Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1374
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian 13 trixie versions ant\u00e9rieures \u00e0 6.12.113-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-98190",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98190"
},
{
"name": "CVE-2026-98302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98302"
},
{
"name": "CVE-2026-89797",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89797"
},
{
"name": "CVE-2026-98311",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98311"
},
{
"name": "CVE-2026-97536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97536"
},
{
"name": "CVE-2026-98179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98179"
},
{
"name": "CVE-2026-93199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93199"
},
{
"name": "CVE-2026-98325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98325"
},
{
"name": "CVE-2026-98266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98266"
},
{
"name": "CVE-2026-98187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98187"
},
{
"name": "CVE-2026-97537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97537"
},
{
"name": "CVE-2026-98287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98287"
},
{
"name": "CVE-2026-98339",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98339"
},
{
"name": "CVE-2026-98260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98260"
},
{
"name": "CVE-2026-98239",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98239"
},
{
"name": "CVE-2026-98335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98335"
},
{
"name": "CVE-2026-98295",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98295"
},
{
"name": "CVE-2026-98214",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98214"
},
{
"name": "CVE-2026-97609",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97609"
},
{
"name": "CVE-2026-98272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98272"
},
{
"name": "CVE-2026-98430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98430"
},
{
"name": "CVE-2026-98283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98283"
},
{
"name": "CVE-2026-98306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98306"
},
{
"name": "CVE-2026-98336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98336"
},
{
"name": "CVE-2026-98217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98217"
},
{
"name": "CVE-2026-89972",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89972"
},
{
"name": "CVE-2026-98264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98264"
},
{
"name": "CVE-2026-93243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93243"
},
{
"name": "CVE-2026-97531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97531"
},
{
"name": "CVE-2026-81016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-81016"
},
{
"name": "CVE-2026-98426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98426"
},
{
"name": "CVE-2026-89838",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89838"
},
{
"name": "CVE-2026-89638",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89638"
},
{
"name": "CVE-2026-98365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98365"
},
{
"name": "CVE-2026-90013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90013"
},
{
"name": "CVE-2026-98262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98262"
},
{
"name": "CVE-2026-98257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98257"
},
{
"name": "CVE-2026-98207",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98207"
},
{
"name": "CVE-2026-97906",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97906"
},
{
"name": "CVE-2026-98359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98359"
},
{
"name": "CVE-2026-98173",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98173"
},
{
"name": "CVE-2026-98346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98346"
},
{
"name": "CVE-2026-98255",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98255"
},
{
"name": "CVE-2026-98326",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98326"
},
{
"name": "CVE-2026-89467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89467"
},
{
"name": "CVE-2026-98362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98362"
},
{
"name": "CVE-2026-98347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98347"
},
{
"name": "CVE-2026-89868",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89868"
},
{
"name": "CVE-2026-89840",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89840"
},
{
"name": "CVE-2026-89832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89832"
},
{
"name": "CVE-2026-98193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98193"
},
{
"name": "CVE-2026-98377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98377"
},
{
"name": "CVE-2026-89527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89527"
},
{
"name": "CVE-2026-98378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98378"
},
{
"name": "CVE-2026-89806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89806"
},
{
"name": "CVE-2026-98161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98161"
},
{
"name": "CVE-2026-98345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98345"
},
{
"name": "CVE-2026-98253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98253"
},
{
"name": "CVE-2026-98354",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98354"
},
{
"name": "CVE-2026-98247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98247"
},
{
"name": "CVE-2026-98322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98322"
},
{
"name": "CVE-2026-98200",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98200"
},
{
"name": "CVE-2026-98429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98429"
},
{
"name": "CVE-2026-98263",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98263"
},
{
"name": "CVE-2026-97919",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97919"
},
{
"name": "CVE-2026-98230",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98230"
},
{
"name": "CVE-2026-98331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98331"
},
{
"name": "CVE-2026-98303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98303"
},
{
"name": "CVE-2026-98175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98175"
},
{
"name": "CVE-2026-98238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98238"
},
{
"name": "CVE-2026-97603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97603"
},
{
"name": "CVE-2026-98409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98409"
},
{
"name": "CVE-2026-98231",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98231"
},
{
"name": "CVE-2026-98375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98375"
},
{
"name": "CVE-2026-98205",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98205"
},
{
"name": "CVE-2026-98269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98269"
},
{
"name": "CVE-2026-98320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98320"
},
{
"name": "CVE-2026-90029",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90029"
},
{
"name": "CVE-2026-98352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98352"
},
{
"name": "CVE-2026-99999",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99999"
},
{
"name": "CVE-2026-97594",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97594"
},
{
"name": "CVE-2026-98351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98351"
},
{
"name": "CVE-2026-98171",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98171"
},
{
"name": "CVE-2026-90023",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90023"
},
{
"name": "CVE-2026-98300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98300"
},
{
"name": "CVE-2026-80935",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80935"
},
{
"name": "CVE-2026-98329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98329"
},
{
"name": "CVE-2026-98252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98252"
},
{
"name": "CVE-2026-98312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98312"
},
{
"name": "CVE-2026-98316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98316"
},
{
"name": "CVE-2026-98291",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98291"
},
{
"name": "CVE-2026-89956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89956"
},
{
"name": "CVE-2026-98421",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98421"
},
{
"name": "CVE-2026-98222",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98222"
},
{
"name": "CVE-2026-98314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98314"
},
{
"name": "CVE-2026-89859",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89859"
},
{
"name": "CVE-2026-98227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98227"
},
{
"name": "CVE-2026-98342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98342"
},
{
"name": "CVE-2026-98182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98182"
},
{
"name": "CVE-2026-98245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98245"
},
{
"name": "CVE-2026-98432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98432"
},
{
"name": "CVE-2026-97534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97534"
},
{
"name": "CVE-2026-98403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98403"
},
{
"name": "CVE-2026-98383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98383"
},
{
"name": "CVE-2026-98360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98360"
},
{
"name": "CVE-2026-89503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89503"
},
{
"name": "CVE-2026-98358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98358"
},
{
"name": "CVE-2026-97918",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97918"
},
{
"name": "CVE-2026-98172",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98172"
},
{
"name": "CVE-2026-97532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97532"
},
{
"name": "CVE-2026-98210",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98210"
},
{
"name": "CVE-2026-98366",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98366"
},
{
"name": "CVE-2026-98410",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98410"
},
{
"name": "CVE-2026-98186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98186"
},
{
"name": "CVE-2026-80937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80937"
},
{
"name": "CVE-2026-98174",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98174"
},
{
"name": "CVE-2026-98290",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98290"
},
{
"name": "CVE-2026-90030",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90030"
},
{
"name": "CVE-2026-98184",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98184"
},
{
"name": "CVE-2026-97528",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97528"
},
{
"name": "CVE-2026-97549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97549"
},
{
"name": "CVE-2026-90146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90146"
},
{
"name": "CVE-2026-98206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98206"
},
{
"name": "CVE-2026-98428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98428"
},
{
"name": "CVE-2026-97619",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97619"
},
{
"name": "CVE-2026-97935",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97935"
},
{
"name": "CVE-2026-98386",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98386"
},
{
"name": "CVE-2026-98185",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98185"
},
{
"name": "CVE-2026-98369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98369"
},
{
"name": "CVE-2026-97597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97597"
},
{
"name": "CVE-2026-52988",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52988"
},
{
"name": "CVE-2026-98168",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98168"
},
{
"name": "CVE-2026-98348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98348"
},
{
"name": "CVE-2026-98202",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98202"
},
{
"name": "CVE-2026-98251",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98251"
},
{
"name": "CVE-2026-98406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98406"
},
{
"name": "CVE-2026-97558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97558"
},
{
"name": "CVE-2026-98270",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98270"
},
{
"name": "CVE-2026-98189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98189"
},
{
"name": "CVE-2026-97559",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97559"
},
{
"name": "CVE-2026-89437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89437"
},
{
"name": "CVE-2026-98201",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98201"
},
{
"name": "CVE-2026-98265",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98265"
},
{
"name": "CVE-2026-93179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93179"
},
{
"name": "CVE-2026-89827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89827"
},
{
"name": "CVE-2026-97950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97950"
},
{
"name": "CVE-2026-80980",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80980"
},
{
"name": "CVE-2026-98198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98198"
},
{
"name": "CVE-2026-72463",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72463"
},
{
"name": "CVE-2026-98233",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98233"
},
{
"name": "CVE-2026-98416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98416"
},
{
"name": "CVE-2026-98261",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98261"
},
{
"name": "CVE-2026-93285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93285"
},
{
"name": "CVE-2026-97901",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97901"
},
{
"name": "CVE-2026-89441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89441"
},
{
"name": "CVE-2026-98423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98423"
},
{
"name": "CVE-2026-98169",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98169"
},
{
"name": "CVE-2026-98327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98327"
},
{
"name": "CVE-2025-40158",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40158"
},
{
"name": "CVE-2026-98271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98271"
},
{
"name": "CVE-2026-98344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98344"
},
{
"name": "CVE-2026-98422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98422"
},
{
"name": "CVE-2026-98411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98411"
},
{
"name": "CVE-2026-93196",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93196"
},
{
"name": "CVE-2026-98340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98340"
},
{
"name": "CVE-2026-98309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98309"
},
{
"name": "CVE-2026-98196",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98196"
},
{
"name": "CVE-2026-98191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98191"
},
{
"name": "CVE-2026-98373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98373"
},
{
"name": "CVE-2026-89500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89500"
},
{
"name": "CVE-2026-98235",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98235"
},
{
"name": "CVE-2026-97933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97933"
},
{
"name": "CVE-2026-98334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98334"
},
{
"name": "CVE-2026-98379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98379"
},
{
"name": "CVE-2026-97529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97529"
},
{
"name": "CVE-2026-98241",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98241"
},
{
"name": "CVE-2026-98343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98343"
},
{
"name": "CVE-2026-98425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98425"
},
{
"name": "CVE-2026-98412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98412"
},
{
"name": "CVE-2026-98308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98308"
},
{
"name": "CVE-2026-90002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90002"
},
{
"name": "CVE-2026-97566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97566"
},
{
"name": "CVE-2026-98298",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98298"
},
{
"name": "CVE-2026-98167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98167"
},
{
"name": "CVE-2026-98276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98276"
},
{
"name": "CVE-2026-98236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98236"
},
{
"name": "CVE-2026-89912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89912"
},
{
"name": "CVE-2026-98199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98199"
},
{
"name": "CVE-2026-98381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98381"
},
{
"name": "CVE-2026-98282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98282"
},
{
"name": "CVE-2026-98211",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98211"
},
{
"name": "CVE-2026-98229",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98229"
},
{
"name": "CVE-2026-98307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98307"
},
{
"name": "CVE-2026-98368",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98368"
},
{
"name": "CVE-2026-98234",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98234"
},
{
"name": "CVE-2026-98204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98204"
},
{
"name": "CVE-2026-97567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97567"
},
{
"name": "CVE-2026-98380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98380"
},
{
"name": "CVE-2026-98370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98370"
},
{
"name": "CVE-2026-98323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98323"
},
{
"name": "CVE-2026-98203",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98203"
},
{
"name": "CVE-2026-98384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98384"
},
{
"name": "CVE-2026-98297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98297"
},
{
"name": "CVE-2026-98367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98367"
},
{
"name": "CVE-2026-89766",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89766"
},
{
"name": "CVE-2026-98215",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98215"
},
{
"name": "CVE-2026-98337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98337"
},
{
"name": "CVE-2026-97934",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97934"
},
{
"name": "CVE-2026-98413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98413"
},
{
"name": "CVE-2026-98197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98197"
},
{
"name": "CVE-2026-90016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90016"
},
{
"name": "CVE-2026-89445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89445"
},
{
"name": "CVE-2026-74347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74347"
},
{
"name": "CVE-2026-93244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93244"
},
{
"name": "CVE-2026-98237",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98237"
},
{
"name": "CVE-2026-89633",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89633"
},
{
"name": "CVE-2026-98221",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98221"
},
{
"name": "CVE-2026-98363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98363"
},
{
"name": "CVE-2026-97571",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97571"
},
{
"name": "CVE-2026-97535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97535"
},
{
"name": "CVE-2026-98170",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98170"
},
{
"name": "CVE-2026-98301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98301"
},
{
"name": "CVE-2026-98213",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98213"
},
{
"name": "CVE-2026-98419",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98419"
},
{
"name": "CVE-2026-98299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98299"
},
{
"name": "CVE-2026-89795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89795"
},
{
"name": "CVE-2026-98293",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98293"
},
{
"name": "CVE-2026-98417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98417"
},
{
"name": "CVE-2026-98232",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98232"
},
{
"name": "CVE-2026-72315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72315"
},
{
"name": "CVE-2026-93231",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93231"
},
{
"name": "CVE-2026-98192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98192"
},
{
"name": "CVE-2026-80939",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80939"
},
{
"name": "CVE-2026-97949",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97949"
},
{
"name": "CVE-2026-98101",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98101"
},
{
"name": "CVE-2026-97620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97620"
},
{
"name": "CVE-2026-98212",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98212"
},
{
"name": "CVE-2026-97939",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97939"
},
{
"name": "CVE-2026-98407",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98407"
},
{
"name": "CVE-2026-89921",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89921"
},
{
"name": "CVE-2026-98246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98246"
},
{
"name": "CVE-2026-98374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98374"
},
{
"name": "CVE-2026-89452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89452"
},
{
"name": "CVE-2026-98209",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98209"
},
{
"name": "CVE-2026-97527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97527"
},
{
"name": "CVE-2026-98275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98275"
},
{
"name": "CVE-2026-98195",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98195"
},
{
"name": "CVE-2026-89520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89520"
},
{
"name": "CVE-2026-98267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98267"
},
{
"name": "CVE-2026-98181",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98181"
},
{
"name": "CVE-2026-98349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98349"
},
{
"name": "CVE-2026-97530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97530"
},
{
"name": "CVE-2026-98188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98188"
},
{
"name": "CVE-2026-98382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98382"
},
{
"name": "CVE-2026-97618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97618"
},
{
"name": "CVE-2026-98328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98328"
},
{
"name": "CVE-2026-98357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98357"
},
{
"name": "CVE-2026-98319",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98319"
},
{
"name": "CVE-2026-89837",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89837"
},
{
"name": "CVE-2025-38204",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38204"
},
{
"name": "CVE-2026-98249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98249"
},
{
"name": "CVE-2026-98216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98216"
},
{
"name": "CVE-2026-98218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98218"
},
{
"name": "CVE-2026-98248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98248"
},
{
"name": "CVE-2026-89996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89996"
},
{
"name": "CVE-2026-97615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97615"
},
{
"name": "CVE-2026-98194",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98194"
},
{
"name": "CVE-2026-98208",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98208"
},
{
"name": "CVE-2026-97574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97574"
},
{
"name": "CVE-2026-89971",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89971"
},
{
"name": "CVE-2026-97938",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97938"
},
{
"name": "CVE-2026-93200",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93200"
},
{
"name": "CVE-2026-98254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98254"
}
],
"initial_release_date": "2026-10-23T00:00:00",
"last_revision_date": "2026-10-23T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1374",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-23T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00482",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00482.html"
}
]
}
CVE-2026-98351 (GCVE-0-2026-98351)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: virt_wifi: free skb when disconnected
When the simulated link is disconnected, virt_wifi_start_xmit() returns
NET_XMIT_DROP without freeing the skb. dev_hard_start_xmit() treats this
return value as consumed, so every packet sent while disconnected leaks its
skb.
Free the skb before returning the drop status.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/virtual/virt_wifi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "38d3a5df85345f158f78b478b265ca906224454e",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "ee053ea35c759135460f03d1c574f4ed08de844a",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "d177eca79e1106834bc423d3969a4a2e3987996a",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "36727a702cf8e3399e3da60d0856378f6afcfb34",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "56469996c10a0240653fc00576b4d33bdfb4cc51",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "4f266738af45675faa0e8afee08c6e780afa8b06",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "46371442847a725cc0df3697fea2eba1dd54b82b",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "f9edf7cf63b96d2b776fca8d258d3c5256e40c8e",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/virtual/virt_wifi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: free skb when disconnected\n\nWhen the simulated link is disconnected, virt_wifi_start_xmit() returns\nNET_XMIT_DROP without freeing the skb. dev_hard_start_xmit() treats this\nreturn value as consumed, so every packet sent while disconnected leaks its\nskb.\n\nFree the skb before returning the drop status."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:02.098Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/38d3a5df85345f158f78b478b265ca906224454e"
},
{
"url": "https://git.kernel.org/stable/c/ee053ea35c759135460f03d1c574f4ed08de844a"
},
{
"url": "https://git.kernel.org/stable/c/d177eca79e1106834bc423d3969a4a2e3987996a"
},
{
"url": "https://git.kernel.org/stable/c/36727a702cf8e3399e3da60d0856378f6afcfb34"
},
{
"url": "https://git.kernel.org/stable/c/56469996c10a0240653fc00576b4d33bdfb4cc51"
},
{
"url": "https://git.kernel.org/stable/c/4f266738af45675faa0e8afee08c6e780afa8b06"
},
{
"url": "https://git.kernel.org/stable/c/46371442847a725cc0df3697fea2eba1dd54b82b"
},
{
"url": "https://git.kernel.org/stable/c/f9edf7cf63b96d2b776fca8d258d3c5256e40c8e"
}
],
"title": "wifi: virt_wifi: free skb when disconnected",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98351",
"datePublished": "2026-10-06T08:46:39.335Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-19T09:18:02.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89445 (GCVE-0-2026-89445)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-19 08:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Fix UAF in selftest IOPF reporting
IOMMUFD selftest TRIGGER_IOPF borrows an attach handle from
group->pasid_array without synchronizing against PASID detach,
then a concurrent iommu_report_device_fault() can dereference
that borrowed handle's domain pointer after the detach erases
the handle and frees the backing struct iommufd_attach_handle.
TRIGGER_IOPF then dereferences the freed handle, causing a UAF.
Fix by adding a iopf_rwsem in mock_dev to follow the expected design
of a real driver. Hold its read side across the whole
iommu_report_device_fault() call, and its write side around every
path that attaches, detaches, or replaces a device domain.
This can block new reports and drains in-flight reports before an old
attach handle or the IOPF fault parameter can be removed.
