/CONNECT states before locking.\n\nFix by adding lock/release. Recheck hcon is valid after lock acquire\nwhere needed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is hit in hci_le_per_adv_report_evt when the controller delivers HCI_EV_LE_PER_ADV_REPORT from in-range LE periodic advertising; this is the Bluetooth ISO broadcast-sink path on phones/headsets in public spaces, not a local-only syscall entry point.\nAC:L - Exploitation is a socket-lock race where the attacker can repeatedly deliver PA reports and concurrently close or tear down the matching ISO listen socket (or race automatic teardown), controlling both sides rather than depending on uncontrollable memory layout.\nPR:N - An adjacent Bluetooth attacker needs no account or capabilities on the victim; they only need the device to be using LE Audio broadcast reception while they transmit periodic advertising that drives the vulnerable HCI handler.\nUI:N - Once a broadcast sink socket is active, triggering the flaw does not require the victim to perform a specific one-off action at exploit time; the attacker can flood PA reports and race normal stack teardown without user prompts.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary; there is no VM escape, IOMMU bypass, or cross-authority scope change.\nC:H - Missing lock_sock allows TOCTOU/UAF on iso_pi(sk)-\u003econn and stale hci_conn pointers; per kernel guidance, this class of race on connection objects can expose freed kernel heap contents and enable information disclosure primitives.\nI:H - The handler memcpy()s attacker-controlled PA report bytes into hcon-\u003ele_per_adv_data without holding the socket lock, so a stale hcon can turn remote advertising data into an exploitable kernel heap write/control-flow corruption primitive.\nA:H - Concurrent NULL conn dereference or use of a detached hci_conn can oops/panic the kernel during PA reassembly, and the remote PA-report trigger can be repeated to cause sustained denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:45:51.636Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0e830354c120954ccb9ca15880245912722c4031"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8e9cff6d80eeec28dec4cf7cc18662986945391"
        },
        {
          "url": "https://git.kernel.org/stable/c/9bee7e476534f27e830658dad962d85da9edf6bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/4311fd6f429065a8ba208660360a895627a00cf3"
        }
      ],
      "title": "Bluetooth: ISO: lock sk in iso_connect_ind",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74538",
    "datePublished": "2026-08-15T12:27:50.271Z",
    "dateReserved": "2026-08-15T05:44:03.913Z",
    "dateUpdated": "2026-10-21T12:45:51.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/gss_rpc_xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4b5ebb4f91a6152a0f7b1253f701197e5710d4da",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            },
            {
              "lessThan": "f615b884310bf82d0014e3b5a92eb9aa88146685",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            },
            {
              "lessThan": "7a1d0501cbb962beba23377035d667bf3c1726ee",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            },
            {
              "lessThan": "9d94f046b23de0f77849ea69133063c949297e30",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            },
            {
              "lessThan": "2e4ce62385c1b8a887c5370af058ac7b52a8eaf9",
              "status": "affected",
              "version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/gss_rpc_xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: reject duplicate CREDS_VALUE options\n\ngssx_dec_option_array() walks the wire-supplied option array and, for\nevery entry whose name matches CREDS_VALUE, calls\ngssx_dec_linux_creds() on the same struct svc_cred. That helper\nunconditionally installs a fresh groups_alloc() result into\ncreds-\u003ecr_group_info without releasing whatever pointer was already\nthere:\n\n    for (i = 0; i \u003c count; i++) {\n        ... decode name ...\n        if (length == sizeof(CREDS_VALUE) \u0026\u0026\n            memcmp(p, CREDS_VALUE, sizeof(CREDS_VALUE)) == 0) {\n            err = gssx_dec_linux_creds(xdr, creds);\n            ...\n        }\n    }\n\nA reply that carries two CREDS_VALUE entries therefore overwrites\ncr_group_info on the second iteration and orphans the group_info\nallocated by the first call. The earlier free_creds path only\nreleases the last cr_group_info via free_svc_cred(), so the first\nallocation\u0027s refcount stays at one and its kvmalloc-backed storage\nis leaked. No in-tree caller of gssp_accept_sec_context_upcall()\nexpects more than one CREDS_VALUE per reply.\n\nFix by tracking whether a CREDS_VALUE option has already been\ndecoded and returning -EINVAL on any subsequent match, so the\nfree_creds path releases the single group_info that was installed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:47:46.957Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4b5ebb4f91a6152a0f7b1253f701197e5710d4da"
        },
        {
          "url": "https://git.kernel.org/stable/c/f615b884310bf82d0014e3b5a92eb9aa88146685"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a1d0501cbb962beba23377035d667bf3c1726ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d94f046b23de0f77849ea69133063c949297e30"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e4ce62385c1b8a887c5370af058ac7b52a8eaf9"
        }
      ],
      "title": "SUNRPC: reject duplicate CREDS_VALUE options",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89539",
    "datePublished": "2026-09-11T19:44:16.699Z",
    "dateReserved": "2026-09-11T19:38:34.721Z",
    "dateUpdated": "2026-10-21T12:47:46.957Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64003",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:35:05.354063Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:18:02.511Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "15fb19af49f2073ed77fad16aaabc648b0ca6800",
              "status": "affected",
              "version": "8b566edbdbfb5cde31a322c57932694ff48125ed",
              "versionType": "git"
            },
            {
              "lessThan": "d4dddfecdbb5467bef158d4e1486459808357fef",
              "status": "affected",
              "version": "8b566edbdbfb5cde31a322c57932694ff48125ed",
              "versionType": "git"
            },
            {
              "lessThan": "475f2b37a78f4c698967a7f14f325f04e24c9175",
              "status": "affected",
              "version": "8b566edbdbfb5cde31a322c57932694ff48125ed",
              "versionType": "git"
            },
            {
              "lessThan": "c740e13e7fe32d8e4d9a1699f65b8daf6709895a",
              "status": "affected",
              "version": "8b566edbdbfb5cde31a322c57932694ff48125ed",
              "versionType": "git"
            },
            {
              "lessThan": "7205b58702273baf21d6ba7992e6ba15852325f7",
              "status": "affected",
              "version": "8b566edbdbfb5cde31a322c57932694ff48125ed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues\n\nWhile a SCSI host is in a recovery state, scsi_mq_requeue_cmd() will not\nset the requeue list for a requeued command to be kicked in the future.\nThe expectation is a call to scsi_run_host_queues() will kick all SCSI\ndevices once the recovery state is cleared.\n\nHowever, scsi_run_host_queues() uses shost_for_each_device() which uses\nscsi_device_get() and so will ignore devices in a partially removed\nstate like SDEV_CANCEL. But these devices may also have requeued\nrequests, leaving their requests stuck from not being kicked and causing\nthe removal process of the device to hang.\n\nscsi_run_host_queues() needs to run against more devices than the macro\nshost_for_each_device() allows. Instead of using the too limiting\nscsi_device_get() state checks, only ignore devices in SDEV_DEL state or\nwhen unable to acquire a reference. Attempt to run the queues for all\nother devices when scsi_run_host_queues() is called."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the SCSI core midlayer reached after host error recovery; on enterprise servers using kernel iSCSI (iscsi_tcp/libiscsi), a remote storage target can inject SCSI failures and then drive session teardown that calls scsi_remove_target(), all over TCP without local access.\nAC:L - A malicious or compromised iSCSI peer controls both sides of the race by timing command failures, non-responsive task-management replies, and connection resets so SCSI EH recovery overlaps with device removal in SDEV_CANCEL.\nPR:N - Exploitation requires no privileges on the victim host; the attacker acts as the remote iSCSI endpoint on an already-established session and needs no CAP_SYS_ADMIN, sysfs writes, or ioctl access.\nUI:N - No end-user action is required during exploitation; recovery and removal are driven automatically by kernel SCSI/iSCSI error-handling once the session exists.\nS:U - Impact is a kernel hang during SCSI device teardown on the same host; it does not cross a VM, IOMMU, or sandbox security boundary.\nC:N - This is a queue-dispatch logic bug that leaves requeued requests stuck; there is no memory corruption, out-of-bounds access, or information disclosure.\nI:N - The flaw prevents requeued I/O from being kicked and blocks removal completion; it does not modify data or provide a write or code-execution primitive.\nA:H - Stuck requeued requests leave devices in SDEV_CANCEL with queues never kicked after recovery, causing the device removal path to hang indefinitely (deadlock), potentially blocking storage teardown, module unload, or shutdown."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:03.750Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/15fb19af49f2073ed77fad16aaabc648b0ca6800"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4dddfecdbb5467bef158d4e1486459808357fef"
        },
        {
          "url": "https://git.kernel.org/stable/c/475f2b37a78f4c698967a7f14f325f04e24c9175"
        },
        {