Also take the write side while registering a mock device, since
it can invoke the mock driver's default-domain attach callback.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/selftest.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fd2e7ac94d6d813548b021473c3dddc30c8c07d1",
"status": "affected",
"version": "ddee19971081b42615d62f4fdada21274708ed4d",
"versionType": "git"
},
{
"lessThan": "cab2895729516799384d48560e6fca105fb3f927",
"status": "affected",
"version": "ddee19971081b42615d62f4fdada21274708ed4d",
"versionType": "git"
},
{
"lessThan": "e27e90bde68b2ab92e63ed19caad1ef57188bea0",
"status": "affected",
"version": "ddee19971081b42615d62f4fdada21274708ed4d",
"versionType": "git"
},
{
"lessThan": "8c07df7cdfcf52f1ff276c588612aabc6c6b8399",
"status": "affected",
"version": "ddee19971081b42615d62f4fdada21274708ed4d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommufd/selftest.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Fix UAF in selftest IOPF reporting\n\nIOMMUFD selftest TRIGGER_IOPF borrows an attach handle from\ngroup-\u003epasid_array without synchronizing against PASID detach,\nthen a concurrent iommu_report_device_fault() can dereference\nthat borrowed handle\u0027s domain pointer after the detach erases\nthe handle and frees the backing struct iommufd_attach_handle.\nTRIGGER_IOPF then dereferences the freed handle, causing a UAF.\n\nFix by adding a iopf_rwsem in mock_dev to follow the expected design\nof a real driver. Hold its read side across the whole\niommu_report_device_fault() call, and its write side around every\npath that attaches, detaches, or replaces a device domain.\nThis can block new reports and drains in-flight reports before an old\nattach handle or the IOPF fault parameter can be removed.\nAlso take the write side while registering a mock device, since\nit can invoke the mock driver\u0027s default-domain attach callback."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached only via local ioctls on /dev/iommu (or VFIO-compat /dev/vfio/vfio): IOMMU_TEST_CMD TRIGGER_IOPF calls iommu_report_device_fault() while a concurrent PASID/RID detach frees the attach handle. No network or packet-receive path exists.\nAC:L - The attacker controls both sides of the race by issuing concurrent IOMMU_TEST_OP_TRIGGER_IOPF and PASID_DETACH/REPLACE or mock-domain destroy on the same fd; iommu_attach_handle_get() does not keep the handle alive after lookup, so no victim timing or uncontrollable layout is required.\nPR:L - iommufd_fops_open() and IOMMU_TEST_CMD perform no capability checks; /dev/iommu is 0660 and MOCK_DOMAIN creates an IOPF-capable mock device without physical assignment, so an unprivileged local user with iommufd access (selftest/syzkaller kernels or VFIO/iommufd group membership) can trigger it without init-namespace root.\nUI:N - Exploitation requires no victim action; the attacker programmatically opens iommufd, creates a mock domain, attaches a PASID, and races TRIGGER_IOPF against detach through their own file descriptors and ioctls.\nS:C - The freed object is struct iommufd_attach_handle used by iommu_report_device_fault() to dispatch domain-\u003eiopf_handler and complete IOMMU page faults; pre-fix TRIGGER_IOPF also accepted any bound idev, so corrupting those handles can hijack IOMMU fault/DMA isolation across the device-assignment boundary.\nC:H - Use-after-free of iommufd_attach_handle lets an attacker reclaim the slab and control the domain pointer later read as attach_handle-\u003edomain-\u003eiopf_handler, enabling arbitrary kernel reads through the IOPF handler and fault-queue path.\nI:H - The UAF is a function-pointer dereference of domain-\u003eiopf_handler plus later handle use in iommufd_fault_iopf_handler; heap spraying yields an arbitrary write and control-flow hijack in the IOMMU fault-completion path.\nA:H - Dereferencing the freed attach handle in find_fault_handler()/iommu_report_device_fault() causes a kernel oops or panic; the UAF is reliably crashable even when not fully exploited for code execution."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:46:54.686Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fd2e7ac94d6d813548b021473c3dddc30c8c07d1"
},
{
"url": "https://git.kernel.org/stable/c/cab2895729516799384d48560e6fca105fb3f927"
},
{
"url": "https://git.kernel.org/stable/c/e27e90bde68b2ab92e63ed19caad1ef57188bea0"
},
{
"url": "https://git.kernel.org/stable/c/8c07df7cdfcf52f1ff276c588612aabc6c6b8399"
}
],
"title": "iommufd: Fix UAF in selftest IOPF reporting",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89445",
"datePublished": "2026-09-11T19:43:12.765Z",
"dateReserved": "2026-09-11T19:38:34.704Z",
"dateUpdated": "2026-10-19T08:46:54.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98241 (GCVE-0-2026-98241)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: xfrm: use full sockets in local error paths
xfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb->sk as if it
always pointed at a full IPv6 socket.
That is not guaranteed. TCP SYN-ACK skbs can be owned by a
TCP_NEW_SYN_RECV request_sock while the output path itself is driven by the
full listener. If rerouting selects an IPv6 XFRM tunnel route with a lower
MTU, the local PMTU/error handling path can reach these callbacks with that
mini-socket still attached to the skb.
The callbacks then miscast the request socket as a full inet/IPv6 socket and
can read beyond the request_sock allocation when they access inet_sock or
ipv6_pinfo state.
Resolve the owner with skb_to_full_sk() in both callbacks and bail out when
no full socket is attached. This matches the surrounding XFRM IPv6 PMTU/error
logic, which already reasons about full sockets with skb_to_full_sk().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dd767856a36e00b631d65ebc4bb81b19915532d6 Version: dd767856a36e00b631d65ebc4bb81b19915532d6 Version: dd767856a36e00b631d65ebc4bb81b19915532d6 Version: dd767856a36e00b631d65ebc4bb81b19915532d6 Version: dd767856a36e00b631d65ebc4bb81b19915532d6 Version: dd767856a36e00b631d65ebc4bb81b19915532d6 Version: dd767856a36e00b631d65ebc4bb81b19915532d6 Version: dd767856a36e00b631d65ebc4bb81b19915532d6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/xfrm6_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b1a88633c36d2cbc3831382f3846754d344276fd",
"status": "affected",
"version": "dd767856a36e00b631d65ebc4bb81b19915532d6",
"versionType": "git"
},
{
"lessThan": "904a0e827d0d7189271a3a2eb648293809f25efc",
"status": "affected",
"version": "dd767856a36e00b631d65ebc4bb81b19915532d6",
"versionType": "git"
},
{
"lessThan": "675919e08ce266b8cac11fd9af29170e762a480f",
"status": "affected",
"version": "dd767856a36e00b631d65ebc4bb81b19915532d6",
"versionType": "git"
},
{
"lessThan": "60459c670329d586a58db5d8f811fa5accfe4862",
"status": "affected",
"version": "dd767856a36e00b631d65ebc4bb81b19915532d6",
"versionType": "git"
},
{
"lessThan": "ca3d68c3213475b53db6647e159dc73bd1af5ab1",
"status": "affected",
"version": "dd767856a36e00b631d65ebc4bb81b19915532d6",
"versionType": "git"
},
{
"lessThan": "4c030a0400ebfd2318361c923a88103b2c67c49f",
"status": "affected",
"version": "dd767856a36e00b631d65ebc4bb81b19915532d6",
"versionType": "git"
},
{
"lessThan": "c21f3f7fbfeda7c5794f606cb0ffcc2d9001eef8",
"status": "affected",
"version": "dd767856a36e00b631d65ebc4bb81b19915532d6",
"versionType": "git"
},
{
"lessThan": "6973a21ee73c5567f883813c8ef414774b45892f",
"status": "affected",
"version": "dd767856a36e00b631d65ebc4bb81b19915532d6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/xfrm6_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: xfrm: use full sockets in local error paths\n\nxfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb-\u003esk as if it\nalways pointed at a full IPv6 socket.\n\nThat is not guaranteed. TCP SYN-ACK skbs can be owned by a\nTCP_NEW_SYN_RECV request_sock while the output path itself is driven by the\nfull listener. If rerouting selects an IPv6 XFRM tunnel route with a lower\nMTU, the local PMTU/error handling path can reach these callbacks with that\nmini-socket still attached to the skb.\n\nThe callbacks then miscast the request socket as a full inet/IPv6 socket and\ncan read beyond the request_sock allocation when they access inet_sock or\nipv6_pinfo state.\n\nResolve the owner with skb_to_full_sk() in both callbacks and bail out when\nno full socket is attached. This matches the surrounding XFRM IPv6 PMTU/error\nlogic, which already reasons about full sockets with skb_to_full_sk()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The fixed xfrm6_local_error() is reached via __xfrm6_output() -\u003e xfrm_local_error() only if a rerouted SYN-ACK exceeds an xfrm tunnel MTU below ~100 bytes; that needs local xfrm/route/netfilter setup. A remote SYN carries no malformed data and can\u0027t create this state (IPv4 PMTU floor is 552, xfrm6_tunnel_check_size clamps to 1280).\nAC:L - The attacker builds every precondition: an IPv6-in-IPv4 tunnel-mode xfrm SA/policy, a tiny outer MTU, a LOCAL_OUT reroute, and a TCP listener they connect to. Each SYN deterministically sends a SYN-ACK owned by a TCP_NEW_SYN_RECV request_sock down the !ignore_df \u0026\u0026 toobig branch.\nPR:L - The needed XFRM_MSG_NEWSA/NEWPOLICY, nftables rules and link MTU changes only need CAP_NET_ADMIN in the netns, which an unprivileged user gets via unshare -Urn; the listener and connect() are ordinary syscalls.\nUI:N - The attacker sets up the namespace and drives the handshake that emits the SYN-ACK themselves; no other user has to do anything.\nS:U - The out-of-bounds access corrupts kernel heap memory in the same kernel that enforces the attacker\u0027s namespace; no hypervisor or IOMMU boundary is crossed.\nC:H - xfrm6_local_error() passes the request_sock to ipv6_local_error() as a full IPv6 socket; inet6_test_bit(RECVERR6) reads inet_flags past the end of the tcp6_request_sock allocation, into the next slab object, and the rest of the path keeps reading socket fields out of bounds.\nI:H - If the out-of-bounds RECVERR6 bit is set, sock_queue_err_skb() does atomic_add on an OOB sk_rmem_alloc, links an skb into an OOB sk_error_queue list and calls the OOB sk_error_report pointer: heap writes plus control-flow hijack if the attacker grooms the adjacent object.\nA:H - Treating neighbouring slab memory as sk_error_queue and sk_error_report gives list corruption or a wild indirect call, crashing the kernel; the attacker can repeat it with each SYN."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:12.796Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b1a88633c36d2cbc3831382f3846754d344276fd"
},
{
"url": "https://git.kernel.org/stable/c/904a0e827d0d7189271a3a2eb648293809f25efc"
},
{
"url": "https://git.kernel.org/stable/c/675919e08ce266b8cac11fd9af29170e762a480f"
},
{
"url": "https://git.kernel.org/stable/c/60459c670329d586a58db5d8f811fa5accfe4862"
},
{
"url": "https://git.kernel.org/stable/c/ca3d68c3213475b53db6647e159dc73bd1af5ab1"
},
{
"url": "https://git.kernel.org/stable/c/4c030a0400ebfd2318361c923a88103b2c67c49f"
},
{
"url": "https://git.kernel.org/stable/c/c21f3f7fbfeda7c5794f606cb0ffcc2d9001eef8"
},
{
"url": "https://git.kernel.org/stable/c/6973a21ee73c5567f883813c8ef414774b45892f"
}
],
"title": "ipv6: xfrm: use full sockets in local error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98241",
"datePublished": "2026-10-06T08:45:11.954Z",
"dateReserved": "2026-09-25T10:25:14.329Z",
"dateUpdated": "2026-10-19T09:16:12.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89503 (GCVE-0-2026-89503)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-19 08:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set,
it can allocate a reader page with an outdated order. This isn't a big
issue, the user can still re-allocate a new reader page and try again.
However, what is more problematic is if the value of subbuf_order
changes in the middle of ring_buffer_alloc_read_page(). In that case,
bpage->order might not match the actual allocated memory.
Use bpage->order for the allocation to prevent this race.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2313ff69bd237aad264a5913907f374f958335a2",
"status": "affected",
"version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
"versionType": "git"
},
{
"lessThan": "2dc510957fe8fd098ab3c3147ebdf34d00cd2734",
"status": "affected",
"version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
"versionType": "git"
},
{
"lessThan": "53106e9262a310ef2c9a9321168c03705940c678",
"status": "affected",
"version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
"versionType": "git"
},
{
"lessThan": "e743527c5bfdceda1095bc0a9e596e2aebb6a9c3",
"status": "affected",
"version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()\n\nring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set,\nit can allocate a reader page with an outdated order. This isn\u0027t a big\nissue, the user can still re-allocate a new reader page and try again.\n\nHowever, what is more problematic is if the value of subbuf_order\nchanges in the middle of ring_buffer_alloc_read_page(). In that case,\nbpage-\u003eorder might not match the actual allocated memory.\n\nUse bpage-\u003eorder for the allocation to prevent this race."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local tracefs: read() on per_cpu/*/trace_pipe_raw or snapshot_raw (tracing_buffers_read -\u003e ring_buffer_alloc_read_page) racing with write() to buffer_subbuf_size_kb. No network, adjacent-radio, or physical path reaches this code.\nAC:L - The attacker controls both sides: one thread reads trace_pipe_raw while another writes buffer_subbuf_size_kb. GFP_KERNEL in alloc_cpu_data sleeps, so subbuf_order can change between the two reads in ring_buffer_alloc_read_page(); the race is reliably retried.\nPR:L - tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC with no capable() check. trace_pipe_raw is 0440 and buffer_subbuf_size_kb is 0640, routinely delegated via gid=/mode= to tracing-group members on Android/Perfetto, ChromeOS, and developer systems.\nUI:N - Exploitation uses the attacker\u0027s own tracefs file descriptors and threads. No separate victim mount, click, or configuration action is required beyond the attacker holding tracefs access.\nS:U - Wrong-order page allocation and free corrupt the kernel buddy allocator and ring-buffer pages within the same OS security authority. This enables local privilege escalation but does not cross VM, IOMMU, or hardware trust boundaries.\nC:H - When bpage-\u003eorder does not match the alloc_pages() size, later copy_to_user of a stale page_size and ring_buffer_read_page memcpy/memset over-read adjacent kernel pages, and wrong-order free_pages() corrupts the buddy allocator, yielding arbitrary kernel reads.\nI:H - free_pages() with a larger order than allocated, or memcpy/memset into an undersized sub-buffer when reader_page-\u003eorder later matches the stale bpage-\u003eorder, corrupts adjacent pages and the buddy allocator, which is exploitable for arbitrary kernel writes.\nA:H - Wrong-order free_pages() and out-of-bounds writes on undersized compound pages crash the kernel via buddy-allocator corruption or oops in ring_buffer_read_page/free_read_page. The attacker can retrigger the race at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:47:54.761Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2313ff69bd237aad264a5913907f374f958335a2"
},
{
"url": "https://git.kernel.org/stable/c/2dc510957fe8fd098ab3c3147ebdf34d00cd2734"
},
{
"url": "https://git.kernel.org/stable/c/53106e9262a310ef2c9a9321168c03705940c678"
},
{
"url": "https://git.kernel.org/stable/c/e743527c5bfdceda1095bc0a9e596e2aebb6a9c3"
}
],
"title": "ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89503",
"datePublished": "2026-09-11T19:43:51.357Z",
"dateReserved": "2026-09-11T19:38:34.715Z",
"dateUpdated": "2026-10-19T08:47:54.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98422 (GCVE-0-2026-98422)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
On ifup, AP_VLAN interfaces get crypto_tx_tailroom_needed_cnt from
the AP interface, but it's never decremented again unless the AP is
also brought down. Thus, bringing the same AP_VLAN up again will
increment the counter again and eventually hit the sanity check:
WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt !=
master->crypto_tx_tailroom_needed_cnt);
Reset it on ifdown to avoid that.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 Version: f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 Version: f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 Version: f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 Version: f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 Version: f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 Version: f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 Version: f9dca80b98caac8b4bfb43a2edf1e9f877ccf322 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/iface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b0b32d3f163d24ea7134380666193bf398e9dc0b",
"status": "affected",
"version": "f9dca80b98caac8b4bfb43a2edf1e9f877ccf322",
"versionType": "git"
},
{
"lessThan": "f6b34a7d64324faf28eedc0f8678b0f832f1cc36",
"status": "affected",
"version": "f9dca80b98caac8b4bfb43a2edf1e9f877ccf322",
"versionType": "git"
},
{
"lessThan": "304a874670a0b6ab5589a7f60b4af0251797b121",
"status": "affected",
"version": "f9dca80b98caac8b4bfb43a2edf1e9f877ccf322",
"versionType": "git"
},
{
"lessThan": "7775759e3cb35ef5a571b2d877c2a9b70a5d5f08",
"status": "affected",
"version": "f9dca80b98caac8b4bfb43a2edf1e9f877ccf322",
"versionType": "git"
},
{
"lessThan": "3d76b45e8432c0d75fcb9e90d92eaa3176898adf",
"status": "affected",
"version": "f9dca80b98caac8b4bfb43a2edf1e9f877ccf322",
"versionType": "git"
},
{
"lessThan": "4b54d01b48445b66c9e576de92b90a3a3ae7b34a",
"status": "affected",
"version": "f9dca80b98caac8b4bfb43a2edf1e9f877ccf322",
"versionType": "git"
},
{
"lessThan": "875835377d8d62c849b4eb03a7abfafa71d7668f",
"status": "affected",
"version": "f9dca80b98caac8b4bfb43a2edf1e9f877ccf322",
"versionType": "git"
},
{
"lessThan": "4504f3960dc4501c73be9f99eabda2e26e9db41e",
"status": "affected",
"version": "f9dca80b98caac8b4bfb43a2edf1e9f877ccf322",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/iface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reset the AP_VLAN tailroom counter on ifdown\n\nOn ifup, AP_VLAN interfaces get crypto_tx_tailroom_needed_cnt from\nthe AP interface, but it\u0027s never decremented again unless the AP is\nalso brought down. Thus, bringing the same AP_VLAN up again will\nincrement the counter again and eventually hit the sanity check:\n\n WARN_ON_ONCE(sdata-\u003ecrypto_tx_tailroom_needed_cnt !=\n master-\u003ecrypto_tx_tailroom_needed_cnt);\n\nReset it on ifdown to avoid that."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:15.873Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b0b32d3f163d24ea7134380666193bf398e9dc0b"
},
{
"url": "https://git.kernel.org/stable/c/f6b34a7d64324faf28eedc0f8678b0f832f1cc36"
},
{
"url": "https://git.kernel.org/stable/c/304a874670a0b6ab5589a7f60b4af0251797b121"
},
{
"url": "https://git.kernel.org/stable/c/7775759e3cb35ef5a571b2d877c2a9b70a5d5f08"
},
{
"url": "https://git.kernel.org/stable/c/3d76b45e8432c0d75fcb9e90d92eaa3176898adf"
},
{
"url": "https://git.kernel.org/stable/c/4b54d01b48445b66c9e576de92b90a3a3ae7b34a"
},
{
"url": "https://git.kernel.org/stable/c/875835377d8d62c849b4eb03a7abfafa71d7668f"
},
{
"url": "https://git.kernel.org/stable/c/4504f3960dc4501c73be9f99eabda2e26e9db41e"
}
],
"title": "wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98422",
"datePublished": "2026-10-14T13:27:50.789Z",
"dateReserved": "2026-09-25T10:25:14.348Z",
"dateUpdated": "2026-10-19T09:19:15.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98380 (GCVE-0-2026-98380)
Vulnerability from cvelistv5
Published
2026-10-09 07:34
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: reject IDR error pointers when deleting actions
tcf_action_delete() drops the reference held by its lookup before calling
tcf_idr_delete_index() with the saved action index. An unlocked
classifier can remove that action and reserve the same IDR slot with
ERR_PTR(-EBUSY) in between.