          "url": "https://git.kernel.org/stable/c/c740e13e7fe32d8e4d9a1699f65b8daf6709895a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7205b58702273baf21d6ba7992e6ba15852325f7"
        }
      ],
      "title": "scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64003",
    "datePublished": "2026-07-19T14:56:20.172Z",
    "dateReserved": "2026-07-19T07:54:57.026Z",
    "dateUpdated": "2026-10-19T20:18:02.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63913",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:33:11.442709Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:17:55.476Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_proto_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2006979a15af5404bf932a325357683c0bac1656",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "6476c17d536dbd321c073242e762ddb2713a1238",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "f5547bebc416d56f56fb5b86dc20aabfa42165a0",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "f206def4e86d810f927ba1d8e322ea72b29bce58",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "b98ab51c45c5608a1c19ce7fd17a3032469bb83f",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "d67c6adee8d1b65330d0174c4c367faba14e80a8",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            },
            {
              "lessThan": "bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a",
              "status": "affected",
              "version": "9fb9cbb1082d6b31fb45aa1a14432449a0df6cf1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_proto_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.15"
            },
            {
              "lessThan": "2.6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check\n\nAn unintended behavior in the TCP conntrack state machine allows a\nconnection to be forced into the CLOSE state using an RST packet with an\ninvalid sequence number.\n\nSpecifically, after a SYN packet is observed, an RST with an invalid SEQ\ncan transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of\nwhether the RST corresponds to the expected reply direction. The relevant\ncode path assumes the RST is a response to an outgoing SYN, but does not\nvalidate packet direction or ensure that a matching SYN was actually sent\nin the opposite direction.\n\nAs a result, a crafted packet sequence consisting of a SYN followed by an\ninvalid-sequence RST can prematurely terminate an active NAT entry. This\nmakes connection teardown easier than intended.\n\nSo, tighten the state transition logic to ensure that RST-triggered\nCLOSE transitions only occur when the RST is a valid response to a\npreviously observed SYN in the correct direction."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code runs in nf_conntrack_tcp_packet() on every TCP packet processed by netfilter conntrack via the NF_INET_PRE_ROUTING and LOCAL_OUT hooks; a remote attacker can deliver the crafted SYN+RST sequence over the network to internet-facing NAT gateways, routers, and servers with connection tracking enabled.\nAC:L - The attacker fully controls the exploit sequence (SYN to annotate last_index/last_end, then RST with matching ack_seq but invalid seq) and can time/retry at will; no race against third parties or rare memory layout is required beyond knowing or observing the target connection 4-tuple.\nPR:N - Exploitation requires only the ability to send TCP packets to a system running conntrack/NAT; no authentication, local shell access, or CAP_NET_ADMIN/netlink configuration is needed to reach the vulnerable state-transition path.\nUI:N - No victim user action (opening files, clicking links, mounting filesystems) is required; the attack is carried out entirely by sending crafted network packets to the target.\nS:U - Impact is confined to incorrect conntrack/NAT state on the same kernel/firewall security authority; it does not cross VM, container, or IOMMU boundaries to affect a separate security domain.\nC:N - This is a state-machine logic bug with no memory corruption, out-of-bounds access, use-after-free, or information disclosure; only connection-tracking metadata is affected.\nI:L - The bug causes unauthorized modification of conntrack connection state (forcing TCP_CONNTRACK_CLOSE and accelerated NAT entry teardown) rather than arbitrary memory or code execution, constituting limited integrity impact on data processed by the conntrack subsystem.\nA:H - Prematurely closing conntrack/NAT entries disrupts active TCP sessions and can be repeated against arbitrary tracked connections without authentication, causing sustained denial of service to affected network flows on NAT gateways and stateful firewalls."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:07.250Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2006979a15af5404bf932a325357683c0bac1656"
        },
        {
          "url": "https://git.kernel.org/stable/c/6476c17d536dbd321c073242e762ddb2713a1238"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5547bebc416d56f56fb5b86dc20aabfa42165a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bb6d82b586ea5a4cb73bbdd6b7432e96096bc77"
        },
        {
          "url": "https://git.kernel.org/stable/c/f206def4e86d810f927ba1d8e322ea72b29bce58"
        },
        {
          "url": "https://git.kernel.org/stable/c/b98ab51c45c5608a1c19ce7fd17a3032469bb83f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d67c6adee8d1b65330d0174c4c367faba14e80a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bed6e04be8e6b9133d8b16d5a42d0e0ce674fa9a"
        }
      ],
      "title": "netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63913",
    "datePublished": "2026-07-19T14:55:17.917Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-10-19T20:17:55.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89707",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:26:16.926763Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:49.252Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "085cfde7c2186acaad103f02d2c25435ad5224e9",
              "status": "affected",
              "version": "cc53ce53c86924bfe98a12ea20b7465038a08792",
              "versionType": "git"
            },
            {
              "lessThan": "194316df81263519156ebe714c4a286bee00e5be",
              "status": "affected",
              "version": "cc53ce53c86924bfe98a12ea20b7465038a08792",
              "versionType": "git"
            },
            {
              "lessThan": "467d56fd3ff57447a790c6dc3ede2d02a947d224",
              "status": "affected",
              "version": "cc53ce53c86924bfe98a12ea20b7465038a08792",
              "versionType": "git"
            },
            {
              "lessThan": "2bc4343308d85ee4e0dd3877b384306c96f114c2",
              "status": "affected",
              "version": "cc53ce53c86924bfe98a12ea20b7465038a08792",
              "versionType": "git"
            },
            {
              "lessThan": "6cba08dc1922140d260cfeb30bbda4ee1bf869d8",
              "status": "affected",
              "version": "cc53ce53c86924bfe98a12ea20b7465038a08792",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/vfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release path refs on follow_down() error\n\nnfsd_cross_mnt() initializes a local struct path with mntget() and\ndget() before calling follow_down(). On a negative return the error\narm jumps to out without releasing those references:\n\n    err = follow_down(\u0026path, follow_flags);\n    if (err \u003c 0)\n            goto out;\n\nfollow_down() never drops the caller\u0027s entry-time refs on any error\nsub-case; for example a pre-cross d_manage() failure leaves path\nuntouched, so the mntget()/dget() taken on entry survive the call.\n\nEvery other early-exit arm in nfsd_cross_mnt() (other-namespace\nreturn, IS_ERR(exp2), and the success tail after the swap) already\ncalls path_put(\u0026path); the err \u003c 0 arm is the lone omission. The\nleak inflates mnt_count and d_count on each failed cross-mount,\nblocking umount and pinning dentries against the shrinker, and is\nreachable by any authenticated NFS client through nfsd_lookup_dentry\nor the NFSv4 READDIR encode path.\n\nFix by calling path_put(\u0026path) before the goto out in the err \u003c 0\narm so the entry-time refs are released on all follow_down() error\nreturns."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd_cross_mnt() runs in the in-kernel NFS server on TCP/UDP 2049 from nfsd_lookup_dentry() (NFSv2/v3/v4 LOOKUP) and nfsd4_encode_entry4_fattr() (NFSv4 READDIR); a remote client reaches it with ordinary RPC requests.\nAC:L - On a typical nfsd export of autofs homes or nested mounts with crossmnt, an attacker can deterministically make follow_down() fail (autofs d_manage/automount error) by repeating LOOKUP/READDIR of failing mount triggers; no race or victim-controlled layout is required.\nPR:N - Default nfsd exports accept RPC_AUTH_NULL and RPC_AUTH_UNIX with no password; fh_verify only checks export IP policy, a MOUNT/PUTROOTFH filehandle, and directory execute, so no Linux account or capability on the server is required.\nUI:N - The attacker triggers the leak with their own NFS LOOKUP or READDIR RPCs; no victim mount, click, or other interactive action is required.\nS:U - The leak inflates dentry and vfsmount refcounts inside the nfsd host kernel and does not cross a VM, IOMMU, or other separate security authority.\nC:N - The bug only fails to path_put() the mntget/dget taken before follow_down(); it does not read kernel or file data or provide an information-disclosure primitive.\nI:N - The bug does not write attacker-controlled data or corrupt kernel objects; it only retains extra references on existing dentries and mounts.\nA:H - Each failed follow_down() permanently pins the dentry and vfsmount; repeated LOOKUPs of distinct autofs/mountpoint names leave unreclaimable dentries, block umount, and can exhaust kernel memory for a system-wide DoS."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:51:20.289Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/085cfde7c2186acaad103f02d2c25435ad5224e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/194316df81263519156ebe714c4a286bee00e5be"