tcf_idr_delete_index() only checks the lookup result for NULL. It
therefore treats the reservation as a tc_action and dereferences
tcfa_bindcnt. A hardware execution breakpoint was used to schedule the
interleaving without changing the kernel source. KASAN reported this
decoded trace:
BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010
Read of size 4 at addr 0000000000000010 by task poc/150
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002
RIP: tca_action_gd+0x5c0/0x1010:
arch_atomic_read at arch/x86/include/asm/atomic.h:23
raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457
atomic_read at include/linux/atomic/atomic-instrumented.h:33
tcf_idr_delete_index at net/sched/act_api.c:766
tcf_action_delete at net/sched/act_api.c:1859
tcf_del_notify at net/sched/act_api.c:2014
tca_action_gd at net/sched/act_api.c:2064
R13: 0000000000000010 R15: fffffffffffffff0
Kernel panic - not syncing: Fatal exception
R15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces
the address in R13. With the guard applied, the same reproducer returned
-ENOENT without a KASAN report or panic. Treat error pointers as absent
and return -ENOENT.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0190c1d452a91c38a3462abdd81752be1b9006a8 Version: 0190c1d452a91c38a3462abdd81752be1b9006a8 Version: 0190c1d452a91c38a3462abdd81752be1b9006a8 Version: 0190c1d452a91c38a3462abdd81752be1b9006a8 Version: 0190c1d452a91c38a3462abdd81752be1b9006a8 Version: 0190c1d452a91c38a3462abdd81752be1b9006a8 Version: 0190c1d452a91c38a3462abdd81752be1b9006a8 Version: 0190c1d452a91c38a3462abdd81752be1b9006a8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "39b751a210bf61a374afa82749afc7a77a08bf1d",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "dd80a7519824b72c8fcfd3cc50cb93f7e2d90923",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "6bf076258aac4e0af69ef317656c31ce6444d647",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "6c9f07bf8800171de2cd3f02815cebe1f4d45f2d",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "259caa711b7688365676442e2fdb286b8aceaa80",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "968550a439f64bd1a6c0d88efb92e4f082f84a26",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "a9551f26287debe6d8aa6e8841974661065b975f",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
},
{
"lessThan": "c82b797abe668d0b668601a93ba2c0b071a63574",
"status": "affected",
"version": "0190c1d452a91c38a3462abdd81752be1b9006a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: reject IDR error pointers when deleting actions\n\ntcf_action_delete() drops the reference held by its lookup before calling\ntcf_idr_delete_index() with the saved action index. An unlocked\nclassifier can remove that action and reserve the same IDR slot with\nERR_PTR(-EBUSY) in between.\n\ntcf_idr_delete_index() only checks the lookup result for NULL. It\ntherefore treats the reservation as a tc_action and dereferences\ntcfa_bindcnt. A hardware execution breakpoint was used to schedule the\ninterleaving without changing the kernel source. KASAN reported this\ndecoded trace:\n\n BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010\n Read of size 4 at addr 0000000000000010 by task poc/150\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002\n RIP: tca_action_gd+0x5c0/0x1010:\n arch_atomic_read at arch/x86/include/asm/atomic.h:23\n raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457\n atomic_read at include/linux/atomic/atomic-instrumented.h:33\n tcf_idr_delete_index at net/sched/act_api.c:766\n tcf_action_delete at net/sched/act_api.c:1859\n tcf_del_notify at net/sched/act_api.c:2014\n tca_action_gd at net/sched/act_api.c:2064\n R13: 0000000000000010 R15: fffffffffffffff0\n Kernel panic - not syncing: Fatal exception\n\nR15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces\nthe address in R13. With the guard applied, the same reproducer returned\n-ENOENT without a KASAN report or panic. Treat error pointers as absent\nand return -ENOENT."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:31.007Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/39b751a210bf61a374afa82749afc7a77a08bf1d"
},
{
"url": "https://git.kernel.org/stable/c/dd80a7519824b72c8fcfd3cc50cb93f7e2d90923"
},
{
"url": "https://git.kernel.org/stable/c/6bf076258aac4e0af69ef317656c31ce6444d647"
},
{
"url": "https://git.kernel.org/stable/c/6c9f07bf8800171de2cd3f02815cebe1f4d45f2d"
},
{
"url": "https://git.kernel.org/stable/c/259caa711b7688365676442e2fdb286b8aceaa80"
},
{
"url": "https://git.kernel.org/stable/c/968550a439f64bd1a6c0d88efb92e4f082f84a26"
},
{
"url": "https://git.kernel.org/stable/c/a9551f26287debe6d8aa6e8841974661065b975f"
},
{
"url": "https://git.kernel.org/stable/c/c82b797abe668d0b668601a93ba2c0b071a63574"
}
],
"title": "net/sched: reject IDR error pointers when deleting actions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98380",
"datePublished": "2026-10-09T07:34:20.218Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-19T09:18:31.007Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98384 (GCVE-0-2026-98384)
Vulnerability from cvelistv5
Published
2026-10-09 07:34
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
sk_protocol lives in struct sock, not in struct sock_common. A timewait
or request sock handed to bpf_sock_destroy() by the tcp iterator is
neither, so reading sk->sk_protocol runs past the object:
==================================================================
BUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0
Read of size 2 at addr ffff8881047d11b4 by task test_progs/428
Tainted: [W]=WARN
Call Trace:
<TASK>
dump_stack_lvl+0x91/0xf0
print_report+0xd1/0x630
kasan_report+0xf3/0x130
__asan_report_load2_noabort+0x14/0x30
bpf_sock_destroy+0xc7/0xe0
bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7
bpf_iter_run_prog+0x538/0xde0
bpf_iter_tcp_seq_show+0x26b/0x4b0
bpf_seq_read+0x424/0x1210
vfs_read+0x197/0xe40
ksys_read+0x119/0x240
__x64_sys_read+0x72/0xc0
x64_sys_call+0x647/0x27e0
do_syscall_64+0xe5/0x610
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Only check sk_protocol on full socks. tcp_abort() already knows how to
deal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it
never matched the code.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5b4eb82475ae17d55974235c09e97044829426a8",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "a9651704c6fd64590b5ad4fbe7c3768accf95993",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "91a482a81eabddebf5430cbbdf12027e1a91b767",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "2534a5e5d360c2b10203cfa80f4ab9d021e48f2f",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
},
{
"lessThan": "01b245ba016d44861690594e10f67e026ce8552f",
"status": "affected",
"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()\n\nsk_protocol lives in struct sock, not in struct sock_common. A timewait\nor request sock handed to bpf_sock_destroy() by the tcp iterator is\nneither, so reading sk-\u003esk_protocol runs past the object:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0\nRead of size 2 at addr ffff8881047d11b4 by task test_progs/428\n\nTainted: [W]=WARN\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x91/0xf0\n print_report+0xd1/0x630\n kasan_report+0xf3/0x130\n __asan_report_load2_noabort+0x14/0x30\n bpf_sock_destroy+0xc7/0xe0\n bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7\n bpf_iter_run_prog+0x538/0xde0\n bpf_iter_tcp_seq_show+0x26b/0x4b0\n bpf_seq_read+0x424/0x1210\n vfs_read+0x197/0xe40\n ksys_read+0x119/0x240\n __x64_sys_read+0x72/0xc0\n x64_sys_call+0x647/0x27e0\n do_syscall_64+0xe5/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nOnly check sk_protocol on full socks. tcp_abort() already knows how to\ndeal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it\nnever matched the code."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:35.149Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5b4eb82475ae17d55974235c09e97044829426a8"
},
{
"url": "https://git.kernel.org/stable/c/a9651704c6fd64590b5ad4fbe7c3768accf95993"
},
{
"url": "https://git.kernel.org/stable/c/91a482a81eabddebf5430cbbdf12027e1a91b767"
},
{
"url": "https://git.kernel.org/stable/c/2534a5e5d360c2b10203cfa80f4ab9d021e48f2f"
},
{
"url": "https://git.kernel.org/stable/c/01b245ba016d44861690594e10f67e026ce8552f"
}
],
"title": "bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98384",
"datePublished": "2026-10-09T07:34:23.097Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-19T09:18:35.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97571 (GCVE-0-2026-97571)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-19 09:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()
bnxt_alloc_one_tpa_info_data() returns -ENOMEM as soon as one allocation
fails. This leaves the remaining rxr->rx_tpa[] entries zeroed.
bnxt_queue_mem_alloc() discards that return value, so the partially
initialized ring is installed by bnxt_queue_start().
Since the agg_id is picked by the hardware and bnxt_alloc_agg_idx maps
it to a SW index in rxr->rx_tpa[], it is possible that an uninitialized
slot can be chosen which would hand a zero DMA address to the device.
Fix this by checking the return value of bnxt_alloc_one_tpa_info_data
and unwinding, freeing the ring buffers.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d7db2e4953e4626339fd0075564a3e447650d37b",
"status": "affected",
"version": "0997443906b96a051011f220a61e6dce4602ec54",
"versionType": "git"
},
{
"lessThan": "c8050386a2209b2a474c1eb4bd1574dc19129bfb",
"status": "affected",
"version": "bd649c5cc958169b8a8a3e77ea926d92d472b02a",
"versionType": "git"
},
{
"lessThan": "37e08dc821a57fe0592c917486b638caa888b46d",
"status": "affected",
"version": "bd649c5cc958169b8a8a3e77ea926d92d472b02a",
"versionType": "git"
},
{
"lessThan": "b814dfbfeb0a68c9a52073f2caa05a2d5247a329",
"status": "affected",
"version": "bd649c5cc958169b8a8a3e77ea926d92d472b02a",
"versionType": "git"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "6.12.20",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()\n\nbnxt_alloc_one_tpa_info_data() returns -ENOMEM as soon as one allocation\nfails. This leaves the remaining rxr-\u003erx_tpa[] entries zeroed.\n\nbnxt_queue_mem_alloc() discards that return value, so the partially\ninitialized ring is installed by bnxt_queue_start().\n\nSince the agg_id is picked by the hardware and bnxt_alloc_agg_idx maps\nit to a SW index in rxr-\u003erx_tpa[], it is possible that an uninitialized\nslot can be chosen which would hand a zero DMA address to the device.\n\nFix this by checking the return value of bnxt_alloc_one_tpa_info_data\nand unwinding, freeing the ring buffers."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:09:33.921Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d7db2e4953e4626339fd0075564a3e447650d37b"
},
{
"url": "https://git.kernel.org/stable/c/c8050386a2209b2a474c1eb4bd1574dc19129bfb"
},
{
"url": "https://git.kernel.org/stable/c/37e08dc821a57fe0592c917486b638caa888b46d"
},
{
"url": "https://git.kernel.org/stable/c/b814dfbfeb0a68c9a52073f2caa05a2d5247a329"
}
],
"title": "bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97571",
"datePublished": "2026-09-25T10:21:56.208Z",
"dateReserved": "2026-09-24T16:01:01.155Z",
"dateUpdated": "2026-10-19T09:09:33.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98334 (GCVE-0-2026-98334)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: reset state when starting AP fails
ieee80211_start_ap() can set enable_beacon (and beacon_int) and fail
later, leaving it set forever. Scanning can then attempt to restore
beaconing on such an interface, leading to:
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:mac80211_hwsim_link_info_changed+0xca7/0xf00
Call Trace:
drv_link_info_changed+0x413/0x860 net/mac80211/driver-ops.c:495
ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427
ieee80211_offchannel_return+0x381/0x580 net/mac80211/offchannel.c:160
__ieee80211_scan_completed+0x993/0xe30 net/mac80211/scan.c:519
ieee80211_scan_work+0x472/0x2010 net/mac80211/scan.c:1193
cfg80211_wiphy_work+0x2b7/0x550 net/wireless/core.c:538
in hwsim. Also, cfg80211 then allows changing the interface type,
and the off-channel path getgs confused about beaconing as well,
leading to another warning:
WARNING: net/mac80211/driver-ops.c:468 at drv_link_info_changed+0x583/0x880
ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427
ieee80211_offchannel_stop_vifs+0x328/0x5c0 net/mac80211/offchannel.c:122
ieee80211_start_sw_scan net/mac80211/scan.c:583 [inline]
__ieee80211_start_scan+0xfb6/0x1af0 net/mac80211/scan.c:882
Reset the state on failures to always have it correct.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/cfg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d83da43e9b3b3b1bad99ac5a1065f1c63ad5fc32",
"status": "affected",
"version": "d6a83228823fc0cc8d79d95c9f0bf568b7317862",
"versionType": "git"
},
{
"lessThan": "5d5ff5b36f5748a2a077f875a73ccb26860d3fcc",
"status": "affected",
"version": "d6a83228823fc0cc8d79d95c9f0bf568b7317862",
"versionType": "git"
},
{
"lessThan": "6eac225f59c1c2277ac74f8a716d6df0ba3b8d28",
"status": "affected",
"version": "d6a83228823fc0cc8d79d95c9f0bf568b7317862",
"versionType": "git"
},
{
"lessThan": "3f28551d0241254a75626d868041c6340285088b",
"status": "affected",
"version": "d6a83228823fc0cc8d79d95c9f0bf568b7317862",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/cfg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reset state when starting AP fails\n\nieee80211_start_ap() can set enable_beacon (and beacon_int) and fail\nlater, leaving it set forever. Scanning can then attempt to restore\nbeaconing on such an interface, leading to:\n\n Oops: divide error: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:mac80211_hwsim_link_info_changed+0xca7/0xf00\n Call Trace:\n drv_link_info_changed+0x413/0x860 net/mac80211/driver-ops.c:495\n ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427\n ieee80211_offchannel_return+0x381/0x580 net/mac80211/offchannel.c:160\n __ieee80211_scan_completed+0x993/0xe30 net/mac80211/scan.c:519\n ieee80211_scan_work+0x472/0x2010 net/mac80211/scan.c:1193\n cfg80211_wiphy_work+0x2b7/0x550 net/wireless/core.c:538\n\nin hwsim. Also, cfg80211 then allows changing the interface type,\nand the off-channel path getgs confused about beaconing as well,\nleading to another warning:\n\n WARNING: net/mac80211/driver-ops.c:468 at drv_link_info_changed+0x583/0x880\n ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427\n ieee80211_offchannel_stop_vifs+0x328/0x5c0 net/mac80211/offchannel.c:122\n ieee80211_start_sw_scan net/mac80211/scan.c:583 [inline]\n __ieee80211_start_scan+0xfb6/0x1af0 net/mac80211/scan.c:882\n\nReset the state on failures to always have it correct."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:45.494Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d83da43e9b3b3b1bad99ac5a1065f1c63ad5fc32"
},
{
"url": "https://git.kernel.org/stable/c/5d5ff5b36f5748a2a077f875a73ccb26860d3fcc"
},
{
"url": "https://git.kernel.org/stable/c/6eac225f59c1c2277ac74f8a716d6df0ba3b8d28"
},
{
"url": "https://git.kernel.org/stable/c/3f28551d0241254a75626d868041c6340285088b"
}
],
"title": "wifi: mac80211: reset state when starting AP fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98334",
"datePublished": "2026-10-06T08:46:25.992Z",
"dateReserved": "2026-09-25T10:25:14.341Z",
"dateUpdated": "2026-10-19T09:17:45.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98260 (GCVE-0-2026-98260)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
exec: Cleanup POSIX timers right after de_thread()
A per-thread CPU timer holds a reference to the PID of the thread it is
attached to and, while it is armed, its node is queued in that thread's
posix_cputimers. The task is looked up by that PID.
When a non-leader thread exec()s, de_thread() changes which task owns
that PID. pid_task(timer->it.cpu.pid, PIDTYPE_PID) then returns NULL,
but the node is still queued on tsk, which is alive. timer_lock_sighand()
takes a failed lookup to mean that the node is already dequeued, so it
has nothing to undo.
begin_new_exec() calls posix_cpu_timers_exit(me) right after
exec_task_namespaces() and that removes the leftover node, so the state
normally stays invisible. But bprm->point_of_no_return is set before
de_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or
exec_task_namespaces() fails, the task dies before it gets there.
exit_itimers() then frees the k_itimer while its node is still queued,
and reaping tsk later erases that freed node from the rbtree.
In short:
the non-leader thread B the parent
timer_create(CLOCK_THREAD_CPUTIME_ID)
timer_settime()
arm_timer() // the node is queued on B
execve()
de_thread(B)
exchange_tids(B, leader) // B's PID now belongs to the leader
release_task(leader)
__exit_signal(leader)
posix_cpu_timers_exit(leader) // cleans leader's queue, not B's
__unhash_process(leader) // that PID has no task anymore
exec_mmap()
mmap_read_lock_killable(old_mm)
kill(B, SIGKILL)
// -EINTR
get_signal()
do_exit()
exit_itimers()
posix_timer_delete()
posix_cpu_timer_del()
posix_timer_unhash_and_free() // freed while still queued
wait4()
release_task(B)
posix_cpu_timers_exit(B)
cleanup_timerqueue()
timerqueue_del() // use-after-free
Move the POSIX timer cleanup right after de_thread() before any of the
later failure conditions brings the task into do_exit().
[ tglx: Move the cleanup right after de_thread() ]
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/exec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6f1977cea3e85cd8ab55fb337d3e1725fe61d1ce",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "d9ae467e617ca29b825493a362bf0d75ad5f4ac3",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "75aa08b93c65766040f9ca99f41ac85ad22596b6",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "d602877baf36c43c788a5f472c977e0be414029f",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "acb03d3881818581052924a9bbbe92b8741ed448",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/exec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexec: Cleanup POSIX timers right after de_thread()\n\nA per-thread CPU timer holds a reference to the PID of the thread it is\nattached to and, while it is armed, its node is queued in that thread\u0027s\nposix_cputimers. The task is looked up by that PID.\n\nWhen a non-leader thread exec()s, de_thread() changes which task owns\nthat PID. pid_task(timer-\u003eit.cpu.pid, PIDTYPE_PID) then returns NULL,\nbut the node is still queued on tsk, which is alive. timer_lock_sighand()\ntakes a failed lookup to mean that the node is already dequeued, so it\nhas nothing to undo.\n\nbegin_new_exec() calls posix_cpu_timers_exit(me) right after\nexec_task_namespaces() and that removes the leftover node, so the state\nnormally stays invisible. But bprm-\u003epoint_of_no_return is set before\nde_thread(), so if unshare_files(), set_mm_exe_file(), exec_mmap() or\nexec_task_namespaces() fails, the task dies before it gets there.\nexit_itimers() then frees the k_itimer while its node is still queued,\nand reaping tsk later erases that freed node from the rbtree.\n\nIn short:\n\n the non-leader thread B the parent\n\n timer_create(CLOCK_THREAD_CPUTIME_ID)\n timer_settime()\n arm_timer() // the node is queued on B\n execve()\n de_thread(B)\n exchange_tids(B, leader) // B\u0027s PID now belongs to the leader\n release_task(leader)\n __exit_signal(leader)\n posix_cpu_timers_exit(leader) // cleans leader\u0027s queue, not B\u0027s\n __unhash_process(leader) // that PID has no task anymore\n exec_mmap()\n mmap_read_lock_killable(old_mm)\n kill(B, SIGKILL)\n // -EINTR\n get_signal()\n do_exit()\n exit_itimers()\n posix_timer_delete()\n posix_cpu_timer_del()\n posix_timer_unhash_and_free() // freed while still queued\n wait4()\n release_task(B)\n posix_cpu_timers_exit(B)\n cleanup_timerqueue()\n timerqueue_del() // use-after-free\n\nMove the POSIX timer cleanup right after de_thread() before any of the\nlater failure conditions brings the task into do_exit().\n\n[ tglx: Move the cleanup right after de_thread() ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug needs local syscalls: timer_create(CLOCK_THREAD_CPUTIME_ID) and timer_settime() on a non-leader thread, then execve(). That thread\u0027s exec must fail after de_thread() in begin_new_exec() (e.g. exec_mmap() returning -EINTR on SIGKILL). No remote protocol carries any of this input.\nAC:L - The attacker controls both sides of the race. Their own parent sends SIGKILL while exec_mmap() waits on down_write_killable(exec_update_lock) or mmap_read_lock_killable(old_mm), and they can create that lock contention with their own CLONE_VM or /proc readers. No condition outside their control is needed.\nPR:L - Arming a thread CPU timer, calling execve and signalling one\u0027s own child are all available to any unprivileged user, with no capability checks on this path. A local unprivileged account is enough.\nUI:N - The attacker\u0027s own processes perform every step (timer arm, execve from a non-leader thread, SIGKILL, wait4 reap), so no victim action is needed.\nS:U - The memory corruption is inside the kernel that the attacker\u0027s process runs on. The outcome is a normal local privilege escalation, with no VM or sandbox boundary crossed.\nC:H - exit_itimers() frees the k_itimer while its cpu_timer node is still linked in the task\u0027s posix_cputimers rbtree. The freed slab object can be reclaimed with attacker-sprayed data, giving a use-after-free that can be turned into kernel memory disclosure.\nI:H - When release_task() reaps the task, posix_cpu_timers_exit() -\u003e cleanup_timerqueue() -\u003e timerqueue_del() calls rb_erase on the freed node and rewrites rbtree pointers in reclaimed memory. That is a use-after-free write which can be used for privilege escalation.\nA:H - The rbtree erase on freed memory corrupts kernel data and can oops or panic the kernel. Any unprivileged user can repeat it at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:31.364Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6f1977cea3e85cd8ab55fb337d3e1725fe61d1ce"
},
{
"url": "https://git.kernel.org/stable/c/d9ae467e617ca29b825493a362bf0d75ad5f4ac3"
},
{
"url": "https://git.kernel.org/stable/c/75aa08b93c65766040f9ca99f41ac85ad22596b6"
},
{
"url": "https://git.kernel.org/stable/c/d602877baf36c43c788a5f472c977e0be414029f"
},
{
"url": "https://git.kernel.org/stable/c/acb03d3881818581052924a9bbbe92b8741ed448"
}
],
"title": "exec: Cleanup POSIX timers right after de_thread()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98260",
"datePublished": "2026-10-06T08:45:24.711Z",
"dateReserved": "2026-09-25T10:25:14.332Z",
"dateUpdated": "2026-10-19T09:16:31.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98320 (GCVE-0-2026-98320)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: hold reference on ct until flow is released
nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe
semantics also allow to refer to the wrong conntrack from the flowtable
datapath. Hold reference on ct until flow is released after rcu grace
period.
Add rcu_barrier() on module exit path, to ensure pending flow entries
are release before module goes away.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0ff90b6c20340e57616a51ae1a1bf18156d6638a Version: 0ff90b6c20340e57616a51ae1a1bf18156d6638a Version: 0ff90b6c20340e57616a51ae1a1bf18156d6638a Version: 0ff90b6c20340e57616a51ae1a1bf18156d6638a Version: 0ff90b6c20340e57616a51ae1a1bf18156d6638a Version: 0ff90b6c20340e57616a51ae1a1bf18156d6638a Version: 0ff90b6c20340e57616a51ae1a1bf18156d6638a Version: 0ff90b6c20340e57616a51ae1a1bf18156d6638a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "93ff1594be1aad4da364462dd8db050ebcfda2de",
"status": "affected",
"version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
"versionType": "git"
},
{
"lessThan": "eed6997e8dc40593a539fcc722e7ed51b18db86c",
"status": "affected",
"version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
"versionType": "git"
},
{
"lessThan": "61c6688be282277c6e91ab286a7acd0ae8681ac6",
"status": "affected",
"version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
"versionType": "git"
},
{
"lessThan": "a43cd2b67b91e943273c913237a7a88c50cdcfbc",
"status": "affected",
"version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
"versionType": "git"
},
{
"lessThan": "8274cdc5f9c57e17ed77fc4ba76212536c840f25",
"status": "affected",
"version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
"versionType": "git"
},
{
"lessThan": "12c1ac230f4ca16e0017b62a963ab75e0b48074f",
"status": "affected",
"version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
"versionType": "git"
},
{
"lessThan": "d9e6175a3ee48209ee65f294fc567b4e16b29b74",
"status": "affected",
"version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
"versionType": "git"
},
{
"lessThan": "e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d",
"status": "affected",
"version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: hold reference on ct until flow is released\n\nnf_ct_put() releases the ct-\u003eext area inmediately, the rcu typesafe\nsemantics also allow to refer to the wrong conntrack from the flowtable\ndatapath. Hold reference on ct until flow is released after rcu grace\nperiod.\n\nAdd rcu_barrier() on module exit path, to ensure pending flow entries\nare release before module goes away."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The freed ct is reached from nf_flow_offload_forward() (nf_ct_acct_update/flow_offload_teardown on flow-\u003ect) but freeing it needs the conntrack killed (nf_ct_is_dying) and flow_offload_del() run; a remote peer only supplies forwarded packets and cannot kill an offloaded ct, so the full trigger needs local nftables/ctnetlink access.\nAC:L - The attacker drives every side of the race: they flood packets through their own flowtable, delete the ct via ctnetlink, and force nf_flow_offload_gc_step()-\u003eflow_offload_del() at once by downing the veth (nf_flow_table_gc_cleanup flush_delayed_work). The window is narrow but can be retried indefinitely.\nPR:L - Creating the nftables flowtable, adding veth forwarding and sending IPCTNL_MSG_CT_DELETE need only CAP_NET_ADMIN in a network namespace, which an unprivileged user gets via unshare -Urn.\nUI:N - No victim action is needed; the attacker sets up the flowtable, the traffic and the conntrack/flow teardown entirely within their own namespace.\nS:U - Memory corruption in the host kernel\u0027s netfilter flowtable/conntrack objects yields kernel privilege escalation within the same authority; no VM or hardware boundary is crossed.\nC:H - flow_offload_free() dropped the ct reference before the RCU grace period, so in-flight readers dereference ct-\u003eext after nf_conntrack_free() has kfree\u0027d it, or a recycled SLAB_TYPESAFE_BY_RCU nf_conn now owned by another connection - a use-after-free that can be groomed to leak kernel memory.\nI:H - The stale reader writes freed or reused memory: nf_ct_acct_add() does atomic64_add into the freed ct-\u003eext counters, and flow_offload_teardown()/flow_offload_fixup_ct() modify status/timeout of a recycled conntrack, giving heap-corruption primitives.\nA:H - The use-after-free on ct-\u003eext and recycled nf_conn objects in the forwarding softirq can corrupt the slab and crash the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:30.784Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/93ff1594be1aad4da364462dd8db050ebcfda2de"
},
{
"url": "https://git.kernel.org/stable/c/eed6997e8dc40593a539fcc722e7ed51b18db86c"
},
{
"url": "https://git.kernel.org/stable/c/61c6688be282277c6e91ab286a7acd0ae8681ac6"
},
{
"url": "https://git.kernel.org/stable/c/a43cd2b67b91e943273c913237a7a88c50cdcfbc"
},
{
"url": "https://git.kernel.org/stable/c/8274cdc5f9c57e17ed77fc4ba76212536c840f25"
},
{
"url": "https://git.kernel.org/stable/c/12c1ac230f4ca16e0017b62a963ab75e0b48074f"
},
{
"url": "https://git.kernel.org/stable/c/d9e6175a3ee48209ee65f294fc567b4e16b29b74"
},
{
"url": "https://git.kernel.org/stable/c/e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d"
}
],
"title": "netfilter: flowtable: hold reference on ct until flow is released",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98320",
"datePublished": "2026-10-06T08:46:14.757Z",
"dateReserved": "2026-09-25T10:25:14.340Z",
"dateUpdated": "2026-10-19T09:17:30.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98331 (GCVE-0-2026-98331)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: unlist vifs when their netdev is unregistered
mac80211 only removes vifs from the local->interfaces list when
an interface is removed via ieee80211_if_remove(), before it
unregisters the netdev. However, it's possible for a netdev to
be unregistered without going through that: When the netns that
holds the wiphy is destroyed, the wiphy is supposed to move to
the init_ns, but that can run into allocation failures.
Then, mac80211 has an interface listed that doesn't exist, and
will eventually hit
BUG: failure at net/wireless/core.h:141/wiphy_to_rdev()!
...
_cfg80211_unregister_wdev+0x24/0x36a [cfg80211]
cfg80211_unregister_wdev+0x15/0x1d [cfg80211]
ieee80211_remove_interfaces+0x1ff/0x257 [mac80211]
ieee80211_unregister_hw+0x73/0x1d1 [mac80211]
mac80211_hwsim_del_radio+0x114/0x166 [mac80211_hwsim]
Remove the interface from the list in ->ndo_uninit if it's still
around to avoid this.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 463d018323851a608eef52a9427b0585005c647f Version: 463d018323851a608eef52a9427b0585005c647f Version: 463d018323851a608eef52a9427b0585005c647f Version: 463d018323851a608eef52a9427b0585005c647f Version: 463d018323851a608eef52a9427b0585005c647f Version: 463d018323851a608eef52a9427b0585005c647f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/iface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a22c02863439993095acd0c3db97fa53cd515f4f",
"status": "affected",
"version": "463d018323851a608eef52a9427b0585005c647f",
"versionType": "git"
},
{
"lessThan": "20a56e96a6f7b4dfbd13f8732fd2673409fc7ba0",
"status": "affected",
"version": "463d018323851a608eef52a9427b0585005c647f",
"versionType": "git"
},
{
"lessThan": "b735ad1a9aca6080192c1316cf2706e5e1318762",
"status": "affected",
"version": "463d018323851a608eef52a9427b0585005c647f",
"versionType": "git"
},
{
"lessThan": "d45bf731ec7085d2cc2c5d179d3b3b6c743d4fb1",
"status": "affected",
"version": "463d018323851a608eef52a9427b0585005c647f",
"versionType": "git"
},
{
"lessThan": "821bab0456dfca12acef6df702c8f2477d313227",
"status": "affected",
"version": "463d018323851a608eef52a9427b0585005c647f",
"versionType": "git"
},
{
"lessThan": "eee2efd82867b623982ac51925b5a1812a74c50d",
"status": "affected",
"version": "463d018323851a608eef52a9427b0585005c647f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/iface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"lessThan": "2.6.32",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: unlist vifs when their netdev is unregistered\n\nmac80211 only removes vifs from the local-\u003einterfaces list when\nan interface is removed via ieee80211_if_remove(), before it\nunregisters the netdev. However, it\u0027s possible for a netdev to\nbe unregistered without going through that: When the netns that\nholds the wiphy is destroyed, the wiphy is supposed to move to\nthe init_ns, but that can run into allocation failures.\n\nThen, mac80211 has an interface listed that doesn\u0027t exist, and\nwill eventually hit\n\n BUG: failure at net/wireless/core.h:141/wiphy_to_rdev()!\n ...\n _cfg80211_unregister_wdev+0x24/0x36a [cfg80211]\n cfg80211_unregister_wdev+0x15/0x1d [cfg80211]\n ieee80211_remove_interfaces+0x1ff/0x257 [mac80211]\n ieee80211_unregister_hw+0x73/0x1d1 [mac80211]\n mac80211_hwsim_del_radio+0x114/0x166 [mac80211_hwsim]\n\nRemove the interface from the list in -\u003endo_uninit if it\u0027s still\naround to avoid this."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The trigger is local: tearing down a netns that holds a mac80211 wiphy runs cfg80211_pernet_exit()-\u003ecfg80211_switch_netns(). When dev_change_net_namespace() fails there, default_device_exit_batch() unregisters the netdev while ieee80211_uninit() leaves its sdata on local-\u003einterfaces. No WiFi frame supplies the failing state.\nAC:H - It needs a wiphy already moved into an attacker-controlled netns (an admin step), plus a failed move back. The attacker can force the failure: an altname on the wlan netdev that clashes with an init_net name makes __dev_change_net_namespace() return -EEXIST, because cfg80211 doesn\u0027t strip altnames. The rare alternative is an allocation failure.\nPR:L - With a phy delegated to a container, root in that user-namespace-owned netns, which is unprivileged on the host, can add the altname via RTM_NEWLINKPROP and destroy the netns. Moving a phy out of init_net yourself needs init-ns CAP_NET_ADMIN, and hwsim radios made in a user netns are deleted by hwsim_exit_net() before cfg80211 runs.\nUI:N - The container root adds the altname and exits the namespace on their own. No other user has to do anything.\nS:U - This is memory corruption in the host kernel\u0027s mac80211 interface list. Exploiting it is ordinary kernel privilege escalation within the same kernel authority; no hypervisor or IOMMU boundary is involved.\nC:H - The netdev is freed via needs_free_netdev, but its sdata stays on local-\u003einterfaces. Every received frame then makes __ieee80211_rx_handle_packet() read the freed sdata through list_for_each_entry_rcu(), which gives a use-after-free read of an object an attacker can reallocate.\nI:H - Later removal of a neighbouring interface (list_del_rcu) and ieee80211_remove_interfaces() write into and dereference the stale sdata. That is a use-after-free write that heap reallocation could turn into memory corruption.\nA:H - The dangling entry crashes the kernel: the commit shows a BUG in wiphy_to_rdev() reached from ieee80211_remove_interfaces() during ieee80211_unregister_hw(), and frame RX can touch freed memory."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:41.508Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a22c02863439993095acd0c3db97fa53cd515f4f"
},
{
"url": "https://git.kernel.org/stable/c/20a56e96a6f7b4dfbd13f8732fd2673409fc7ba0"
},
{
"url": "https://git.kernel.org/stable/c/b735ad1a9aca6080192c1316cf2706e5e1318762"
},
{
"url": "https://git.kernel.org/stable/c/d45bf731ec7085d2cc2c5d179d3b3b6c743d4fb1"
},
{
"url": "https://git.kernel.org/stable/c/821bab0456dfca12acef6df702c8f2477d313227"
},
{
"url": "https://git.kernel.org/stable/c/eee2efd82867b623982ac51925b5a1812a74c50d"
}
],
"title": "wifi: mac80211: unlist vifs when their netdev is unregistered",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98331",
"datePublished": "2026-10-06T08:46:23.481Z",
"dateReserved": "2026-09-25T10:25:14.341Z",
"dateUpdated": "2026-10-19T09:17:41.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89868 (GCVE-0-2026-89868)
Vulnerability from cvelistv5
Published
2026-09-16 10:31
Modified
2026-10-19 08:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: chips-media: wave5: Add timeout while stop_streaming
When stop_streaming is called, an infinite loop may occur in some cases.
Add a bounded poll of the queue status: loop until the queues drain,
sleeping briefly between polls, and bail out once VPU_DEC_STOP_TIMEOUT
elapses.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c",
"drivers/media/platform/chips-media/wave5/wave5-vpuconfig.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "58e185e69a3dbe3494e54aad330f228f0b6645e1",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
},
{
"lessThan": "c343348473e716882249bacf9297d6c363665fd9",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
},
{
"lessThan": "c104f37b9f79d6c179c5f1a170d7f1da497ff527",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
},
{
"lessThan": "2ae7faed2e60d6d07d9efdd962d20dcb15330ced",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c",
"drivers/media/platform/chips-media/wave5/wave5-vpuconfig.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Add timeout while stop_streaming\n\nWhen stop_streaming is called, an infinite loop may occur in some cases.\nAdd a bounded poll of the queue status: loop until the queues drain,\nsleeping briefly between polls, and bail out once VPU_DEC_STOP_TIMEOUT\nelapses."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:54:01.483Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/58e185e69a3dbe3494e54aad330f228f0b6645e1"
},
{
"url": "https://git.kernel.org/stable/c/c343348473e716882249bacf9297d6c363665fd9"
},
{
"url": "https://git.kernel.org/stable/c/c104f37b9f79d6c179c5f1a170d7f1da497ff527"
},
{
"url": "https://git.kernel.org/stable/c/2ae7faed2e60d6d07d9efdd962d20dcb15330ced"
}
],
"title": "media: chips-media: wave5: Add timeout while stop_streaming",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89868",
"datePublished": "2026-09-16T10:31:37.872Z",
"dateReserved": "2026-09-11T19:38:34.771Z",
"dateUpdated": "2026-10-19T08:54:01.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89467 (GCVE-0-2026-89467)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: qcom_battmgr: fix use-after-free
qcom_battmgr_pdr_notify() queues enable_work when the PMIC GLINK service
comes up, and the worker recovers battmgr through container_of() to issue
firmware requests. The PMIC GLINK client stays on the client list until
its devres release action runs, so a PDR notification can keep queueing
the work, and a pending or running worker can access battmgr after devres
frees it.
Make enable_work device-managed with devm_work_autocancel(), registered
before the PMIC GLINK client is allocated. The devres cleanup then
releases the client first, so no further notification can queue the work,
and cancels the work before battmgr is freed.