        },
        {
          "url": "https://git.kernel.org/stable/c/467d56fd3ff57447a790c6dc3ede2d02a947d224"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bc4343308d85ee4e0dd3877b384306c96f114c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cba08dc1922140d260cfeb30bbda4ee1bf869d8"
        }
      ],
      "title": "nfsd: release path refs on follow_down() error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89707",
    "datePublished": "2026-09-11T19:46:23.293Z",
    "dateReserved": "2026-09-11T19:38:34.751Z",
    "dateUpdated": "2026-10-19T08:51:20.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64597",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:43:23.981933Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-415",
                "description": "CWE-415 Double Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T20:48:43.468Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "037511726228aaf165c7067ff2bfc88eaecdf1f3",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "0aa97edf7c347c0f54e7e60c4740574b8120c66a",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "d15d83125007f673aec4323e1bbbaaffbe87ea13",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "b18ed621dbfceecea5539848cddcb9272c9a61e1",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "f96e1cdcb63ed3321142ff2fcdf784e32cda8fee",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix double-free in SMB2_close() replay\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_close_init() fails before the next send, cleanup\nretains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious or compromised SMB server triggers the double-free via crafted SMB2 CLOSE responses over the network, returning replayable NTSTATUS values that map to -EAGAIN/-ECONNABORTED while leaving a response buffer for the client to free.\nAC:L - The attacking server controls both sides of the sequence by returning a replayable CLOSE status with a response buffer, then dropping or forcing reconnect so SMB2_close_init fails before the next send, and can repeat until the stale free occurs.\nPR:N - The attacking SMB endpoint needs no account or privileges on the victim client; once an SMB session and handle exist, the server alone drives the vulnerable CLOSE replay path.\nUI:N - On an already mounted or automounted share, background paths such as cached-directory close and cancelled-close work, as well as routine service file closes, can invoke SMB2_close without interactive user action at exploit time.\nS:U - The mempool double-free corrupts kernel memory within the same host kernel security authority and does not inherently cross a VM, IOMMU, or sandbox boundary.\nC:H - Double-free of a CIFS small/large response buffer can create overlapping live allocations and use-after-free reads, enabling disclosure of arbitrary kernel memory.\nI:H - Reallocation of the freed mempool object with attacker-controlled network data can corrupt live kernel objects or allocator metadata, enabling arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can immediately trigger allocator BUG diagnostics, heap corruption, oops, or panic, and the server can retrigger the path repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:58:19.742Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/037511726228aaf165c7067ff2bfc88eaecdf1f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aa97edf7c347c0f54e7e60c4740574b8120c66a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d15d83125007f673aec4323e1bbbaaffbe87ea13"
        },
        {
          "url": "https://git.kernel.org/stable/c/b18ed621dbfceecea5539848cddcb9272c9a61e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f96e1cdcb63ed3321142ff2fcdf784e32cda8fee"
        }
      ],
      "title": "smb: client: fix double-free in SMB2_close() replay",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64597",
    "datePublished": "2026-08-06T07:13:52.117Z",
    "dateReserved": "2026-07-19T15:36:31.799Z",
    "dateUpdated": "2026-10-19T20:48:43.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "29536a9ff146d9bbd618959857ed2e691cda1d21",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e0f5842c4e2a7dbefb52a2dc6711789bc6963e55",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d61c12573ed9768690fdcb2bc38846a1bcb01358",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "df50c24c6447c18886ed126d3d81cc7e155ea8b6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "76c6f845dc0c614304a6e6ee619b552f97cf24b3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-ioctl: fix a possible overflow in list_version_get_info\n\nsizeof(tt-\u003eversion) is 12 bytes, but the code writes 16 bytes into the\noutput buffer - info-\u003evers-\u003eversion[0], info-\u003evers-\u003eversion[1],\ninfo-\u003evers-\u003eversion[2] and info-\u003evers-\u003enext. This can cause buffer\noverflow.\n\nFix this buffer overflow by replacing \"sizeof(tt-\u003eversion)\" with\n\"sizeof(struct dm_target_versions)\"."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T06:56:11.658Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/29536a9ff146d9bbd618959857ed2e691cda1d21"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0f5842c4e2a7dbefb52a2dc6711789bc6963e55"
        },
        {
          "url": "https://git.kernel.org/stable/c/d61c12573ed9768690fdcb2bc38846a1bcb01358"
        },
        {
          "url": "https://git.kernel.org/stable/c/df50c24c6447c18886ed126d3d81cc7e155ea8b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/76c6f845dc0c614304a6e6ee619b552f97cf24b3"
        }
      ],
      "title": "dm-ioctl: fix a possible overflow in list_version_get_info",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72106",
    "datePublished": "2026-08-15T05:52:48.845Z",
    "dateReserved": "2026-08-09T03:40:39.906Z",
    "dateUpdated": "2026-08-18T06:56:11.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89662",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:25:37.406747Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:47.751Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "42d7954b0a1907d4ef122aef94561952a033cdc3",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "b8bad5a11416b26cc7fd4b18fba46d75ff636558",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "1ce74d1b7770e69735e8f8e509807af4ff9c8ee7",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "a6ead6fff3a7d03e49845f048f7000a2e0d34431",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "4804c58f73a80d12df1de323bf97a164f6ee8743",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "8cf4ff0a7c083dd5e0067f517d63979b74b66649",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "lessThan": "5e2fa29d223a9a1e6a948e40b109d09081d1decd",
              "status": "affected",
              "version": "68ef3bc3166468678d5e1fdd216628c35bd1186f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e294c4c2d33b7307a89cdf31bec08a112d6a9297",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "797bfd05d4040fbf766198b3cfcc1838002cc890",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0f44e9da465ea259b6c9f31a627f3c50a16e1679",
              "versionType": "git"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.91",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.31",
              "versionType": "semver"
            },
            {
              "lessThan": "4.16",
              "status": "affected",
              "version": "4.15.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.91",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.15.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Prevent lock owner use-after-free during client teardown\n\n__destroy_client() releases a client\u0027s open owners, but a lock owner\nwhose only reference is a blocked lock (nbl) stays on\ncl_ownerstr_hashtbl.  client_has_state() does not count a bare owner,\nso DESTROY_CLIENTID can reach __destroy_client() with such owners\npresent.\n\n__destroy_client() then walks the table, calling remove_blocked_locks()\non each owner without a reference.  Freeing a blocked lock drops the\nowner reference held via flc_owner.  The per-net laundromat reaps\nblocked locks from nn-\u003eblocked_locks_lru independently of client state.\nThe two paths share blocked_locks_lock only for the list splice, not\nthe owner\u0027s lifetime.  The laundromat therefore frees the owner as\n__destroy_client() dereferences it, a NULL dereference in\nremove_blocked_locks().\n\nnfsd4_release_lockowner() holds a reference across the same call;\n__destroy_client() does not.  Hold cl_lock across the walk, taking a\nreference and unhashing each owner, then drop it before\nremove_blocked_locks() and nfs4_put_stateowner(), which take\nblocked_locks_lock and cl_lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in nfsd NFSv4.1 client teardown and blocked-lock handling, reached by remote COMPOUND RPCs on the in-kernel NFS server (TCP/UDP 2049). A network client drives EXCHANGE_ID, CREATE_SESSION, OPEN, blocking LOCK, DESTROY_SESSION, and DESTROY_CLIENTID into __destroy_client().\nAC:L - The attacker controls both sides of the race: one client holds a conflicting lock while another queues a blocked lock, then DESTROY_CLIENTID races with lock-grant/CB_NOTIFY_LOCK or the laundromat freeing that lockowner. Concurrent NFS requests create the race, and it can be retried.\nPR:N - Typical nfsd deployments use AUTH_SYS, which does not cryptographically authenticate the client. A remote peer that can reach an export can create NFSv4.1 state and issue DESTROY_CLIENTID without a local account or kernel capabilities on the server.\nUI:N - Exploitation requires only attacker-sent NFS RPCs against a running nfsd export. No victim user action such as mounting a filesystem or opening a local file on the server is required.\nS:U - The use-after-free occurs in kernel nfsd lock-owner state on the NFS server host and does not cross a separate security authority such as a VM, guest/host, or IOMMU boundary.\nC:H - This is a use-after-free of the nfs4_lockowner slab object. Reclaiming the freed owner lets an attacker control later reads of so_client and related pointers in remove_blocked_locks(), yielding a kernel information-disclosure primitive.\nI:H - The same UAF is exploitable for integrity: the freed lockowner includes so_ops function pointers and lo_blocked list heads, so heap reuse can hijack control flow or corrupt list pointers for an arbitrary kernel write.\nA:H - The bug is a kernel use-after-free of the lock owner and was observed as a NULL dereference in remove_blocked_locks(), which can oops or panic nfsd and take down the server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:50:33.792Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/42d7954b0a1907d4ef122aef94561952a033cdc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb38ff8b4dafbbd1781ad37cd96722fdf2cd972a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8bad5a11416b26cc7fd4b18fba46d75ff636558"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ce74d1b7770e69735e8f8e509807af4ff9c8ee7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6ead6fff3a7d03e49845f048f7000a2e0d34431"