This issue was found by an in-house static analysis tool.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/qcom_battmgr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "35964ed01e10b61a30066b0c568aa0e0e8fb6432",
"status": "affected",
"version": "29e8142b5623b5949587bcc4f591c4e6595c4aca",
"versionType": "git"
},
{
"lessThan": "77fefca305db44b0edd3fcdb52d781771c1ce366",
"status": "affected",
"version": "29e8142b5623b5949587bcc4f591c4e6595c4aca",
"versionType": "git"
},
{
"lessThan": "06618447029c6dddaa02f6e9528efe5dd49fc329",
"status": "affected",
"version": "29e8142b5623b5949587bcc4f591c4e6595c4aca",
"versionType": "git"
},
{
"lessThan": "49fbcd3da2958159370d25dafbf736e654a4d59b",
"status": "affected",
"version": "29e8142b5623b5949587bcc4f591c4e6595c4aca",
"versionType": "git"
},
{
"lessThan": "4e40befedfc8ed86f44e1f81df92d13c149c9f8d",
"status": "affected",
"version": "29e8142b5623b5949587bcc4f591c4e6595c4aca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/qcom_battmgr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: qcom_battmgr: fix use-after-free\n\nqcom_battmgr_pdr_notify() queues enable_work when the PMIC GLINK service\ncomes up, and the worker recovers battmgr through container_of() to issue\nfirmware requests. The PMIC GLINK client stays on the client list until\nits devres release action runs, so a PDR notification can keep queueing\nthe work, and a pending or running worker can access battmgr after devres\nfrees it.\n\nMake enable_work device-managed with devm_work_autocancel(), registered\nbefore the PMIC GLINK client is allocated. The devres cleanup then\nreleases the client first, so no further notification can queue the work,\nand cancels the work before battmgr is freed.\n\nThis issue was found by an in-house static analysis tool."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:32.936Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/35964ed01e10b61a30066b0c568aa0e0e8fb6432"
},
{
"url": "https://git.kernel.org/stable/c/77fefca305db44b0edd3fcdb52d781771c1ce366"
},
{
"url": "https://git.kernel.org/stable/c/06618447029c6dddaa02f6e9528efe5dd49fc329"
},
{
"url": "https://git.kernel.org/stable/c/49fbcd3da2958159370d25dafbf736e654a4d59b"
},
{
"url": "https://git.kernel.org/stable/c/4e40befedfc8ed86f44e1f81df92d13c149c9f8d"
}
],
"title": "power: supply: qcom_battmgr: fix use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89467",
"datePublished": "2026-09-11T19:43:27.247Z",
"dateReserved": "2026-09-11T19:38:34.709Z",
"dateUpdated": "2026-10-21T12:47:32.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97529 (GCVE-0-2026-97529)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
The FC BSG transport allocates job->request via memdup_user() using the
exact user-supplied request_len. For FC_BSG_HST_VENDOR,
fc_bsg_host_dispatch() only guarantees request_len covers msgcode and
vendor_id; it does not account for the vendor_cmd[] flexible array.
qla2xxx then reads the command selector vendor_cmd[0] and, in several
sub-handlers, vendor_cmd[1]/[2] or structures overlaid on the vendor
command area without verifying request_len. A caller holding
CAP_SYS_RAWIO can submit a short request whose vendor_id matches the
host, triggering out-of-bounds heap reads (KASAN-detectable, and able to
mis-select a command or panic).
Add a central guard in qla2x00_process_vendor_specific() so the selector
is always in bounds, restrict the early vendor_cmd[0] read in
qla24xx_bsg_request() to sufficiently long vendor messages, and add
request_len checks to the sub-handlers that read further:
qla24xx_proc_fcp_prio_cfg_cmd(), qla2x00_process_loopback(),
qla84xx_reset(), qla84xx_updatefw(), qla2x00_read_optrom(),
qla2x00_update_optrom(), qlafx00_mgmt_cmd() and
qla28xx_validate_flash_image().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_bsg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5f33efe04658968b6b3f432f904d5f1f74c12286",
"status": "affected",
"version": "01e0e15c8b3b32e006e5cccac10c8b377ac3d803",
"versionType": "git"
},
{
"lessThan": "ef63922d8bdea03de1804af39a6b12212acb1be2",
"status": "affected",
"version": "01e0e15c8b3b32e006e5cccac10c8b377ac3d803",
"versionType": "git"
},
{
"lessThan": "740f3458a4798af54aaf8cf63e797d407e8b6d3b",
"status": "affected",
"version": "01e0e15c8b3b32e006e5cccac10c8b377ac3d803",
"versionType": "git"
},
{
"lessThan": "f75bff451a2fac5aed82f9641df1e9a42c5a899d",
"status": "affected",
"version": "01e0e15c8b3b32e006e5cccac10c8b377ac3d803",
"versionType": "git"
},
{
"lessThan": "4cf38dd9465736141263ebb63375868311a0ec81",
"status": "affected",
"version": "01e0e15c8b3b32e006e5cccac10c8b377ac3d803",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_bsg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]\n\nThe FC BSG transport allocates job-\u003erequest via memdup_user() using the\nexact user-supplied request_len. For FC_BSG_HST_VENDOR,\nfc_bsg_host_dispatch() only guarantees request_len covers msgcode and\nvendor_id; it does not account for the vendor_cmd[] flexible array.\n\nqla2xxx then reads the command selector vendor_cmd[0] and, in several\nsub-handlers, vendor_cmd[1]/[2] or structures overlaid on the vendor\ncommand area without verifying request_len. A caller holding\nCAP_SYS_RAWIO can submit a short request whose vendor_id matches the\nhost, triggering out-of-bounds heap reads (KASAN-detectable, and able to\nmis-select a command or panic).\n\nAdd a central guard in qla2x00_process_vendor_specific() so the selector\nis always in bounds, restrict the early vendor_cmd[0] read in\nqla24xx_bsg_request() to sufficiently long vendor messages, and add\nrequest_len checks to the sub-handlers that read further:\nqla24xx_proc_fcp_prio_cfg_cmd(), qla2x00_process_loopback(),\nqla84xx_reset(), qla84xx_updatefw(), qla2x00_read_optrom(),\nqla2x00_update_optrom(), qlafx00_mgmt_cmd() and\nqla28xx_validate_flash_image()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:04.993Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5f33efe04658968b6b3f432f904d5f1f74c12286"
},
{
"url": "https://git.kernel.org/stable/c/ef63922d8bdea03de1804af39a6b12212acb1be2"
},
{
"url": "https://git.kernel.org/stable/c/740f3458a4798af54aaf8cf63e797d407e8b6d3b"
},
{
"url": "https://git.kernel.org/stable/c/f75bff451a2fac5aed82f9641df1e9a42c5a899d"
},
{
"url": "https://git.kernel.org/stable/c/4cf38dd9465736141263ebb63375868311a0ec81"
}
],
"title": "scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97529",
"datePublished": "2026-09-25T10:21:30.733Z",
"dateReserved": "2026-09-24T16:01:01.153Z",
"dateUpdated": "2026-10-21T12:53:04.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98297 (GCVE-0-2026-98297)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
hci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev->tx_work
unconditionally. They can run from the L2CAP/SCO/ISO socket send path
while hci_dev_close_sync() is draining hdev->workqueue (HCIDEVDOWN
racing with a socket write). Since that queue_work() is not chained
work from the tx_work worker itself, __queue_work() sees the queue
marked __WQ_DRAINING, warns "cannot queue %ps on wq %s", and drops
the work:
WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work
Call Trace:
queue_work_on
l2cap_chan_send
l2cap_sock_sendmsg
...
hci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before
draining, but only hci_cmd_work() and handle_cmd_cnt_and_timer()
check it before queuing. Route the tx_work producers through the
same guard via a shared hci_sched_tx() helper.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21 Version: 9cebe4680bb9a72f80c6541eb24af06db7a1fbc9 Version: 47330cc875b36a1cf7b3543cb2cf90a7c603ce0e Version: 525daaea459fc215f432de1b8debbd9144bf97b0 Version: 525daaea459fc215f432de1b8debbd9144bf97b0 Version: 60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff Version: 6.12.93 ≤ Version: 6.18.35 ≤ Version: 7.0.12 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8010212197d4a3ee714f78ed77048d0b712ff925",
"status": "affected",
"version": "7b81c1378b79c3143ca3fdb3d18ac0f01cbabb21",
"versionType": "git"
},
{
"lessThan": "ab0678a0701ac4de499428dc1b321659bb74d272",
"status": "affected",
"version": "9cebe4680bb9a72f80c6541eb24af06db7a1fbc9",
"versionType": "git"
},
{
"lessThan": "e220c1242a643d97102a79f09b7ef3aa31276961",
"status": "affected",
"version": "47330cc875b36a1cf7b3543cb2cf90a7c603ce0e",
"versionType": "git"
},
{
"lessThan": "cbb325bc150e8c0dbce004ac0e5516bcffc0de31",
"status": "affected",
"version": "525daaea459fc215f432de1b8debbd9144bf97b0",
"versionType": "git"
},
{
"lessThan": "6610c6fe4b8936c232048e6049bf77c70a6f759c",
"status": "affected",
"version": "525daaea459fc215f432de1b8debbd9144bf97b0",
"versionType": "git"
},
{
"status": "affected",
"version": "60bceb9a4c693e68cc90ba4b2dfb9e000e8638ff",
"versionType": "git"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThan": "6.18.54",
"status": "affected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThan": "7.1",
"status": "affected",
"version": "7.0.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.18.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: Fix queuing tx_work after workqueue is drained\n\nhci_send_acl(), hci_send_sco() and hci_send_iso() queue hdev-\u003etx_work\nunconditionally. They can run from the L2CAP/SCO/ISO socket send path\nwhile hci_dev_close_sync() is draining hdev-\u003eworkqueue (HCIDEVDOWN\nracing with a socket write). Since that queue_work() is not chained\nwork from the tx_work worker itself, __queue_work() sees the queue\nmarked __WQ_DRAINING, warns \"cannot queue %ps on wq %s\", and drops\nthe work:\n\n WARNING: CPU: 1 PID: 5985 at kernel/workqueue.c:2352 __queue_work\n Call Trace:\n queue_work_on\n l2cap_chan_send\n l2cap_sock_sendmsg\n ...\n\nhci_dev_close_sync() already sets HCI_CMD_DRAIN_WORKQUEUE before\ndraining, but only hci_cmd_work() and handle_cmd_cnt_and_timer()\ncheck it before queuing. Route the tx_work producers through the\nsame guard via a shared hci_sched_tx() helper."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:55.978Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8010212197d4a3ee714f78ed77048d0b712ff925"
},
{
"url": "https://git.kernel.org/stable/c/ab0678a0701ac4de499428dc1b321659bb74d272"
},
{
"url": "https://git.kernel.org/stable/c/e220c1242a643d97102a79f09b7ef3aa31276961"
},
{
"url": "https://git.kernel.org/stable/c/cbb325bc150e8c0dbce004ac0e5516bcffc0de31"
},
{
"url": "https://git.kernel.org/stable/c/6610c6fe4b8936c232048e6049bf77c70a6f759c"
}
],
"title": "Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98297",
"datePublished": "2026-10-06T08:45:55.723Z",
"dateReserved": "2026-09-25T10:25:14.337Z",
"dateUpdated": "2026-10-21T12:54:55.978Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98322 (GCVE-0-2026-98322)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_nat: fully initialise new_addr in netmap setup
nft_nat_setup_netmap() builds the mapped address in an on-stack
union nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip
member and the loop runs a single 32-bit iteration, but it then copies
the whole 16-byte union into range->min_addr and range->max_addr, so the
upper 12 bytes reach nf_nat_setup_info() uninitialised.
KMSAN reports an uninit-value in nf_nat_setup_info() reached from
nft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected.
Zero-initialise new_addr.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3ff7ddb1353da9b535e65702704cbadea1da9a00 Version: 3ff7ddb1353da9b535e65702704cbadea1da9a00 Version: 3ff7ddb1353da9b535e65702704cbadea1da9a00 Version: 3ff7ddb1353da9b535e65702704cbadea1da9a00 Version: 3ff7ddb1353da9b535e65702704cbadea1da9a00 Version: 3ff7ddb1353da9b535e65702704cbadea1da9a00 Version: 3ff7ddb1353da9b535e65702704cbadea1da9a00 Version: 3ff7ddb1353da9b535e65702704cbadea1da9a00 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_nat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "29365695842db0a97b701a43a09fad1b4f7ecf3e",
"status": "affected",
"version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
"versionType": "git"
},
{
"lessThan": "7b9380c38c2fd2189416fa602bdbc5c8523b84b2",
"status": "affected",
"version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
"versionType": "git"
},
{
"lessThan": "eb2030137dba3b59cbb5057a33af70488d6bc231",
"status": "affected",
"version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
"versionType": "git"
},
{
"lessThan": "e4982c489ee359162eee3ece1fb36082648464a5",
"status": "affected",
"version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
"versionType": "git"
},
{
"lessThan": "161f5860c92a8ec80b6bdff16e79d70dcd8afc5a",
"status": "affected",
"version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
"versionType": "git"
},
{
"lessThan": "0ce42c7b84032335abff9eac43762e4ca8224451",
"status": "affected",
"version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
"versionType": "git"
},
{
"lessThan": "1c43f5db482f74b41987c39c9c375a5e767556eb",
"status": "affected",
"version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
"versionType": "git"
},
{
"lessThan": "d313499df66159b4b7971d760d16729598ab7e5a",
"status": "affected",
"version": "3ff7ddb1353da9b535e65702704cbadea1da9a00",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_nat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_nat: fully initialise new_addr in netmap setup\n\nnft_nat_setup_netmap() builds the mapped address in an on-stack\nunion nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip\nmember and the loop runs a single 32-bit iteration, but it then copies\nthe whole 16-byte union into range-\u003emin_addr and range-\u003emax_addr, so the\nupper 12 bytes reach nf_nat_setup_info() uninitialised.\n\nKMSAN reports an uninit-value in nf_nat_setup_info() reached from\nnft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected.\n\nZero-initialise new_addr."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:32.745Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/29365695842db0a97b701a43a09fad1b4f7ecf3e"
},
{
"url": "https://git.kernel.org/stable/c/7b9380c38c2fd2189416fa602bdbc5c8523b84b2"
},
{
"url": "https://git.kernel.org/stable/c/eb2030137dba3b59cbb5057a33af70488d6bc231"
},
{
"url": "https://git.kernel.org/stable/c/e4982c489ee359162eee3ece1fb36082648464a5"
},
{
"url": "https://git.kernel.org/stable/c/161f5860c92a8ec80b6bdff16e79d70dcd8afc5a"
},
{
"url": "https://git.kernel.org/stable/c/0ce42c7b84032335abff9eac43762e4ca8224451"
},
{
"url": "https://git.kernel.org/stable/c/1c43f5db482f74b41987c39c9c375a5e767556eb"
},
{
"url": "https://git.kernel.org/stable/c/d313499df66159b4b7971d760d16729598ab7e5a"
}
],
"title": "netfilter: nft_nat: fully initialise new_addr in netmap setup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98322",
"datePublished": "2026-10-06T08:46:16.346Z",
"dateReserved": "2026-09-25T10:25:14.340Z",
"dateUpdated": "2026-10-19T09:17:32.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98382 (GCVE-0-2026-98382)
Vulnerability from cvelistv5
Published
2026-10-09 07:34
Modified
2026-10-24 14:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject dev-bound-only programs on other devices
__bpf_offload_dev_match() falls back to comparing offdev pointers after an
exact netdev mismatch. Bound-only programs normally have NULL offdevs, so
unrelated netdevs compare equal. A bound-only program on an
offload-registered netdev can instead inherit a real offdev and match a
sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use
bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs
specialized for the bound driver on the target driver's xdp_buff. Running a
veth-bound program on tun reads beyond tun's bare stack xdp_buff as a
veth_xdp_buff.
Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)
Call Trace:
...
tun_build_skb (drivers/net/tun.c:1739)
tun_get_user (drivers/net/tun.c:1856)
tun_chr_write_iter (drivers/net/tun.c:2091)
vfs_write (fs/read_write.c:595 fs/read_write.c:687)
ksys_write (fs/read_write.c:739)
do_syscall_64 (arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Restrict non-offloaded programs to exact netdev matches and retain the
shared-offdev fallback only for genuinely offloaded multi-port programs.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e57f04194361574493e3e6cf0b9e9c69e4ae9791",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "0dceda331180617aeeb22381e8480b37f18ba08b",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "940b626854de200e6187777d42114727daca617c",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "bb375f3c5990e29851894f20ebc4b9dbc6676126",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "6db1ce73e9853f533eb7f413f14ba00f8ec6f80d",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/offload.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject dev-bound-only programs on other devices\n\n__bpf_offload_dev_match() falls back to comparing offdev pointers after an\nexact netdev mismatch. Bound-only programs normally have NULL offdevs, so\nunrelated netdevs compare equal. A bound-only program on an\noffload-registered netdev can instead inherit a real offdev and match a\nsibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use\nbpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs\nspecialized for the bound driver on the target driver\u0027s xdp_buff. Running a\nveth-bound program on tun reads beyond tun\u0027s bare stack xdp_buff as a\nveth_xdp_buff.\n\n Oops: general protection fault, probably for non-canonical address\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673)\n Call Trace:\n ...\n tun_build_skb (drivers/net/tun.c:1739)\n tun_get_user (drivers/net/tun.c:1856)\n tun_chr_write_iter (drivers/net/tun.c:2091)\n vfs_write (fs/read_write.c:595 fs/read_write.c:687)\n ksys_write (fs/read_write.c:739)\n do_syscall_64 (arch/x86/entry/syscall_64.c:84)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n Kernel panic - not syncing: Fatal exception in interrupt\n\nRestrict non-offloaded programs to exact netdev matches and retain the\nshared-offdev fallback only for genuinely offloaded multi-port programs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - bpf(BPF_LINK_CREATE) reaches link_create(), bpf_xdp_link_attach(), dev_xdp_install(), and patched __bpf_offload_dev_match(), which accepts a program whose prog_ifindex names another local netdev; no network protocol carries the mismatched ifindex.\nAC:L - The attacker can bind programs to both veth and tun to create their NULL-offdev entries, attach the veth-bound program to tun, and write a packet through tun_chr_write_iter(); the mismatch is deterministic and requires no race or external device state.\nPR:L - bpf_prog_load() requires bpf_token_capable() for CAP_BPF and CAP_NET_ADMIN, which BPF-token delegation can satisfy in a user namespace; tun_set_iff() checks CAP_NET_ADMIN against net-\u003euser_ns, permitting this path in delegated container deployments.\nUI:N - The attacker creates the devices, loads and attaches both programs, and triggers execution by writing to their own tun file descriptor; no victim action is involved.\nS:U - The incorrectly specialized metadata kfunc dereferences and can modify memory inside the same host kernel executing the XDP program; no VM, IOMMU, or other separate security authority is crossed.\nC:H - bpf_dev_bound_resolve_kfunc() specializes the call to veth_xdp_rx_timestamp(), which casts tun\u0027s bare stack xdp_buff to veth_xdp_buff, treats the adjacent word as an skb pointer, and returns skb_hwtstamps()-\u003ehwtstamp to the BPF program, providing an unbounded kernel-read primitive.\nI:H - veth_xdp_rx_hash() passes the same bogus skb pointer to skb_get_hash(); when no hash is present, __skb_get_hash_net() calls __skb_set_sw_hash() and writes hash, l4_hash, and sw_hash through that attacker-influenceable pointer.\nA:H - tun_build_skb() runs the mismatched program from tun_chr_write_iter(), and the demonstrated veth_xdp_rx_timestamp() invalid dereference produces a general-protection fault followed by a kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:08:39.904Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e57f04194361574493e3e6cf0b9e9c69e4ae9791"
},
{
"url": "https://git.kernel.org/stable/c/0dceda331180617aeeb22381e8480b37f18ba08b"
},
{
"url": "https://git.kernel.org/stable/c/940b626854de200e6187777d42114727daca617c"
},
{
"url": "https://git.kernel.org/stable/c/bb375f3c5990e29851894f20ebc4b9dbc6676126"
},
{
"url": "https://git.kernel.org/stable/c/6db1ce73e9853f533eb7f413f14ba00f8ec6f80d"
}
],
"title": "bpf: Reject dev-bound-only programs on other devices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98382",
"datePublished": "2026-10-09T07:34:21.718Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-24T14:08:39.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97527 (GCVE-0-2026-97527)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
The fcport->unsol_ctx_head list is modified from several contexts without
a common lock. Entries are added in qla2xxx_process_purls_iocb() from the
response queue ISR (under the qpair qp_lock), while they are removed from
qla2xxx_process_purls_pkt() (DPC/purex worker), qla_nvme_xmt_ls_rsp()
(NVMe-FC transport callback) and qla_nvme_release_lsrsp_cmd_kref() (SRB
completion). The qpair qp_lock cannot serialize this per-fcport list since
multiqueue adapters add entries through different qpairs, so a concurrent
add and delete (or two concurrent deletes) can corrupt the list pointers.