        },
        {
          "url": "https://git.kernel.org/stable/c/4804c58f73a80d12df1de323bf97a164f6ee8743"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cf4ff0a7c083dd5e0067f517d63979b74b66649"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e2fa29d223a9a1e6a948e40b109d09081d1decd"
        }
      ],
      "title": "NFSD: Prevent lock owner use-after-free during client teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89662",
    "datePublished": "2026-09-11T19:45:49.833Z",
    "dateReserved": "2026-09-11T19:38:34.744Z",
    "dateUpdated": "2026-10-19T08:50:33.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-80721",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:20:54.409613Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:35.259Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e941799c31f68e67ce0976efb38a79101f921b64",
              "status": "affected",
              "version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b",
              "versionType": "git"
            },
            {
              "lessThan": "cdce8af9291d8a1f8916c271de029bf558d9e8ec",
              "status": "affected",
              "version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b",
              "versionType": "git"
            },
            {
              "lessThan": "aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb",
              "status": "affected",
              "version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f53e7489273dc2bb307bf50f319b3762d45534f0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a58d0f5dac322e16cc75334d000666512341bde5",
              "versionType": "git"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThan": "6.13",
              "status": "affected",
              "version": "6.12.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.12.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: ensure no dangling hcon references in iso_conn\n\nAfter iso_conn_del(), ISO sockets should not dereference the hcon any\nmore.  Currently, clearing iso_conn::hcon relies on iso_conn_del()\nreleasing the last reference to the iso_conn.\n\nSimplify this by explicitly clearing conn-\u003ehcon in iso_conn_del(), to\navoid more complex reasoning on races about who holds the last\nreference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in Bluetooth ISO connection teardown (iso_conn_del/iso_conn_free); reachable when an adjacent peer triggers HCI disconnect/connect-failure events or sends ISO traffic processed by iso_recv, without network or physical USB access.\nAC:L - An adjacent attacker controls both sides of the refcount race by timing remote disconnects and ISO packets against local teardown; no rare layout or victim-specific state beyond an active ISO session is required.\nPR:N - No local privileges are required on the victim; an unauthenticated adjacent Bluetooth peer can trigger iso_disconn_cfm/iso_connect_cfm teardown on phones and desktops with Bluetooth and LE Audio/ISO enabled.\nUI:N - Exploitation needs no victim interaction during the attack; once Bluetooth is on and an ISO link exists (e.g., LE Audio), remote disconnect and ISO traffic alone can hit the race.\nS:U - The flaw causes kernel heap use-after-free on hci_conn via dangling iso_conn::hcon references; impact stays within kernel memory safety, not a VM escape or cross-authority boundary.\nC:H - After hci_conn_del frees hcon, iso_conn still holds conn-\u003ehcon; subsequent iso_conn_free or socket paths dereference freed hci_conn memory, a classic UAF read primitive.\nI:H - Use-after-free on hci_conn enables corrupting connection management fields and hci_conn_drop state; such kernel heap UAF bugs are routinely leveraged for arbitrary write and code execution.\nA:H - Dereferencing freed hci_conn in iso_conn_free or ISO socket teardown reliably causes kernel oops or panic, giving unprivileged adjacent attackers a repeatable denial-of-service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-30T07:08:36.447Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e941799c31f68e67ce0976efb38a79101f921b64"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdce8af9291d8a1f8916c271de029bf558d9e8ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb"
        }
      ],
      "title": "Bluetooth: ISO: ensure no dangling hcon references in iso_conn",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80721",
    "datePublished": "2026-08-28T06:53:17.278Z",
    "dateReserved": "2026-08-26T14:34:25.788Z",
    "dateUpdated": "2026-10-16T19:26:35.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/enetc/enetc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1ecb199b0e6d12ab6c26c0b7edf1a8f4472d9aed",
              "status": "affected",
              "version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6",
              "versionType": "git"
            },
            {
              "lessThan": "f55276160ffad3e235b657ee4b7304eb99b90e5c",
              "status": "affected",
              "version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6",
              "versionType": "git"
            },
            {
              "lessThan": "cfbc6e9b84dcc0aa2d65c84ea4745af327763209",
              "status": "affected",
              "version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6",
              "versionType": "git"
            },
            {
              "lessThan": "1681cc7974a6123f5d5740b03bc11e4784bd2542",
              "status": "affected",
              "version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6",
              "versionType": "git"
            },
            {
              "lessThan": "d22829101ab675607ad6c3d420fb3ab875f46bbb",
              "status": "affected",
              "version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6",
              "versionType": "git"
            },
            {
              "lessThan": "555c5475e787802eeae0d2b91c2f66c330db2767",
              "status": "affected",
              "version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/enetc/enetc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: check the number of BDs needed for xdp_frame\n\nThe size of xdp_redirect_arr array is ENETC_MAX_SKB_FRAGS. However, the\nnumber of fragments contained in xdp_frame may be greater than or equal\nto ENETC_MAX_SKB_FRAGS, which will cause the access to xdp_redirect_arr\nto be out of bounds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote attackers can deliver multi-fragment frames to an XDP-enabled ingress path that bpf_redirect_map/devmap forwards to an ENETC PF netdev, reaching enetc_xdp_xmit via the standard XDP_REDIRECT flush path without local access.\nAC:L - Once XDP redirect to ENETC is deployed, an attacker can reliably craft or segment traffic to produce xdp_frames with nr_frags+1\u003e13; no race or uncontrollable memory layout is required to trigger the out-of-bounds write.\nPR:N - Exploitation requires no attacker privileges when XDP redirect is pre-deployed on the gateway (normal for edge filtering); unprivileged users with CAP_NET_ADMIN via user namespaces can also attach the needed BPF/XDP programs.\nUI:N - No victim interaction is required beyond sending crafted network traffic; exploitation is fully attacker-driven once the XDP redirect datapath exists.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel/host security boundary, not a cross-VM or IOMMU scope change.\nC:H - Stack out-of-bounds writes of enetc_tx_swbd structures past a 13-element array corrupt adjacent stack data and pointers, providing a memory-corruption primitive that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The overflow writes attacker-influenced enetc_tx_swbd fields (DMA addresses, lengths, frame pointers) beyond the buffer bounds, enabling heap/stack corruption suitable for arbitrary write and potential code execution.\nA:H - Corrupting stack-resident transmit metadata and pointers in enetc_xdp_xmit can cause immediate kernel oops/panic or hung transmit paths, constituting total loss of availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:43:41.891Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1ecb199b0e6d12ab6c26c0b7edf1a8f4472d9aed"
        },
        {
          "url": "https://git.kernel.org/stable/c/f55276160ffad3e235b657ee4b7304eb99b90e5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfbc6e9b84dcc0aa2d65c84ea4745af327763209"
        },
        {
          "url": "https://git.kernel.org/stable/c/1681cc7974a6123f5d5740b03bc11e4784bd2542"
        },
        {
          "url": "https://git.kernel.org/stable/c/d22829101ab675607ad6c3d420fb3ab875f46bbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/555c5475e787802eeae0d2b91c2f66c330db2767"
        }
      ],
      "title": "net: enetc: check the number of BDs needed for xdp_frame",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72399",
    "datePublished": "2026-08-15T05:56:24.926Z",
    "dateReserved": "2026-08-09T03:40:39.925Z",
    "dateUpdated": "2026-08-17T05:43:41.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/svcauth_gss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "56b29d62017c7dd1718d060dd5b3a2ce61095d0c",
              "status": "affected",
              "version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
              "versionType": "git"
            },
            {
              "lessThan": "0e18641708eaa8bc3c1ff338cd844aeadbd52bac",
              "status": "affected",
              "version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
              "versionType": "git"
            },
            {
              "lessThan": "e0778464049b0238f2915a40007a4154f86cf351",
              "status": "affected",
              "version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
              "versionType": "git"
            },
            {
              "lessThan": "0fa8a8acae57e6373962741d5b06d13f44aba6a9",
              "status": "affected",
              "version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
              "versionType": "git"
            },
            {
              "lessThan": "11539e8fcce0b0af062ae5fecf7b3676c2f7aeed",
              "status": "affected",
              "version": "b0bc53470d1af01f62a0fe2d405cf56477804863",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/svcauth_gss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\n\nsvcauth_gss_decode_credbody() writes the caller\u0027s\nrpc_gss_wire_cred field by field and assigns gc_ctx.len only on\nthe success tail.  The caller storage is svcdata-\u003eclcred, which\nlives in the per-svc_rqst gss_svc_data and is reused across\nrequests.  Early decode failures leave partially decoded state\nmixed with residue from the prior request.\n\nThe trailing body_len tightness check is the sharpest case:\nxdr_stream_decode_opaque_inline() has already written gc_ctx.data\nwith a borrowed inline pointer into the current request\u0027s XDR\npages, but gc_ctx.len retains its prior value.  Once the request\npages are released the pooled clcred carries a dangling pointer\npaired with a stale length.\n\nZero the caller\u0027s rpc_gss_wire_cred at function entry so that\nevery early-return path leaves a deterministic all-zero cred.\nOn the trailing tightness-check path, gc_ctx.len is now zero\ninstead of stale, which neuters length-driven consumers such as\ngss_svc_searchbyctx() that would otherwise walk the dangling\ndata pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote NFS/SUNRPC peer sends an RPC Call with flavor RPC_AUTH_GSS whose rpc_gss_cred_t fails the body_len tightness check in svcauth_gss_decode_credbody(); those cred bytes arrive on nfsd TCP/UDP 2049 via svc_recv \u2192 svc_tcp_recvfrom/svc_udp_recvfrom \u2192 svc_process \u2192 svc_process_common \u2192 svc_authenticate \u2192 svcauth_gss_accept.\nAC:L - The attacker first sends a well-formed RPCSEC_GSS cred so decode assigns gc_ctx.len, then a second Call where xdr_stream_decode_opaque_inline() succeeds but body_len != XDR_UNIT*5+xdr_align_size(handle_len). Both hit the same nfsd thread\u0027s reused gss_svc_data.clcred; the tightness failure is deterministic with no race.\nPR:N - svcauth_gss_decode_credbody() is the RPC_AUTH_GSS credential decoder inside svcauth_gss_accept(), reached before gss_svc_searchbyctx(), gss_verify_mic(), or nfsd export/client checks. Flavor 6 with auth_rpcgss registered (RPCSEC_GSS_KRB5 defaults y) needs no Kerberos ticket, uid, or capability.\nUI:N - nfsd processes each inbound RPC in the service thread via svc_process with no local user or administrator action; the attacker alone sends the residue-planting Call and the tightness-fail Call.\nS:U - The dangling gc_ctx pointer, consume_skb() of the UDP receive skb, and any later kmemdup of that pointer occur in the host nfsd/SUNRPC kernel. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - On tightness failure, xdr_stream_decode_opaque_inline() writes gc_ctx.data into the UDP in-place skb (svc_udp_recvfrom) while gc_ctx.len stays the prior handle length. svc_udp_release_ctxt() consume_skb() then frees that skb; gss_svc_searchbyctx()\u2192dup_to_netobj() kmemdups handle-\u003elen bytes from the dangling pointer, a UAF read of reclaimed kernel memory.\nI:H - The leftover clcred.gc_ctx is a use-after-free of skb-backed memory with an attacker-chosen stale length planted by the prior GSS handle. Spraying the consumed skb lets length-driven consumers of that netobj treat attacker bytes as kernel objects, so integrity impact is High as for other kernel UAFs.\nA:H - Walking gc_ctx.data after consume_skb() oopses the nfsd thread when the skb is reused or unmapped, and the attacker can repeat tightness-fail Calls to kill service threads or panic the host where panic_on_oops is set."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:07:19.480Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/56b29d62017c7dd1718d060dd5b3a2ce61095d0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e18641708eaa8bc3c1ff338cd844aeadbd52bac"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0778464049b0238f2915a40007a4154f86cf351"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fa8a8acae57e6373962741d5b06d13f44aba6a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/11539e8fcce0b0af062ae5fecf7b3676c2f7aeed"
        }
      ],
      "title": "SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93207",
    "datePublished": "2026-09-24T15:10:30.942Z",
    "dateReserved": "2026-09-17T16:02:15.093Z",
    "dateUpdated": "2026-10-19T09:07:19.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/ib_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f9fe3cad43c42d874a388583552b39b411d886eb",
              "status": "affected",
              "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
              "versionType": "git"
            },
            {
              "lessThan": "3c97b8e76ca2bba9e8770571413aed694068e78e",
              "status": "affected",
              "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
              "versionType": "git"
            },
            {
              "lessThan": "ea0408273ccf5df1fb52d9a1b9db4d31600dcb36",
              "status": "affected",
              "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
              "versionType": "git"
            },
            {
              "lessThan": "5b06f706374c37375bdff9d21cc10e61df925a92",
              "status": "affected",
              "version": "7e86845a0346efc95fddaa97ce5cd6a8bda8c71c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/xprtrdma/ib_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.5",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpcrdma: arm rn_done before publishing the notification\n\nrpcrdma_rn_register() inserts @rn into rd_xa with xa_alloc() before\nstoring the caller\u0027s callback in rn-\u003ern_done. The xarray makes @rn\nreachable to rpcrdma_remove_one(), which walks rd_xa and invokes\nrn-\u003ern_done(rn) for every registered notification. A device removal\nthat races a fresh registration can therefore observe @rn with\nrn_done still NULL, because the notification objects are zero\nallocated by their owners, and call through a NULL function pointer.\n\nStore rn-\u003ern_done before xa_alloc() publishes @rn. The xarray\u0027s\nstore-side and load-side ordering then guarantees that any CPU which\nfinds @rn in rd_xa also observes the armed callback.\n\nrpcrdma_rn_unregister() treats a non-NULL rn_done as the sentinel\nfor a completed registration, so the early store must not survive a\nfailed registration. Clear rn_done again when xa_alloc() fails.\nWere it left set, the failed-accept cleanup path would call\nrpcrdma_rn_unregister() on an @rn that was never inserted, erasing\nan unrelated rd_xa slot and underflowing rd_kref."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:52:52.994Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f9fe3cad43c42d874a388583552b39b411d886eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c97b8e76ca2bba9e8770571413aed694068e78e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea0408273ccf5df1fb52d9a1b9db4d31600dcb36"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b06f706374c37375bdff9d21cc10e61df925a92"
        }
      ],
      "title": "rpcrdma: arm rn_done before publishing the notification",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89798",
    "datePublished": "2026-09-16T10:30:29.930Z",
    "dateReserved": "2026-09-11T19:38:34.767Z",
    "dateUpdated": "2026-10-19T08:52:52.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68198",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:45:39.924585Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:00:24.933Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath6kl/txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a1bac650b2d6b1baab1f3e78e2e007a6e2948dde",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "2132a6db05846dd2318857d00e0c1291f9e41b29",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "17ff29cd8dbc977c97788a5f7c011ec807b58242",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "64af6534a085f49d6ed33338a19ab9cf0d0523c9",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "b5d618fd61b9069b4c0a6b487022dd3117ad5acc",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "18965470d41e69d3fc10eb62afae29d10f4cdfd1",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "a3313111b5d9046af60b370c93eec105b27380c1",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            },
            {
              "lessThan": "ba7debb4dd6427386862220e8335a53a4bfc235d",
              "status": "affected",