Introduce a dedicated per-fcport spinlock, unsol_ctx_lock, initialized in
qla2x00_alloc_fcport(), and take it around every list_add_tail()/list_del()
on unsol_ctx_head. The add nests under the existing qp_lock; no delete path
takes qp_lock, so the lock order is consistent and deadlock free.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_def.h",
"drivers/scsi/qla2xxx/qla_init.c",
"drivers/scsi/qla2xxx/qla_nvme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c71726cdfda93ae169a75c7b1697eb870303125",
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"versionType": "git"
},
{
"lessThan": "c1ee12eecbab9674fb73c9e00a93fac655d5a5dc",
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"versionType": "git"
},
{
"lessThan": "b211d138cad86f749826d6132db6388eded992d8",
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"versionType": "git"
},
{
"lessThan": "4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0",
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"versionType": "git"
},
{
"lessThan": "76da0c43c63eb0496649e372ac64466364d0fe7d",
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_def.h",
"drivers/scsi/qla2xxx/qla_init.c",
"drivers/scsi/qla2xxx/qla_nvme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock\n\nThe fcport-\u003eunsol_ctx_head list is modified from several contexts without\na common lock. Entries are added in qla2xxx_process_purls_iocb() from the\nresponse queue ISR (under the qpair qp_lock), while they are removed from\nqla2xxx_process_purls_pkt() (DPC/purex worker), qla_nvme_xmt_ls_rsp()\n(NVMe-FC transport callback) and qla_nvme_release_lsrsp_cmd_kref() (SRB\ncompletion). The qpair qp_lock cannot serialize this per-fcport list since\nmultiqueue adapters add entries through different qpairs, so a concurrent\nadd and delete (or two concurrent deletes) can corrupt the list pointers.\n\nIntroduce a dedicated per-fcport spinlock, unsol_ctx_lock, initialized in\nqla2x00_alloc_fcport(), and take it around every list_add_tail()/list_del()\non unsol_ctx_head. The add nests under the existing qp_lock; no delete path\ntakes qp_lock, so the lock order is consistent and deadlock free."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - qla24xx_msix_rsp_q/qla2xxx_msix_rsp_q \u2192 qla24xx_process_response_queue dispatches PT_LS4_UNSOL (0x56) into qla2xxx_process_purls_iocb, which list_add_tail\u0027s uctx onto fcport-\u003eunsol_ctx_head. Those are unsolicited NVMe-FC LS frames a SAN N_Port put on the wire. FC/FCoE is a non-routable fabric, so Adjacent.\nAC:L - A fabric peer floods concurrent PT_LS4_UNSOL so ISR list_add_tail in qla2xxx_process_purls_iocb (qp_lock only; different qpairs on MQ) races list_del in qla2xxx_process_purls_pkt (DPC; nvme_fc_rcv_ls_req -E2BIG on oversized LS), qla_nvme_xmt_ls_rsp, or qla_nvme_release_lsrsp_cmd_kref. The attacker drives both sides.\nPR:N - qla2xxx_process_purls_iocb only needs qla2x00_find_fcport_by_nportid to match a non-deleted N_Port that completed NVMe PRLI (nvme_remote_port). The PT_LS4_UNSOL path has no uid, capability, or EDIF check; fabric zoning is network access, not a host privilege.\nUI:N - PT_LS4_UNSOL is consumed in the MSI-X response-queue handler and queued via qla24xx_queue_purex_item to PROCESS_PUREX_IOCB; nvme_fc later calls qla_nvme_xmt_ls_rsp from lsrcv_work. No victim mount, open, or other interactive step is required.\nS:U - Corrupting fcport-\u003eunsol_ctx_head and the qla_nvme_unsol_ctx list nodes stays inside the host kernel that owns the qla2xxx adapter. This is not a VM escape, IOMMU bypass, or other cross-authority impact.\nC:H - Unlocked list_add_tail versus list_del on unsol_ctx_head can leave head-\u003eprev pointing at a qla_nvme_unsol_ctx that qla2xxx_process_purls_pkt already kfree\u0027d, so the next add writes through freed slab. Reuse of that uctx is an arbitrary kernel read primitive.\nI:H - The same race lets list_del write prev/next of a neighbor uctx or the list head through a stale pointer, and a second delete of a poisoned node writes LIST_POISON or a reused object, which is a kernel write and control-flow hijack primitive.\nA:H - list_del on a corrupted unsol_ctx_head hits LIST_POISON or a bad dereference in qla2xxx_process_purls_pkt, qla_nvme_xmt_ls_rsp, or qla_nvme_release_lsrsp_cmd_kref and oopses or panics the host, taking down the NVMe-FC path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:02.776Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c71726cdfda93ae169a75c7b1697eb870303125"
},
{
"url": "https://git.kernel.org/stable/c/c1ee12eecbab9674fb73c9e00a93fac655d5a5dc"
},
{
"url": "https://git.kernel.org/stable/c/b211d138cad86f749826d6132db6388eded992d8"
},
{
"url": "https://git.kernel.org/stable/c/4d8ad6bc8cc5eff1870cef00a0d611f38f8b6bd0"
},
{
"url": "https://git.kernel.org/stable/c/76da0c43c63eb0496649e372ac64466364d0fe7d"
}
],
"title": "scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97527",
"datePublished": "2026-09-25T10:21:29.521Z",
"dateReserved": "2026-09-24T16:01:01.152Z",
"dateUpdated": "2026-10-21T12:53:02.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98417 (GCVE-0-2026-98417)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: xfrm: reject unrepresentable espintcp transport headers
ESP-in-TCP can hand xfrm packets whose transport header offset no longer
fits after the stream parser trims the TCP envelope. The plain transport
header reset truncates that offset and triggers the skb warning path.
Use the careful transport-header helper and drop the skb through the
existing XFRM error path when the offset cannot be represented.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 Version: e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/espintcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d37a5b87577c4b4c1a1dcb000a9dff1df2cf886b",
"status": "affected",
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"versionType": "git"
},
{
"lessThan": "6c29681207bc213188afa603dff2d55e7178a341",
"status": "affected",
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"versionType": "git"
},
{
"lessThan": "4a8243fd2e21980fa3fd10c0610e9155057cebd3",
"status": "affected",
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"versionType": "git"
},
{
"lessThan": "b2b84e73e0386ad0b4f9b8d3afde343e761f5275",
"status": "affected",
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"versionType": "git"
},
{
"lessThan": "327b2a457dd7d5445f7395f371f3c65de79bd5ce",
"status": "affected",
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"versionType": "git"
},
{
"lessThan": "cce630c751279e974fa0bb574d80575e0cc7e8f3",
"status": "affected",
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"versionType": "git"
},
{
"lessThan": "206f396f46149dc8bc4dfd2b54b9879ba3ee1d7d",
"status": "affected",
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"versionType": "git"
},
{
"lessThan": "96f01b53c2d05e003b040892256de54a586e8529",
"status": "affected",
"version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/espintcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: xfrm: reject unrepresentable espintcp transport headers\n\nESP-in-TCP can hand xfrm packets whose transport header offset no longer\nfits after the stream parser trims the TCP envelope. The plain transport\nheader reset truncates that offset and triggers the skb warning path.\n\nUse the careful transport-header helper and drop the skb through the\nexisting XFRM error path when the offset cannot be represented."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:11.040Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d37a5b87577c4b4c1a1dcb000a9dff1df2cf886b"
},
{
"url": "https://git.kernel.org/stable/c/6c29681207bc213188afa603dff2d55e7178a341"
},
{
"url": "https://git.kernel.org/stable/c/4a8243fd2e21980fa3fd10c0610e9155057cebd3"
},
{
"url": "https://git.kernel.org/stable/c/b2b84e73e0386ad0b4f9b8d3afde343e761f5275"
},
{
"url": "https://git.kernel.org/stable/c/327b2a457dd7d5445f7395f371f3c65de79bd5ce"
},
{
"url": "https://git.kernel.org/stable/c/cce630c751279e974fa0bb574d80575e0cc7e8f3"
},
{
"url": "https://git.kernel.org/stable/c/206f396f46149dc8bc4dfd2b54b9879ba3ee1d7d"
},
{
"url": "https://git.kernel.org/stable/c/96f01b53c2d05e003b040892256de54a586e8529"
}
],
"title": "net: xfrm: reject unrepresentable espintcp transport headers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98417",
"datePublished": "2026-10-14T13:27:47.816Z",
"dateReserved": "2026-09-25T10:25:14.347Z",
"dateUpdated": "2026-10-19T09:19:11.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89797 (GCVE-0-2026-89797)
Vulnerability from cvelistv5
Published
2026-09-16 10:30
Modified
2026-10-19 08:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: ab8500_fg: fix use-after-free on remove
ab8500_fg_remove() destroys the driver workqueue while the threaded
interrupt handlers are still armed; they are devm-managed and freed
only after ->remove() returns, so a handler that fires in that
window queues work on the freed workqueue.
Tear the workqueue down through devm instead, registering its cleanup
after the power supply and before the interrupt requests. devm then
frees the interrupts first, so the handlers can no longer queue work,
before disabling the delayed and plain work items and destroying the
workqueue. Disabling the items, rather than cancelling them, keeps
them disabled so no producer (including the power-supply
external_power_changed callback) can requeue them.
Found by an in-house static analysis tool.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/ab8500_fg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c2ce9b8f325f522e10e4d262b37ae49deb83e79b",
"status": "affected",
"version": "13151631b5bd06a1511353bb221079bbd76606c3",
"versionType": "git"
},
{
"lessThan": "c660c017dec1fd7cd88e1103c5ae1aae6ce636bf",
"status": "affected",
"version": "13151631b5bd06a1511353bb221079bbd76606c3",
"versionType": "git"
},
{
"lessThan": "013731074ab6a8d11ec209eee64c5b2656954479",
"status": "affected",
"version": "13151631b5bd06a1511353bb221079bbd76606c3",
"versionType": "git"
},
{
"lessThan": "75b1e88d34254f4fb7753345e21bfee47abddd7f",
"status": "affected",
"version": "13151631b5bd06a1511353bb221079bbd76606c3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/ab8500_fg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: ab8500_fg: fix use-after-free on remove\n\nab8500_fg_remove() destroys the driver workqueue while the threaded\ninterrupt handlers are still armed; they are devm-managed and freed\nonly after -\u003eremove() returns, so a handler that fires in that\nwindow queues work on the freed workqueue.\n\nTear the workqueue down through devm instead, registering its cleanup\nafter the power supply and before the interrupt requests. devm then\nfrees the interrupts first, so the handlers can no longer queue work,\nbefore disabling the delayed and plain work items and destroying the\nworkqueue. Disabling the items, rather than cancelling them, keeps\nthem disabled so no producer (including the power-supply\nexternal_power_changed callback) can requeue them.\n\nFound by an in-house static analysis tool."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:52:52.019Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c2ce9b8f325f522e10e4d262b37ae49deb83e79b"
},
{
"url": "https://git.kernel.org/stable/c/c660c017dec1fd7cd88e1103c5ae1aae6ce636bf"
},
{
"url": "https://git.kernel.org/stable/c/013731074ab6a8d11ec209eee64c5b2656954479"
},
{
"url": "https://git.kernel.org/stable/c/75b1e88d34254f4fb7753345e21bfee47abddd7f"
}
],
"title": "power: supply: ab8500_fg: fix use-after-free on remove",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89797",
"datePublished": "2026-09-16T10:30:28.484Z",
"dateReserved": "2026-09-11T19:38:34.767Z",
"dateUpdated": "2026-10-19T08:52:52.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-38204 (GCVE-0-2025-38204)
Vulnerability from cvelistv5
Published
2025-07-04 13:37
Modified
2026-10-21 12:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
jfs: fix array-index-out-of-bounds read in add_missing_indices
stbl is s8 but it must contain offsets into slot which can go from 0 to
127.
Added a bound check for that error and return -EIO if the check fails.
Also make jfs_readdir return with error if add_missing_indices returns
with an error.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:35:26.756Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/jfs/jfs_dtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81af4b34fd72d390d7f237c6a545cc6d09707956",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bfa4655d28f338e68d345aed80d19be7999bbce2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "44618bee303bed151ef3a525ff79fbd7689593b5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c8733634978086b41255695d993cec3017a23a27",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2ec34dc7094b14149ce091c77aff43a45d255518",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c8399564a58fb6ea2ff21a6fd278417943cb51a5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5dff41a86377563f7a2b968aae00d25b4ceb37c9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/jfs/jfs_dtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.295",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.239",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.186",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.295",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.239",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.186",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds read in add_missing_indices\n\nstbl is s8 but it must contain offsets into slot which can go from 0 to\n127.\n\nAdded a bound check for that error and return -EIO if the check fails.\nAlso make jfs_readdir return with error if add_missing_indices returns\nwith an error."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attack requires a crafted JFS image to be presented to and mounted on the local system (loop device, or removable media auto-mounted by udisks2/autofs on a kiosk or shared workstation), after which the trigger is an ordinary local getdents64() syscall on a directory. There is no network or remote-peer input path into jfs_readdir()/add_missing_indices().\nAC:L - Every controlling value \u2014 the negative stbl[] entries, the starting slot in the dir_table entry that makes readdir skip them, the out-of-range d-\u003eindex that sets fix_page, and next_index \u2014 is read verbatim from the attacker\u0027s image, so the out-of-bounds access is fully deterministic with no race, timing, or memory-layout condition outside the attacker\u0027s control.\nPR:N - The attacker only has to author the filesystem image and needs no account or privilege on the target; once mounted, the vulnerable path is reached by an unprivileged readdir with no capable() or permission check anywhere between the syscall and add_missing_indices().\nUI:R - A user or an automounter on the victim system must mount the malicious JFS image read-write before the corrupted dtree page is ever ingested; on a desktop the file manager then issues the getdents that trips the bug without further action.\nS:U - The out-of-bounds read, the out-of-bounds write, and the corrupted journal records are all confined to the kernel\u0027s own security authority on the affected host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The negative index reads kernel memory up to 4064 bytes before the metapage folio, and because lv-\u003eoffset is u8 the same value makes lmWriteRecord() memcpy 32 bytes from up to 4064 bytes past the metapage into the journal, persisting kernel heap contents onto storage the attacker supplied and can read back \u2014 far beyond a bounded few-byte read.\nI:H - When the out-of-bounds-read d-\u003eindex fails the (2 \u003c= index \u003c next_index) test \u2014 which arbitrary adjacent heap data almost always does \u2014 the code performs a 4-byte out-of-bounds write of add_index()\u0027s return value at an attacker-chosen 32-byte-aligned offset among 128 possible slots before the metapage, giving a groomable heap corruption primitive in addition to the bogus linelock that corrupts the on-disk journal.\nA:H - The wild read and write reach adjacent page-cache folios and other kernel allocations, producing a KASAN report/oops or corrupting live kernel structures, and the malformed journal line-vector writes garbage into the log; the attacker can repeat the readdir arbitrarily, so a kernel panic is readily achievable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:36:51.285Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81af4b34fd72d390d7f237c6a545cc6d09707956"
},
{
"url": "https://git.kernel.org/stable/c/bfa4655d28f338e68d345aed80d19be7999bbce2"
},
{
"url": "https://git.kernel.org/stable/c/44618bee303bed151ef3a525ff79fbd7689593b5"
},
{
"url": "https://git.kernel.org/stable/c/c8733634978086b41255695d993cec3017a23a27"
},
{
"url": "https://git.kernel.org/stable/c/2ec34dc7094b14149ce091c77aff43a45d255518"
},
{
"url": "https://git.kernel.org/stable/c/c8399564a58fb6ea2ff21a6fd278417943cb51a5"
},
{
"url": "https://git.kernel.org/stable/c/5dff41a86377563f7a2b968aae00d25b4ceb37c9"
}
],
"title": "jfs: fix array-index-out-of-bounds read in add_missing_indices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38204",
"datePublished": "2025-07-04T13:37:24.606Z",
"dateReserved": "2025-04-16T04:51:23.994Z",
"dateUpdated": "2026-10-21T12:36:51.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98167 (GCVE-0-2026-98167)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix server->total_read for compound encrypted PDUs
In receive_encrypted_standard(), server->total_read is left at the
full decrypted frame size when walking sub-PDUs of a compound encrypted
frame. As a result, cifs_handle_standard() passes this full size
to smb2_check_message(), causing the PDU length guards to incorrectly
validate the entire compound frame instead of the current sub-PDU.
This allows truncated non-last sub-PDUs to bypass length validation,
leading to out-of-bounds reads in smb2_get_data_area_len().