              "version": "bdcd81707973cf8aa9305337166f8ee842a050d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath6kl/txrx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.266",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath6kl: fix use-after-free in aggr_reset_state()\n\nThe aggr_reset_state() function uses timer_delete() (non-synchronous)\nfor the aggregation timer before proceeding to delete TID state and\nbefore the structure is freed by callers like aggr_module_destroy().\n\nIf the timer callback (aggr_timeout) is executing when aggr_reset_state()\nis called, the callback will continue to access aggr_conn fields like\nrx_tid[] and stat[] which may be freed immediately after by\nkfree(aggr_info-\u003eaggr_conn) in aggr_module_destroy().\n\nAdditionally, the timer callback can re-arm itself via mod_timer() while\naggr_reset_state() is running, creating a more complex race condition.\n\nUse timer_delete_sync() instead to ensure any running timer callback\nhas completed before returning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - ath6kl is a WiFi driver; the race is driven by 802.11 frames from an adjacent attacker \u2014 a gapped A-MPDU sequence arms the reorder timer and a deauth/disassoc or connect/disconnect event drives aggr_reset_state() via ath6kl_disconnect_event()/ath6kl_connect_event()/ath6kl_sta_cleanup(). This requires radio proximity, not routable network access.\nAC:L - The attacker controls both sides of the race: transmitting out-of-order aggregated frames arms aggr_conn-\u003etimer, and a deauth/disassoc or reconnect immediately invokes aggr_reset_state(), which frees rx_tid[].hold_q and (via aggr_module_destroy) aggr_conn itself while aggr_timeout() may be running or re-arming via mod_timer(). The sequence can be repeated indefinitely until the window is hit.\nPR:N - No privileges or account on the target system are required; a rogue AP the client associates with, or an attacker injecting unprotected deauth/disassoc frames at a station with an active block-ack session, is sufficient. In AP mode, a station joining an open network can trigger the same path on disconnect.\nUI:N - The station already associated and receiving aggregated traffic is enough; deauth/disassoc handling and the resulting aggr_reset_state() run automatically in the driver with no action by the device owner.\nS:U - The use-after-free is on kernel heap memory owned by the ath6kl driver and stays within the kernel\u0027s own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The freed aggr_info_conn and hold_q allocations can be reclaimed and refilled with attacker-influenced data (e.g. sk_buff payloads from injected frames), so the concurrent callback reading rx_tid[]/stat[]/hold_q[] yields a controllable read primitive that can leak kernel memory contents.\nI:H - aggr_timeout() writes through the freed object \u2014 setting timer_scheduled, rxtid-\u003etimer_mon, dequeuing skbs from hold_q[] and calling mod_timer() on a freed timer_list \u2014 giving arbitrary writes into reclaimed heap objects and list corruption that is a classic path to control-flow hijack.\nA:H - Even without successful heap grooming, the use-after-free and the double-free/dangling-skb access in aggr_deque_frms() reliably produce slab corruption and a kernel oops or panic, and the attacker can repeat the trigger at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:06.548Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a1bac650b2d6b1baab1f3e78e2e007a6e2948dde"
        },
        {
          "url": "https://git.kernel.org/stable/c/2132a6db05846dd2318857d00e0c1291f9e41b29"
        },
        {
          "url": "https://git.kernel.org/stable/c/17ff29cd8dbc977c97788a5f7c011ec807b58242"
        },
        {
          "url": "https://git.kernel.org/stable/c/64af6534a085f49d6ed33338a19ab9cf0d0523c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5d618fd61b9069b4c0a6b487022dd3117ad5acc"
        },
        {
          "url": "https://git.kernel.org/stable/c/18965470d41e69d3fc10eb62afae29d10f4cdfd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3313111b5d9046af60b370c93eec105b27380c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba7debb4dd6427386862220e8335a53a4bfc235d"
        }
      ],
      "title": "wifi: ath6kl: fix use-after-free in aggr_reset_state()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68198",
    "datePublished": "2026-08-10T12:00:16.718Z",
    "dateReserved": "2026-07-30T09:28:09.374Z",
    "dateUpdated": "2026-10-19T18:00:24.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f076460c5205c9687059e5a3afeed37d2f2ceb6b",
              "status": "affected",
              "version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
              "versionType": "git"
            },
            {
              "lessThan": "b6667d925c274910423385042edf18f6788dbceb",
              "status": "affected",
              "version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
              "versionType": "git"
            },
            {
              "lessThan": "c642583adc136d4c70ce3c65c3f43e847d26c776",
              "status": "affected",
              "version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
              "versionType": "git"
            },
            {
              "lessThan": "f94031c94eaebe14a7c9e91720064de0c5a54a6c",
              "status": "affected",
              "version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
              "versionType": "git"
            },
            {
              "lessThan": "e045d6ed33f8faa3e3dd6dc33c62ec01e3ad275d",
              "status": "affected",
              "version": "c9aa889b035fca4598ae985a0f0c76ebbb547ad2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "39db562b3fedb93978a7e42dd216b306740959f8",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.111",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.111",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix writes_pending leak on write request failures\n\nraid10_make_request() acquires a writes_pending reference with\nmd_write_start() before dispatching write requests. Several failure\npaths in raid10_write_request() complete the bio and return without\nreaching the normal write completion path, causing the corresponding\nmd_write_end() to be skipped.\n\nMake raid10_write_request() return a status indicating whether the write\nrequest was successfully queued. This allows raid10_make_request() to\nrelease the writes_pending reference with md_write_end() when a write\nrequest fails."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:44:56.123Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f076460c5205c9687059e5a3afeed37d2f2ceb6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6667d925c274910423385042edf18f6788dbceb"
        },
        {
          "url": "https://git.kernel.org/stable/c/c642583adc136d4c70ce3c65c3f43e847d26c776"
        },
        {
          "url": "https://git.kernel.org/stable/c/f94031c94eaebe14a7c9e91720064de0c5a54a6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e045d6ed33f8faa3e3dd6dc33c62ec01e3ad275d"
        }
      ],
      "title": "md/raid10: fix writes_pending leak on write request failures",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72439",
    "datePublished": "2026-08-15T05:56:52.023Z",
    "dateReserved": "2026-08-09T03:40:39.930Z",
    "dateUpdated": "2026-10-21T12:44:56.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74689",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:14:36.506932Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:16:09.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/atm/common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b3bcd5d65ac03c15787b2a5b36c718e26a689336",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "35f258fee9ed358c6d0f57f91c30bf029c3724af",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6eb6af88710977eb529b558a07294874d8c40c4d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9f77c1ab382188f5b51982fab6d913443b6dc59f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2c5988c7349c0b64a7e0441bfc6e1dca54f7116a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d0c80dbb970439bd2eeb0e5effff8c16a5f4e1e3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/atm/common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/atm: fix slab-out-of-bounds read in vcc_setsockopt()\n\nvcc_setsockopt() contained an ineffective optlen check:\n  if (__SO_LEVEL_MATCH(optname, level) \u0026\u0026 optlen != __SO_SIZE(optname))\n      return -EINVAL;\n\nIf __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller\npassed a mismatched level), the length check optlen != __SO_SIZE(optname)\nwas short-circuited and bypassed. Execution then fell through to switch(optname),\ncalling copy_from_sockptr() assuming optval contained sufficient space.\n\nFurthermore, even if level matched, a cgroup BPF setsockopt filter could shrink\noptlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(),\nthis leads to a KASAN slab-out-of-bounds read when optlen is smaller than the\nexpected structure size.\n\nFix this by using copy_safe_from_sockptr(), which unconditionally validates\nthat optlen is at least the expected size before copying. Also change the local\n\u0027value\u0027 variable type from \u0027unsigned long\u0027 to \u0027int\u0027 so that SO_SETCLP matches\nits sizeof(int) ABI encoding on 64-bit systems."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via the local setsockopt(2) syscall on an AF_ATMPVC/AF_ATMSVC socket (do_sock_setsockopt -\u003e pvc_setsockopt/svc_setsockopt -\u003e vcc_setsockopt); no remote ATM packet or network-facing handler invokes this path.\nAC:L - The attacker fully controls level, optname, and optlen; passing a mismatched level bypasses the short-circuited length check, and cgroup BPF setsockopt can shrink optlen after entry, deterministically triggering a full-size memcpy past a small kmalloc buffer with no race.\nPR:L - No capability check guards SO_ATMQOS or SO_SETCLP on unconnected ATM sockets; any unprivileged local user in init_net (required because ATM socket creation rejects non-init network namespaces) can open AF_ATMPVC sockets and issue the crafted setsockopt without CAP_NET_ADMIN.\nUI:N - The attacker triggers the out-of-bounds read entirely from their own process with a single crafted setsockopt call; no victim interaction or cooperation is required.\nS:U - Impact is kernel heap memory disclosure and potential crash within the host kernel security boundary; no VM escape, IOMMU bypass, or cross-sandbox boundary crossing occurs.\nC:H - copy_from_sockptr() performs a slab-out-of-bounds read of up to 92 bytes (struct atm_qos) or 8 bytes (SO_SETCLP) past a kmalloc buffer into kernel stack memory; adjacent slab contents can populate vcc-\u003eqos and be retrieved via subsequent SO_ATMQOS getsockopt.\nI:N - The defect is a pure out-of-bounds read with no arbitrary kernel write, heap corruption, or control-flow hijack primitive; although leaked bytes may influence vcc-\u003eqos if validation passes, no attacker-controlled data modification occurs.\nA:H - The KASAN-reported slab-out-of-bounds read triggers kernel oops on hardened kernels, and reading past a small kmalloc object into adjacent slab memory on production kernels risks faulting on unmapped redzone pages or corrupting adjacent objects leading to panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:33.932Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b3bcd5d65ac03c15787b2a5b36c718e26a689336"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f258fee9ed358c6d0f57f91c30bf029c3724af"
        },
        {
          "url": "https://git.kernel.org/stable/c/6eb6af88710977eb529b558a07294874d8c40c4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f77c1ab382188f5b51982fab6d913443b6dc59f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c5988c7349c0b64a7e0441bfc6e1dca54f7116a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0c80dbb970439bd2eeb0e5effff8c16a5f4e1e3"
        }
      ],
      "title": "net/atm: fix slab-out-of-bounds read in vcc_setsockopt()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74689",
    "datePublished": "2026-08-22T15:32:54.034Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-10-16T19:16:09.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89671",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:25:43.543380Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:48.048Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs3acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3be1d8611dae4829e4608007db29f4a8748c37b2",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "68a80b26efdff1d09f8ae1773c6a915abb9e191d",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "b3bff820d068ea59767d4e91a3258231a879da5f",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "ff99ed007f065198fd723152405c22aa558f700b",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            },
            {
              "lessThan": "453d7198a0ab07a12d46e0575861ac7b932da17e",
              "status": "affected",
              "version": "a257cdd0e2179630d3201c32ba14d7fcb3c3a055",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs3acl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.13"
            },
            {
              "lessThan": "2.6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: gate nfs3 setacl by argp-\u003emask\n\nnfsd3_proc_setacl() calls set_posix_acl() unconditionally for both\nACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp-\u003eacl_access and\nargp-\u003eacl_default verbatim. The NFSv3 ACL decoder only populates\nthose pointers when the corresponding mask bit is set:\n\n    nfs3svc_decode_setaclargs()\n      if (args-\u003emask \u0026 NFS_ACL)    decode into acl_access\n      if (args-\u003emask \u0026 NFS_DFACL)  decode into acl_default\n      /* otherwise the pointer stays NULL (pc_argzero) */\n\n    nfsd3_proc_setacl()\n      set_posix_acl(.., ACL_TYPE_ACCESS,  argp-\u003eacl_access)\n      set_posix_acl(.., ACL_TYPE_DEFAULT, argp-\u003eacl_default)\n\nset_posix_acl(idmap, dentry, type, NULL) is the VFS \"remove this\nACL type\" operation. A NULL pointer that means \"the client did not\nsend this arm\" is therefore indistinguishable from \"the client\nasked to remove this ACL\". A SETACL with mask=NFS_ACL silently\ndrops the directory\u0027s default ACL; mask=0 drops both.\n\nThe sibling nfsd3_proc_getacl() already consults argp-\u003emask before\ntouching each arm; mirror that in setacl.\n\nFix by wrapping each set_posix_acl() call in the matching mask bit\ncheck and initializing error to 0 before inode_lock so that a\nrequest with neither bit set leaves the on-disk ACLs untouched and\nreturns nfs_ok. The out_drop_lock path and the unconditional\nposix_acl_release() at out: are preserved; both NULL-tolerate the\nskipped arms."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - nfsd3_proc_setacl() is NFSACL v3 SETACL (RPC program 100227) on the in-kernel NFS server, reached over TCP/UDP (typically port 2049) from a remote peer; no local syscall or physical access is required.\nAC:L - A single SETACL with mask omitting NFS_ACL and/or NFS_DFACL reliably deletes the corresponding POSIX ACL; there is no race or attacker-uncontrollable layout, and CONFIG_NFSD_V3_ACL is enabled on common distro NFS server kernels.\nPR:N - Default nfsd exports accept AUTH_UNIX and AUTH_NULL with no shared secret; AUTH_UNIX UIDs are attacker-chosen, so the caller spoofs the inode owner to pass inode_owner_or_capable() without any account on the server.\nUI:N - The attacker triggers the flaw by sending crafted NFSACL SETACL RPCs; no victim must mount a filesystem, open a file, or otherwise interact.\nS:U - Impact stays on POSIX ACL metadata of the exported filesystem in the same kernel/host security authority; this is not a VM escape, IOMMU bypass, or sandbox breakout.\nC:H - Removing an access ACL drops named-user/group entries that may be the only restriction beyond mode bits, and removing a directory default ACL stops inheritance of restrictive policy, so ACL-protected file contents can become readable.\nI:H - set_posix_acl(..., NULL) is the VFS remove-ACL operation, so an omitted mask bit silently deletes that ACL type on disk; mask=NFS_ACL strips the default ACL and mask=0 strips both, destroying access-control metadata.\nA:N - The path performs a defined VFS ACL-remove and does not oops, panic, hang, deadlock, or leak kernel memory, so nfsd and the host remain available."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:50:44.635Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3be1d8611dae4829e4608007db29f4a8748c37b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/68a80b26efdff1d09f8ae1773c6a915abb9e191d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3bff820d068ea59767d4e91a3258231a879da5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff99ed007f065198fd723152405c22aa558f700b"
        },
        {
          "url": "https://git.kernel.org/stable/c/453d7198a0ab07a12d46e0575861ac7b932da17e"
        }
      ],
      "title": "nfsd: gate nfs3 setacl by argp-\u003emask",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89671",
    "datePublished": "2026-09-11T19:45:56.604Z",
    "dateReserved": "2026-09-11T19:38:34.746Z",
    "dateUpdated": "2026-10-19T08:50:44.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-74662",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:14:06.842861Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:16:07.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_fragment.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f4e4dab62181b7fe7c011bed6fbef9fc3d48c769",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "4ed0681dc2c1e0538b79d2fc56190ffcb369dacd",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "08a04d7bfb9c103432561aff8a62b6872e694a6a",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "d3ffb89b2944672cf7bdd8e9ee577d2043b4a956",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "9f904dd3e455750e5d4ec9b2f134835811b85a2f",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "928128865e43b197e30688dc1bc991592c97edcf",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "lessThan": "653d7ddf6cba867777a3d14c4f83ace008c5ad13",
              "status": "affected",
              "version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "493107105843f299662b3b664a83804645564f12",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.174",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_fragment.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.174",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: publish queues before arming timer\n\ninet_frag_create() arms the fragment queue timer before inserting the\nqueue into the fqdir rhashtable. If the namespace fragment timeout is\nzero or negative, the timer can run before the queue is published.\n\nThe timer callback then marks the queue complete, tries to remove a node\nthat is not in the hash table yet, and drops the anticipated hash\nreference. Creation can subsequently publish the completed queue without\nrestoring that reference, leaving a stale hash node after the caller drops\nthe remaining reference.\n\nPublish the queue first and arm the timer while holding the queue lock.\nThis makes timer expiry wait until the queue is visible in the hash table,\nso inet_frag_kill() can remove the node and balance the hash reference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - IPv4/IPv6 fragments reach inet_frag_create() via remote receive paths (ip_defrag, ipv6_frag_rcv, nf_conntrack reassembly) on any Internet-facing host performing normal fragment reassembly before transport delivery.\nAC:L - Requires per-netns fragment timeout \u22640 so the armed timer expires during queue creation; attacker-settable with CAP_NET_ADMIN in user/net namespaces, and the timer/hash race is fully attacker-controlled and repeatable via crafted fragments.\nPR:N - No authentication or capability check gates IPv4/IPv6 fragment receive/reassembly before inet_frag_find(); remote peers can deliver the triggering fragmented traffic pre-authentication to hosts processing fragments.\nUI:N - Exploitation needs only crafted fragmented packet delivery; no victim action such as opening files, clicking links, or mounting filesystems is required.\nS:U - Corruption is confined to the kernel network stack in the same security authority; this is standard kernel memory corruption/privilege escalation, not a VM escape or IOMMU boundary bypass.\nC:H - Incorrect refcounting leaves a stale rhashtable entry pointing at a freed inet_frag_queue; subsequent fragment lookups dereference freed slab memory, enabling kernel information disclosure primitives.\nI:H - Follow-on fragment handling on the stale queue writes through freed inet_frag_queue and skb linkage fields, yielding kernel heap corruption exploitable for arbitrary modification or code execution.\nA:H - Freed-queue dereferences during reassembly can kernel oops or panic; attackers can retrigger the condition repeatedly by sending additional fragmented datagrams matching the same fragment key."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:39:58.332Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f4e4dab62181b7fe7c011bed6fbef9fc3d48c769"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ed0681dc2c1e0538b79d2fc56190ffcb369dacd"