Fix this by setting server->total_read to the true length of the
current sub-PDU: next_cmd for non-last sub-PDUs, and the remaining
pdu_length for the last one.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8703539d22fdbc13dd2db090ee199c3a427b8ea0",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "e78fc1d240b27349b45a0f1c3e3c2c401d7e230d",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "a46eb242e9eef3a3897d166748b23303c516e870",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "ebb8a075fdc7af3d196a4f158a0e18dbc394c0e3",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "282b72f9a7ef31296c48366db4128882999cc048",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "f73726b83e4756fdaa099e1bc1143293bd57ad79",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix server-\u003etotal_read for compound encrypted PDUs\n\nIn receive_encrypted_standard(), server-\u003etotal_read is left at the\nfull decrypted frame size when walking sub-PDUs of a compound encrypted\nframe. As a result, cifs_handle_standard() passes this full size\nto smb2_check_message(), causing the PDU length guards to incorrectly\nvalidate the entire compound frame instead of the current sub-PDU.\n\nThis allows truncated non-last sub-PDUs to bypass length validation,\nleading to out-of-bounds reads in smb2_get_data_area_len().\n\nFix this by setting server-\u003etotal_read to the true length of the\ncurrent sub-PDU: next_cmd for non-last sub-PDUs, and the remaining\npdu_length for the last one."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:14:58.765Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8703539d22fdbc13dd2db090ee199c3a427b8ea0"
},
{
"url": "https://git.kernel.org/stable/c/e78fc1d240b27349b45a0f1c3e3c2c401d7e230d"
},
{
"url": "https://git.kernel.org/stable/c/a46eb242e9eef3a3897d166748b23303c516e870"
},
{
"url": "https://git.kernel.org/stable/c/ebb8a075fdc7af3d196a4f158a0e18dbc394c0e3"
},
{
"url": "https://git.kernel.org/stable/c/282b72f9a7ef31296c48366db4128882999cc048"
},
{
"url": "https://git.kernel.org/stable/c/f73726b83e4756fdaa099e1bc1143293bd57ad79"
}
],
"title": "smb: client: fix server-\u003etotal_read for compound encrypted PDUs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98167",
"datePublished": "2026-10-06T08:44:12.731Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-10-19T09:14:58.765Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98255 (GCVE-0-2026-98255)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: exclude old ACKs from tcp fast path
Exclude old ACKs before SND.UNA from the tcp fast path
as well as ACKs after SND.NXT.
Such ACKs will fall through to the slow path, where tcp_ack()
performs the appropriate validation and challenge ACK handling
according to RFC5961 and Commit 3d501dd326fb1c7 ("tcp: do not
accept ACK of bytes we never sent").
This prevents old ACKs from being accepted
or modifying connection state as part of the fast path before
appropriate ACK validation is applied.
In particular, this prevents payload carried by a segment with
an excessively old ACK from advancing RCV.NXT before the ACK
is rejected.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 31770e34e43d6c8dee129bfee77e56c34e61f0e5 Version: 31770e34e43d6c8dee129bfee77e56c34e61f0e5 Version: 31770e34e43d6c8dee129bfee77e56c34e61f0e5 Version: 31770e34e43d6c8dee129bfee77e56c34e61f0e5 Version: 31770e34e43d6c8dee129bfee77e56c34e61f0e5 Version: 31770e34e43d6c8dee129bfee77e56c34e61f0e5 Version: 31770e34e43d6c8dee129bfee77e56c34e61f0e5 Version: 31770e34e43d6c8dee129bfee77e56c34e61f0e5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "07cacab90290f795bad2e566790f4ba8e84cdf5f",
"status": "affected",
"version": "31770e34e43d6c8dee129bfee77e56c34e61f0e5",
"versionType": "git"
},
{
"lessThan": "6eb9b697f50b73b9684e466c1e97f4ca8e947a59",
"status": "affected",
"version": "31770e34e43d6c8dee129bfee77e56c34e61f0e5",
"versionType": "git"
},
{
"lessThan": "b86e1e5a4bbcbbccde8b7a3d3486604b581f6628",
"status": "affected",
"version": "31770e34e43d6c8dee129bfee77e56c34e61f0e5",
"versionType": "git"
},
{
"lessThan": "1c8448db5cf35a13d82b0c9004ffdb49358883e7",
"status": "affected",
"version": "31770e34e43d6c8dee129bfee77e56c34e61f0e5",
"versionType": "git"
},
{
"lessThan": "8309dc2cc360056aa9cd2acfbfc25930798c3b66",
"status": "affected",
"version": "31770e34e43d6c8dee129bfee77e56c34e61f0e5",
"versionType": "git"
},
{
"lessThan": "ff037920c688ae6ca1153fec01e90e6782712455",
"status": "affected",
"version": "31770e34e43d6c8dee129bfee77e56c34e61f0e5",
"versionType": "git"
},
{
"lessThan": "8205ac5ddb42a1843fa8d6a8c295b5c7f4f8c6ed",
"status": "affected",
"version": "31770e34e43d6c8dee129bfee77e56c34e61f0e5",
"versionType": "git"
},
{
"lessThan": "f81e6c3fb06327bc49cdd6e559845293ba06a704",
"status": "affected",
"version": "31770e34e43d6c8dee129bfee77e56c34e61f0e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: exclude old ACKs from tcp fast path\n\nExclude old ACKs before SND.UNA from the tcp fast path\nas well as ACKs after SND.NXT.\n\nSuch ACKs will fall through to the slow path, where tcp_ack()\nperforms the appropriate validation and challenge ACK handling\naccording to RFC5961 and Commit 3d501dd326fb1c7 (\"tcp: do not\naccept ACK of bytes we never sent\").\n\nThis prevents old ACKs from being accepted\nor modifying connection state as part of the fast path before\nappropriate ACK validation is applied.\nIn particular, this prevents payload carried by a segment with\nan excessively old ACK from advancing RCV.NXT before the ACK\nis rejected."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:26.522Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/07cacab90290f795bad2e566790f4ba8e84cdf5f"
},
{
"url": "https://git.kernel.org/stable/c/6eb9b697f50b73b9684e466c1e97f4ca8e947a59"
},
{
"url": "https://git.kernel.org/stable/c/b86e1e5a4bbcbbccde8b7a3d3486604b581f6628"
},
{
"url": "https://git.kernel.org/stable/c/1c8448db5cf35a13d82b0c9004ffdb49358883e7"
},
{
"url": "https://git.kernel.org/stable/c/8309dc2cc360056aa9cd2acfbfc25930798c3b66"
},
{
"url": "https://git.kernel.org/stable/c/ff037920c688ae6ca1153fec01e90e6782712455"
},
{
"url": "https://git.kernel.org/stable/c/8205ac5ddb42a1843fa8d6a8c295b5c7f4f8c6ed"
},
{
"url": "https://git.kernel.org/stable/c/f81e6c3fb06327bc49cdd6e559845293ba06a704"
}
],
"title": "tcp: exclude old ACKs from tcp fast path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98255",
"datePublished": "2026-10-06T08:45:21.397Z",
"dateReserved": "2026-09-25T10:25:14.331Z",
"dateUpdated": "2026-10-19T09:16:26.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98101 (GCVE-0-2026-98101)
Vulnerability from cvelistv5
Published
2026-09-25 10:35
Modified
2026-10-19 09:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()
pmc->sflist is read locklessly under rcu_read_lock() by
inet6_mc_check() during packet reception in the UDP and RAW
multicast receive paths.
ip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place
when adding or removing a source filter. Additionally, when expanding
the filter buffer, newpsl was published via rcu_assign_pointer()
before writing the new source into the array.
Because 16-byte struct in6_addr writes are not atomic and array
shifting is not synchronized with RCU readers, concurrent readers in
inet6_mc_check() could read torn IPv6 addresses or observe
duplicated/missed source entries.
Fix this by switching ip6_mc_source() to copy-on-write RCU updates:
allocate and fully populate newpsl before publishing it via
rcu_assign_pointer(), and reclaim the old filter via kfree_rcu(),
matching ip6_mc_msfilter().
Also remove the now unused IP6_SFBLOCK macro.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 882ba1f73c06831f2a21044ebd8864c485ac04f2 Version: 882ba1f73c06831f2a21044ebd8864c485ac04f2 Version: 882ba1f73c06831f2a21044ebd8864c485ac04f2 Version: 882ba1f73c06831f2a21044ebd8864c485ac04f2 Version: 882ba1f73c06831f2a21044ebd8864c485ac04f2 Version: 47c75e3923c8d562fea8daf0ccf31546a7bef0ea Version: 5.10.261 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/if_inet6.h",
"net/ipv6/mcast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ac51321d3b2391860a935820ebcf4d8b9bb16a8a",
"status": "affected",
"version": "882ba1f73c06831f2a21044ebd8864c485ac04f2",
"versionType": "git"
},
{
"lessThan": "dba00514bf668c26cb4900e9f0da84bf96bf065a",
"status": "affected",
"version": "882ba1f73c06831f2a21044ebd8864c485ac04f2",
"versionType": "git"
},
{
"lessThan": "2c2091e2ee93049fc513ad1e6c99d8b6c809f467",
"status": "affected",
"version": "882ba1f73c06831f2a21044ebd8864c485ac04f2",
"versionType": "git"
},
{
"lessThan": "20db91a052332ef5552bd2f651ffb9db911cf67b",
"status": "affected",
"version": "882ba1f73c06831f2a21044ebd8864c485ac04f2",
"versionType": "git"
},
{
"lessThan": "c073d1b070f171d206b19c98d71739a97f15b3f1",
"status": "affected",
"version": "882ba1f73c06831f2a21044ebd8864c485ac04f2",
"versionType": "git"
},
{
"status": "affected",
"version": "47c75e3923c8d562fea8daf0ccf31546a7bef0ea",
"versionType": "git"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.261",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/if_inet6.h",
"net/ipv6/mcast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.261",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()\n\npmc-\u003esflist is read locklessly under rcu_read_lock() by\ninet6_mc_check() during packet reception in the UDP and RAW\nmulticast receive paths.\n\nip6_mc_source() mutated psl-\u003esl_addr and psl-\u003esl_count in-place\nwhen adding or removing a source filter. Additionally, when expanding\nthe filter buffer, newpsl was published via rcu_assign_pointer()\nbefore writing the new source into the array.\n\nBecause 16-byte struct in6_addr writes are not atomic and array\nshifting is not synchronized with RCU readers, concurrent readers in\ninet6_mc_check() could read torn IPv6 addresses or observe\nduplicated/missed source entries.\n\nFix this by switching ip6_mc_source() to copy-on-write RCU updates:\nallocate and fully populate newpsl before publishing it via\nrcu_assign_pointer(), and reclaim the old filter via kfree_rcu(),\nmatching ip6_mc_msfilter().\n\nAlso remove the now unused IP6_SFBLOCK macro."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:13:53.770Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ac51321d3b2391860a935820ebcf4d8b9bb16a8a"
},
{
"url": "https://git.kernel.org/stable/c/dba00514bf668c26cb4900e9f0da84bf96bf065a"
},
{
"url": "https://git.kernel.org/stable/c/2c2091e2ee93049fc513ad1e6c99d8b6c809f467"
},
{
"url": "https://git.kernel.org/stable/c/20db91a052332ef5552bd2f651ffb9db911cf67b"
},
{
"url": "https://git.kernel.org/stable/c/c073d1b070f171d206b19c98d71739a97f15b3f1"
}
],
"title": "ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98101",
"datePublished": "2026-09-25T10:35:52.731Z",
"dateReserved": "2026-09-25T10:25:14.315Z",
"dateUpdated": "2026-10-19T09:13:53.770Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98252 (GCVE-0-2026-98252)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
iwpm_get_nlmsg_request() initializes refcount _after_ list_add_tail()
making it accessible to global list where another CPU can kref_get()
on nlmsg_request causing a refcount "addition on 0" bug. Fix this
by initializing kref _before_ list_add_tail() so refcount for
nlmsg_request can be incremented/decremented normally. In addition,
also initialize every field before list_add_tail().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 Version: 30dc5e63d6a5ad24894b5512d10b228d73645a44 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/iwpm_util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "52c13c63bb3662c108244e7447055e30bf40244e",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "8a91609032d47e77bcb37bc8f6e88d89340d2709",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "ce8a379598bd4058081416abea4279fd05a95374",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "2fbac8a56004b6ce54fbfe845d4b25da6e0b55e8",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "88e429a4e9bac3d2138011c5ca06254331f2587f",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "e15eb536be4f646ce683d2867572b2200be877f7",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "117871cdb8927542abd7b65ce5995bf0265a8c05",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
},
{
"lessThan": "33fb59da49c4c3f5c2ec9f9d4447a56857a02c02",
"status": "affected",
"version": "30dc5e63d6a5ad24894b5512d10b228d73645a44",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/iwpm_util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: fix refcount bug in iwpm_get_nlmsg_request()\n\niwpm_get_nlmsg_request() initializes refcount _after_ list_add_tail()\nmaking it accessible to global list where another CPU can kref_get()\non nlmsg_request causing a refcount \"addition on 0\" bug. Fix this\nby initializing kref _before_ list_add_tail() so refcount for\nnlmsg_request can be incremented/decremented normally. In addition,\nalso initialize every field before list_add_tail()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The triggering input is a forged IWPM reply (e.g. RDMA_NL_IWPM_REG_PID) sent over a local NETLINK_RDMA socket to iwcm_nl_cb_table callbacks, which call iwpm_find_nlmsg_request(). No remote protocol carries it, and rdma_nl_rcv_msg() rejects RDMA_NL_IWCM messages from outside init_net.\nAC:H - The forged reply must land in the few-instruction gap between list_add_tail() and kref_init()/sema_init() in iwpm_get_nlmsg_request(). The host also needs an iWARP device so that iw_cm_map() sends port-mapper requests, and the attacker cannot set that up.\nPR:L - No iwcm_nl_cb_table entry sets RDMA_NL_ADMIN_PERM, and the NETLINK_RDMA socket uses NL_CFG_F_NONROOT_RECV, so an unprivileged user in the initial netns can join RDMA_NL_GROUP_IWPM, read the sequence numbers and send replies. A local login is still needed.\nUI:N - The attacker sends the netlink replies and starts iWARP connection setup without any action from another user.\nS:U - The memory corruption stays inside the kernel\u0027s own security authority. No guest/host or IOMMU boundary is crossed.\nC:H - kref_init() erases the reference taken by iwpm_find_nlmsg_request(), so the requester\u0027s kref_put() in iwpm_wait_complete_req() can free the kmalloc\u0027d iwpm_nlmsg_request while iwpm_register_pid_cb() still uses it. That is a use-after-free that can be reclaimed by sprayed data.\nI:H - After the early free, the callback\u0027s up(\u0026nlmsg_request-\u003esem) and the requester\u0027s down_timeout() write a semaphore inside a freed and possibly reclaimed slab object. That is a use-after-free write on heap memory.\nA:H - The race fires a refcount_t \u0027addition on 0\u0027 WARN (a panic under panic_on_warn), and the replies can dereference NULL req_buffer in iwpm_register_pid_cb() or touch freed memory, either of which oopses the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:23.591Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/52c13c63bb3662c108244e7447055e30bf40244e"
},
{
"url": "https://git.kernel.org/stable/c/8a91609032d47e77bcb37bc8f6e88d89340d2709"
},
{
"url": "https://git.kernel.org/stable/c/ce8a379598bd4058081416abea4279fd05a95374"
},
{
"url": "https://git.kernel.org/stable/c/2fbac8a56004b6ce54fbfe845d4b25da6e0b55e8"
},
{
"url": "https://git.kernel.org/stable/c/88e429a4e9bac3d2138011c5ca06254331f2587f"
},
{
"url": "https://git.kernel.org/stable/c/e15eb536be4f646ce683d2867572b2200be877f7"
},
{
"url": "https://git.kernel.org/stable/c/117871cdb8927542abd7b65ce5995bf0265a8c05"
},
{
"url": "https://git.kernel.org/stable/c/33fb59da49c4c3f5c2ec9f9d4447a56857a02c02"
}
],
"title": "RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98252",
"datePublished": "2026-10-06T08:45:19.393Z",
"dateReserved": "2026-09-25T10:25:14.331Z",
"dateUpdated": "2026-10-19T09:16:23.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93231 (GCVE-0-2026-93231)
Vulnerability from cvelistv5
Published
2026-09-24 15:29
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
lockd: fix swapped arguments in nlmsvc_match_ip()
When releasing locks by server IP address via /proc/fs/nfsd/unlock_ip,
nlmsvc_unlock_all_by_ip() calls nlm_traverse_files() with the server
sockaddr as the opaque @data argument:
nlm_traverse_files(server_addr, nlmsvc_match_ip, NULL);
The match callback is later invoked from nlm_traverse_locks() as:
match(lockhost, host);
where the first argument is the nlm_host that owns the lock, and the
second argument is the @data that was originally passed down (here the
server sockaddr). This is the convention every other match callback
relies on (nlmsvc_mark_host(), nlmsvc_same_host(), nlmsvc_is_client()):
arg1 is the real nlm_host, arg2 is the caller-supplied reference value.
nlmsvc_match_ip() has had these two arguments reversed ever since the
unlock-by-IP feature was introduced in commit 4373ea84c84d ("lockd:
unlock lockd locks associated with a given server ip"):
return rpc_cmp_addr(nlm_srcaddr(host), datap);
Here @host is actually the server sockaddr, so nlm_srcaddr(host)
dereferences a struct sockaddr as a struct nlm_host and reads garbage
at the offset of h_srcaddr; meanwhile @datap is actually the lock
owner's nlm_host but is compared as a sockaddr. As a result the
comparison practically never matches and locks are not released for the
requested IP.
Swap the arguments so the lock owner's source address is compared
against the requested server address:
return rpc_cmp_addr(nlm_srcaddr(datap), (struct sockaddr *)host);
[ cel: fix the misleading typedef parameter names too ]
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/lockd/lockd.h",
"fs/lockd/svcsubs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4fe2db296c9cd897dd1fe06cc0ae9cbc13beefc5",
"status": "affected",
"version": "4373ea84c84d8a96e99d3da99e813d3e36d1bd11",
"versionType": "git"
},
{
"lessThan": "d34c2ac447fe0490ede828e0143e2cbcb59e6c77",
"status": "affected",
"version": "4373ea84c84d8a96e99d3da99e813d3e36d1bd11",
"versionType": "git"
},
{
"lessThan": "0d72e78c9d38d5377a059a4837f82b65b91cdcf6",
"status": "affected",
"version": "4373ea84c84d8a96e99d3da99e813d3e36d1bd11",
"versionType": "git"
},
{
"lessThan": "21bcb609e0ab1dd60f39ca3498f85808933bcc9f",
"status": "affected",
"version": "4373ea84c84d8a96e99d3da99e813d3e36d1bd11",
"versionType": "git"
},
{
"lessThan": "b9060689f49dc663e9a3d069c4a65ff63a836e66",
"status": "affected",
"version": "4373ea84c84d8a96e99d3da99e813d3e36d1bd11",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/lockd/lockd.h",
"fs/lockd/svcsubs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: fix swapped arguments in nlmsvc_match_ip()\n\nWhen releasing locks by server IP address via /proc/fs/nfsd/unlock_ip,\nnlmsvc_unlock_all_by_ip() calls nlm_traverse_files() with the server\nsockaddr as the opaque @data argument:\n\n\tnlm_traverse_files(server_addr, nlmsvc_match_ip, NULL);\n\nThe match callback is later invoked from nlm_traverse_locks() as:\n\n\tmatch(lockhost, host);\n\nwhere the first argument is the nlm_host that owns the lock, and the\nsecond argument is the @data that was originally passed down (here the\nserver sockaddr). This is the convention every other match callback\nrelies on (nlmsvc_mark_host(), nlmsvc_same_host(), nlmsvc_is_client()):\narg1 is the real nlm_host, arg2 is the caller-supplied reference value.\n\nnlmsvc_match_ip() has had these two arguments reversed ever since the\nunlock-by-IP feature was introduced in commit 4373ea84c84d (\"lockd:\nunlock lockd locks associated with a given server ip\"):\n\n\treturn rpc_cmp_addr(nlm_srcaddr(host), datap);\n\nHere @host is actually the server sockaddr, so nlm_srcaddr(host)\ndereferences a struct sockaddr as a struct nlm_host and reads garbage\nat the offset of h_srcaddr; meanwhile @datap is actually the lock\nowner\u0027s nlm_host but is compared as a sockaddr. As a result the\ncomparison practically never matches and locks are not released for the\nrequested IP.\n\nSwap the arguments so the lock owner\u0027s source address is compared\nagainst the requested server address:\n\n\treturn rpc_cmp_addr(nlm_srcaddr(datap), (struct sockaddr *)host);\n\n[ cel: fix the misleading typedef parameter names too ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:26.223Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4fe2db296c9cd897dd1fe06cc0ae9cbc13beefc5"
},
{
"url": "https://git.kernel.org/stable/c/d34c2ac447fe0490ede828e0143e2cbcb59e6c77"
},
{
"url": "https://git.kernel.org/stable/c/0d72e78c9d38d5377a059a4837f82b65b91cdcf6"
},
{
"url": "https://git.kernel.org/stable/c/21bcb609e0ab1dd60f39ca3498f85808933bcc9f"
},
{
"url": "https://git.kernel.org/stable/c/b9060689f49dc663e9a3d069c4a65ff63a836e66"
}
],
"title": "lockd: fix swapped arguments in nlmsvc_match_ip()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93231",
"datePublished": "2026-09-24T15:29:19.786Z",
"dateReserved": "2026-09-17T16:02:15.095Z",
"dateUpdated": "2026-10-21T12:52:26.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98207 (GCVE-0-2026-98207)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mmc: spi: reset bytes_xfered before retrying CRC failures
mmc_spi_data_do() updates data->bytes_xfered after each block has been
transferred successfully. If a later block in the same data request
fails with a CRC error, data->bytes_xfered may therefore contain the
number of bytes completed before the failing block.
mmc_spi_request() has a private recovery path for such CRC failures. It
sends STOP_TRANSMISSION, clears data->error and jumps back to
crc_recover to issue the same command and data request again. However,
it does not clear data->bytes_xfered before the retry.