        },
        {
          "url": "https://git.kernel.org/stable/c/08a04d7bfb9c103432561aff8a62b6872e694a6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3ffb89b2944672cf7bdd8e9ee577d2043b4a956"
        },
        {
          "url": "https://git.kernel.org/stable/c/39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f904dd3e455750e5d4ec9b2f134835811b85a2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/928128865e43b197e30688dc1bc991592c97edcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/653d7ddf6cba867777a3d14c4f83ace008c5ad13"
        }
      ],
      "title": "inet: frags: publish queues before arming timer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74662",
    "datePublished": "2026-08-22T15:32:35.151Z",
    "dateReserved": "2026-08-15T05:44:03.924Z",
    "dateUpdated": "2026-10-16T19:16:07.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/scrub/dir_repair.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5442f0c56445618544a801fb4dae35aed87a1aaa",
              "status": "affected",
              "version": "b1991ee3e7cf852e95a3498801303cfbb4468681",
              "versionType": "git"
            },
            {
              "lessThan": "08754ebfa5c28e8d57316b1bd7a5a921a5e2e762",
              "status": "affected",
              "version": "b1991ee3e7cf852e95a3498801303cfbb4468681",
              "versionType": "git"
            },
            {
              "lessThan": "a455c83ce5dc1a2da33b1b84253d298372a8dfbd",
              "status": "affected",
              "version": "b1991ee3e7cf852e95a3498801303cfbb4468681",
              "versionType": "git"
            },
            {
              "lessThan": "9f84792b40d0c96833341602144574bf0bd14a6a",
              "status": "affected",
              "version": "b1991ee3e7cf852e95a3498801303cfbb4468681",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/scrub/dir_repair.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: don\u0027t spin forever on zero-length dirents when salvaging them\n\nLOLLM noticed that xrep_dir_recover_data can spin forever if it\nencounters an unused dirent that claims to have length zero.  Fix that,\nand prevent the same thing from happening with a zero-length entry."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:09:09.393Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5442f0c56445618544a801fb4dae35aed87a1aaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/08754ebfa5c28e8d57316b1bd7a5a921a5e2e762"
        },
        {
          "url": "https://git.kernel.org/stable/c/a455c83ce5dc1a2da33b1b84253d298372a8dfbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f84792b40d0c96833341602144574bf0bd14a6a"
        }
      ],
      "title": "xfs: don\u0027t spin forever on zero-length dirents when salvaging them",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97546",
    "datePublished": "2026-09-25T10:21:41.029Z",
    "dateReserved": "2026-09-24T16:01:01.154Z",
    "dateUpdated": "2026-10-19T09:09:09.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89550",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:23:48.643149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:43.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/svcauth_gss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ea5b0c7f212c2772d32c2b88287b89a9cdf6edd",
              "status": "affected",
              "version": "7c9fdcfb1b64c47ed618c103b617af3f86e1239c",
              "versionType": "git"
            },
            {
              "lessThan": "dd6afc6cab8c5d387d1ed2f069562ef7bdadd651",
              "status": "affected",
              "version": "7c9fdcfb1b64c47ed618c103b617af3f86e1239c",
              "versionType": "git"
            },
            {
              "lessThan": "de942dd8c2c8358bcad04ce44271954c48924423",
              "status": "affected",
              "version": "7c9fdcfb1b64c47ed618c103b617af3f86e1239c",
              "versionType": "git"
            },
            {
              "lessThan": "2eed1e6a976a44015c3ee78841fe336796e2b21c",
              "status": "affected",
              "version": "7c9fdcfb1b64c47ed618c103b617af3f86e1239c",
              "versionType": "git"
            },
            {
              "lessThan": "a919c5c88769cf8fb3ec071e6078d830bf512489",
              "status": "affected",
              "version": "7c9fdcfb1b64c47ed618c103b617af3f86e1239c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sunrpc/auth_gss/svcauth_gss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "lessThan": "2.6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: svcauth_gss: enforce krb5 token minimum length\n\nsvcauth_gss_unwrap_priv() validates only an upper bound on the\nwire-supplied opaque length before handing the buffer to\ngss_unwrap():\n\n    if (len \u003e xdr_stream_remaining(xdr))\n            goto unwrap_failed;\n    offset = xdr_stream_pos(xdr);\n    ...\n    maj_stat = gss_unwrap(ctx, offset, offset + len, buf);\n\nThe wire value `len` flows unchanged as the upper bound into the\nkrb5 unwrap path, so a len in [0, 16] passes this check and is\nhanded to gss_unwrap(). For a krb5 v2 context that lands in\ngss_krb5_unwrap_v2(), which reads the 16-byte RFC 4121 token\nheader fields at ptr+4 and ptr+6 and then calls rotate_left()\nbefore any integrity check. With a sub-header length the header\nreads run past the token, and _rotate_left()\u0027s `shift %= buf-\u003elen`\npath can divide by zero when buf-\u003elen has been driven to zero by\nthe truncated token. A header-only token (len == 16) is equally\ninvalid: with a non-zero RRC field and the opaque blob ending at\nthe XDR buffer boundary, rotate_left() builds a zero-length\nsubbuffer, reaching the same division.\n\nReject the token at the server entry point before it reaches the\nkrb5 unwrap core. A valid sealed RFC 4121 token must contain\nthe 16-byte header plus at least some encrypted payload.\n\nFix by adding a minimum-length check immediately after the\nexisting upper-bound check:\n\n    if (len \u003c= GSS_KRB5_TOK_HDR_LEN)\n            goto unwrap_failed;"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - svcauth_gss_unwrap_priv() is reached from in-kernel nfsd over TCP/2049 (svc_authenticate \u2192 svcauth_gss_accept) and from the NFSv4.0 RPC_AUTH_GSS callback service, so a remote RPCSEC_GSS peer delivers the short krb5 wrap token over the network.\nAC:L - A single RPCSEC_GSS DATA Call with gc_svc=PRIVACY and opaque length in [0, 16] plus a non-zero RRC in the cleartext RFC 4121 header deterministically hits gss_krb5_unwrap_v2() rotate_left() u32 wrap and shift%=0; no race or attacker-uncontrollable layout is required.\nPR:N - A malicious NFS server that already shares a krb5p GSS context can send a crafted NFSv4.0 GSS callback into the client\u0027s svcauth_gss_unwrap_priv() with no account or capability on the victim. That peer path is the highest-severity reachability.\nUI:N - nfsd unwraps the Call in the service thread with no local user action. On the client, the NFSv4.0 GSS callback path runs from the callback service thread once an NFS/RPCSEC_GSS mount exists; no additional mount, click, or open is required at attack time.\nS:U - The out-of-bounds accesses, divide-by-zero, and underflowed memmove corrupt host kernel SUNRPC/GSS state on the machine processing the RPC. This is ordinary same-host kernel impact, not a VM escape, IOMMU bypass, or other changed-scope boundary.\nC:H - Short tokens make gss_krb5_unwrap_v2() read EC/RRC past the token, and the dead BUG_ON lets unsigned movelen underflow into a ~UINT_MAX-byte memmove that copies kernel memory beyond the receive head; that unbounded read is C:H per kernel CNA memory-corruption guidance.\nI:H - The same underflowed memmove() writes near 4GiB through the RPC receive head, an out-of-bounds write exploitable for control-flow hijack. rotate_left() also ignores xdr_buf_subsegment() failure after u32 wrap and then writes through a subbuf whose length has wrapped.\nA:H - _rotate_left() does shift %= buf-\u003elen on a zero-length subbuffer (header-only token at the XDR boundary), a divide-by-zero oops/panic; the UINT_MAX memmove and wrapped-length rotate loop hang or oops nfsd/callback threads, and the attacker can repeat the RPC to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:48:43.080Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ea5b0c7f212c2772d32c2b88287b89a9cdf6edd"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd6afc6cab8c5d387d1ed2f069562ef7bdadd651"
        },
        {
          "url": "https://git.kernel.org/stable/c/de942dd8c2c8358bcad04ce44271954c48924423"
        },
        {
          "url": "https://git.kernel.org/stable/c/2eed1e6a976a44015c3ee78841fe336796e2b21c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a919c5c88769cf8fb3ec071e6078d830bf512489"
        }
      ],
      "title": "SUNRPC: svcauth_gss: enforce krb5 token minimum length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89550",
    "datePublished": "2026-09-11T19:44:24.572Z",
    "dateReserved": "2026-09-11T19:38:34.723Z",
    "dateUpdated": "2026-10-19T08:48:43.080Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}