If the retry succeeds, the request is completed with the bytes from the
failed attempt still included in data->bytes_xfered. For a multi-block
request this can make the completed request report more bytes than were
transferred by the successful retry, and can even exceed the request size
when most blocks completed before the CRC error.
This is most likely to be observed on MMC-over-SPI systems where long
multi-block transfers occasionally hit a data CRC error but the
mmc_spi-internal retry succeeds. The data itself is retried, but the
completion accounting is not.
Clear data->bytes_xfered together with data->error before repeating the
request so the final completion reports only the bytes transferred by the
successful attempt.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 061c6c847eeb11743e489a16e907b41c6f9042b6 Version: 061c6c847eeb11743e489a16e907b41c6f9042b6 Version: 061c6c847eeb11743e489a16e907b41c6f9042b6 Version: 061c6c847eeb11743e489a16e907b41c6f9042b6 Version: 061c6c847eeb11743e489a16e907b41c6f9042b6 Version: 061c6c847eeb11743e489a16e907b41c6f9042b6 Version: 061c6c847eeb11743e489a16e907b41c6f9042b6 Version: 061c6c847eeb11743e489a16e907b41c6f9042b6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/mmc_spi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7d2f0ec16b300645f20435a6c3827b15e01419af",
"status": "affected",
"version": "061c6c847eeb11743e489a16e907b41c6f9042b6",
"versionType": "git"
},
{
"lessThan": "d1acf4b9f6e9697406ce84ee9acfb92e094d5c7a",
"status": "affected",
"version": "061c6c847eeb11743e489a16e907b41c6f9042b6",
"versionType": "git"
},
{
"lessThan": "0b8c8504593409954ed1a60db4e437d814e04023",
"status": "affected",
"version": "061c6c847eeb11743e489a16e907b41c6f9042b6",
"versionType": "git"
},
{
"lessThan": "da4929ee78ee701c3717543840798fedff66c430",
"status": "affected",
"version": "061c6c847eeb11743e489a16e907b41c6f9042b6",
"versionType": "git"
},
{
"lessThan": "57f5e29db63f7c80f1805d89234a74dcdbf60231",
"status": "affected",
"version": "061c6c847eeb11743e489a16e907b41c6f9042b6",
"versionType": "git"
},
{
"lessThan": "4885e587f1afa9e1a573ab66f8c4d94d7b836d86",
"status": "affected",
"version": "061c6c847eeb11743e489a16e907b41c6f9042b6",
"versionType": "git"
},
{
"lessThan": "3ae80c1fb7de4d3331427a955a44807745ac5a33",
"status": "affected",
"version": "061c6c847eeb11743e489a16e907b41c6f9042b6",
"versionType": "git"
},
{
"lessThan": "8b0cc8707f65e0f51912e764e1b309b2559db1ec",
"status": "affected",
"version": "061c6c847eeb11743e489a16e907b41c6f9042b6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/mmc_spi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: spi: reset bytes_xfered before retrying CRC failures\n\nmmc_spi_data_do() updates data-\u003ebytes_xfered after each block has been\ntransferred successfully. If a later block in the same data request\nfails with a CRC error, data-\u003ebytes_xfered may therefore contain the\nnumber of bytes completed before the failing block.\n\nmmc_spi_request() has a private recovery path for such CRC failures. It\nsends STOP_TRANSMISSION, clears data-\u003eerror and jumps back to\ncrc_recover to issue the same command and data request again. However,\nit does not clear data-\u003ebytes_xfered before the retry.\n\nIf the retry succeeds, the request is completed with the bytes from the\nfailed attempt still included in data-\u003ebytes_xfered. For a multi-block\nrequest this can make the completed request report more bytes than were\ntransferred by the successful retry, and can even exceed the request size\nwhen most blocks completed before the CRC error.\n\nThis is most likely to be observed on MMC-over-SPI systems where long\nmulti-block transfers occasionally hit a data CRC error but the\nmmc_spi-internal retry succeeds. The data itself is retried, but the\ncompletion accounting is not.\n\nClear data-\u003ebytes_xfered together with data-\u003eerror before repeating the\nrequest so the final completion reports only the bytes transferred by the\nsuccessful attempt."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:38.158Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7d2f0ec16b300645f20435a6c3827b15e01419af"
},
{
"url": "https://git.kernel.org/stable/c/d1acf4b9f6e9697406ce84ee9acfb92e094d5c7a"
},
{
"url": "https://git.kernel.org/stable/c/0b8c8504593409954ed1a60db4e437d814e04023"
},
{
"url": "https://git.kernel.org/stable/c/da4929ee78ee701c3717543840798fedff66c430"
},
{
"url": "https://git.kernel.org/stable/c/57f5e29db63f7c80f1805d89234a74dcdbf60231"
},
{
"url": "https://git.kernel.org/stable/c/4885e587f1afa9e1a573ab66f8c4d94d7b836d86"
},
{
"url": "https://git.kernel.org/stable/c/3ae80c1fb7de4d3331427a955a44807745ac5a33"
},
{
"url": "https://git.kernel.org/stable/c/8b0cc8707f65e0f51912e764e1b309b2559db1ec"
}
],
"title": "mmc: spi: reset bytes_xfered before retrying CRC failures",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98207",
"datePublished": "2026-10-06T08:44:44.241Z",
"dateReserved": "2026-09-25T10:25:14.325Z",
"dateUpdated": "2026-10-19T09:15:38.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89527 (GCVE-0-2026-89527)
Vulnerability from cvelistv5
Published
2026-09-11 19:44
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Use svc_xprt_put to free listener on create failure
svc_rdma_create() calls kfree(cma_xprt) when
svc_rdma_create_listen_id() fails. svc_xprt_init() has already
acquired a net namespace reference via get_net_track(); kfree
bypasses svc_xprt_free() which releases it.
Replace the kfree() with svc_xprt_put() so the kref_init birth
reference drops to zero and svc_xprt_free() dispatches
svc_rdma_free() to clean up properly. sc_cm_id is still NULL
at that point; the preceding patch added the necessary NULL
guard in svc_rdma_free().
svc_xprt_free() also drops the module reference via
module_put(), but the caller _svc_xprt_create() does the same
on xpo_create failure, double-putting the single
try_module_get() it acquired. Take a compensating
__module_get() before the svc_xprt_put() to keep the count
balanced, matching the convention in svc_rdma_accept()'s error
path.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2e35ec558b8cece9399a50141ecaeadbdb8768dc",
"status": "affected",
"version": "4fb8518bdac8e85f6580ea3f586adf396cd472bc",
"versionType": "git"
},
{
"lessThan": "ee70d690b5544b736706a9a5796aafb634013f54",
"status": "affected",
"version": "4fb8518bdac8e85f6580ea3f586adf396cd472bc",
"versionType": "git"
},
{
"lessThan": "e68380710fc970e07610b2f42594575ad35fdb1c",
"status": "affected",
"version": "4fb8518bdac8e85f6580ea3f586adf396cd472bc",
"versionType": "git"
},
{
"lessThan": "ac1dd6002f758ab7dd3e737757e5a1bb1c0b38d6",
"status": "affected",
"version": "4fb8518bdac8e85f6580ea3f586adf396cd472bc",
"versionType": "git"
},
{
"lessThan": "e346ef7bcb137f50c49f969330ab7dcf64ea1654",
"status": "affected",
"version": "4fb8518bdac8e85f6580ea3f586adf396cd472bc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/svc_rdma_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Use svc_xprt_put to free listener on create failure\n\nsvc_rdma_create() calls kfree(cma_xprt) when\nsvc_rdma_create_listen_id() fails. svc_xprt_init() has already\nacquired a net namespace reference via get_net_track(); kfree\nbypasses svc_xprt_free() which releases it.\n\nReplace the kfree() with svc_xprt_put() so the kref_init birth\nreference drops to zero and svc_xprt_free() dispatches\nsvc_rdma_free() to clean up properly. sc_cm_id is still NULL\nat that point; the preceding patch added the necessary NULL\nguard in svc_rdma_free().\n\nsvc_xprt_free() also drops the module reference via\nmodule_put(), but the caller _svc_xprt_create() does the same\non xpo_create failure, double-putting the single\ntry_module_get() it acquired. Take a compensating\n__module_get() before the svc_xprt_put() to keep the count\nbalanced, matching the convention in svc_rdma_accept()\u0027s error\npath."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:40.431Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2e35ec558b8cece9399a50141ecaeadbdb8768dc"
},
{
"url": "https://git.kernel.org/stable/c/ee70d690b5544b736706a9a5796aafb634013f54"
},
{
"url": "https://git.kernel.org/stable/c/e68380710fc970e07610b2f42594575ad35fdb1c"
},
{
"url": "https://git.kernel.org/stable/c/ac1dd6002f758ab7dd3e737757e5a1bb1c0b38d6"
},
{
"url": "https://git.kernel.org/stable/c/e346ef7bcb137f50c49f969330ab7dcf64ea1654"
}
],
"title": "svcrdma: Use svc_xprt_put to free listener on create failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89527",
"datePublished": "2026-09-11T19:44:07.785Z",
"dateReserved": "2026-09-11T19:38:34.719Z",
"dateUpdated": "2026-10-21T12:47:40.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-40158 (GCVE-0-2025-40158)
Vulnerability from cvelistv5
Published
2025-11-12 10:23
Modified
2026-10-21 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: use RCU in ip6_output()
Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent
possible UAF.
We can remove rcu_read_lock()/rcu_read_unlock() pairs
from ip6_finish_output2().
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-40158",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T20:00:29.008533Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T20:00:37.150Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "423895685f367b5a0a956bd14b02df0192bded4c",
"status": "affected",
"version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
"versionType": "git"
},
{
"lessThan": "92803b826e40e49a5e8a6e208f4b4574e9d19426",
"status": "affected",
"version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
"versionType": "git"
},
{
"lessThan": "0393f85c3241c19ba8550f04a812e7d19f6b3082",
"status": "affected",
"version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
"versionType": "git"
},
{
"lessThan": "11709573cc4e48dc34c80fc7ab9ce5b159e29695",
"status": "affected",
"version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.3",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: use RCU in ip6_output()\n\nUse RCU in ip6_output() in order to use dst_dev_rcu() to prevent\npossible UAF.\n\nWe can remove rcu_read_lock()/rcu_read_unlock() pairs\nfrom ip6_finish_output2()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - `ip6_output()` is the IPv6 egress path for *forwarded* packets \u2014 `ip6_forward()` \u2192 `ip6_forward_finish()` \u2192 `dst_output()` \u2192 `ip6_output()` \u2014 so a remote, unauthenticated attacker\u0027s IPv6 traffic drives the vulnerable function on any Linux router, gateway, or container/cloud host, matching sibling CVE-2025-40168 in the same dst_dev_rcu series.\nAC:H - The remote attacker supplies the traffic side of the race freely, but the `dst_dev_put()` side (netdev unregister/link down, veth deletion, route-exception teardown) is an operational event they cannot influence from the network, and the freed `inet6_dev`/`net_device` must be reallocated with useful content to escalate beyond a crash.\nPR:N - Packets on the forwarding path reach `ip6_output()` with no credentials, no socket, and no local account on the target \u2014 the router transmits them automatically. (Even in the purely local framing the netns/CAP_NET_ADMIN half is obtainable via `unshare -Urn`, so no real privilege is required either way.)\nUI:N - Transmission and forwarding happen unconditionally in softirq/process context on packet arrival; no administrator or local user has to open, mount, or click anything.\nS:U - The freed `inet6_dev` and `net_device` are kernel objects and the corruption stays within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free read of `idev-\u003ecnf.disable_ipv6`, `idev-\u003estats.ipv6`, `dev-\u003ehard_header_len`/`needed_headroom`, `dev-\u003eheader_ops` and `dev-\u003eflags`; once the freed slab object is reallocated the attacker can steer header-expansion sizes and the egress device, yielding kernel memory disclosure and out-of-device packet leakage.\nI:H - `IP6_INC_STATS`/`IP6_UPD_PO_STATS` expand to `SNMP_INC_STATS64(idev-\u003estats.ipv6, field)`, performing a 64-bit increment through a per-CPU pointer loaded from freed memory \u2014 an arbitrary-write primitive after reallocation \u2014 and `neigh_output()` \u2192 `dev_queue_xmit()` makes an indirect call through `dev-\u003enetdev_ops-\u003endo_start_xmit` read from the freed `net_device`, giving control-flow hijack.\nA:H - Dereferencing a freed `inet6_dev`/`net_device` on the packet transmit path reliably oopses or panics the kernel (KASAN slab-use-after-free), and the crash is in the core IPv6 output path so it takes down the whole forwarding host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:37:50.501Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/423895685f367b5a0a956bd14b02df0192bded4c"
},
{
"url": "https://git.kernel.org/stable/c/92803b826e40e49a5e8a6e208f4b4574e9d19426"
},
{
"url": "https://git.kernel.org/stable/c/0393f85c3241c19ba8550f04a812e7d19f6b3082"
},
{
"url": "https://git.kernel.org/stable/c/11709573cc4e48dc34c80fc7ab9ce5b159e29695"
}
],
"title": "ipv6: use RCU in ip6_output()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40158",
"datePublished": "2025-11-12T10:23:29.516Z",
"dateReserved": "2025-04-16T07:20:57.176Z",
"dateUpdated": "2026-10-21T12:37:50.501Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90002 (GCVE-0-2026-90002)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ftrace: Take trace_array reference before accessing its ftrace_ops
The trace instance files set_ftrace_filter and set_ftrace_notrace was
updated to work with specific trace instances (trace_arrays). The issue is
that when these files are opened, there is a small race window where it
will use the ftrace_ops from the inode->private pointer to get a reference
to the trace_array and then take its reference. The problem is that the
ftrace_ops itself could be freed. If the rmdir on the instance happens at
the same time the set_ftrace_filter file is opened, the rmdir could have
also freed the ftrace_ops and referencing it will cause a use-after-free
bug and crash the kernel.
Instead, pass in the trace_array as the file private data (NULL for the
top level instance), and then pass both the trace_array and the ftrace_ops
to the ftrace_regex_open() function. If the trace_array is NULL, then it
just uses the ftrace_ops without the need to take its reference (like
normal). If the ftrace_ops is NULL, that is only the case for the top
level instance and the global_ops can be used.
This allows the trace_array to have its reference incremented before
touching the ftrace_ops that could also be freed when the instance is.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/ftrace.h",
"kernel/trace/ftrace.c",
"kernel/trace/trace.h",
"kernel/trace/trace_functions.c",
"kernel/trace/trace_stack.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "29266da8ee1d9be656b1f22460c49538e1930658",
"status": "affected",
"version": "591dffdade9f07692a7dd3ed16830ec24e901ece",
"versionType": "git"
},
{
"lessThan": "177cd8966325f0ffffa3c9381f9e0422019a3973",
"status": "affected",
"version": "591dffdade9f07692a7dd3ed16830ec24e901ece",
"versionType": "git"
},
{
"lessThan": "83fd7eca5ab0d3ac3f23bff889175d847e21af06",
"status": "affected",
"version": "591dffdade9f07692a7dd3ed16830ec24e901ece",
"versionType": "git"
},
{
"lessThan": "cee8f286794df916553d8d445eac5c323ec5b0f8",
"status": "affected",
"version": "591dffdade9f07692a7dd3ed16830ec24e901ece",
"versionType": "git"
},
{
"lessThan": "9100191e5acb2e5ea2313f436667bb5fce129f47",
"status": "affected",
"version": "591dffdade9f07692a7dd3ed16830ec24e901ece",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/ftrace.h",
"kernel/trace/ftrace.c",
"kernel/trace/trace.h",
"kernel/trace/trace_functions.c",
"kernel/trace/trace_stack.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Take trace_array reference before accessing its ftrace_ops\n\nThe trace instance files set_ftrace_filter and set_ftrace_notrace was\nupdated to work with specific trace instances (trace_arrays). The issue is\nthat when these files are opened, there is a small race window where it\nwill use the ftrace_ops from the inode-\u003eprivate pointer to get a reference\nto the trace_array and then take its reference. The problem is that the\nftrace_ops itself could be freed. If the rmdir on the instance happens at\nthe same time the set_ftrace_filter file is opened, the rmdir could have\nalso freed the ftrace_ops and referencing it will cause a use-after-free\nbug and crash the kernel.\n\nInstead, pass in the trace_array as the file private data (NULL for the\ntop level instance), and then pass both the trace_array and the ftrace_ops\nto the ftrace_regex_open() function. If the trace_array is NULL, then it\njust uses the ftrace_ops without the need to take its reference (like\nnormal). If the ftrace_ops is NULL, that is only the case for the top\nlevel instance and the global_ops can be used.\n\nThis allows the trace_array to have its reference incremented before\ntouching the ftrace_ops that could also be freed when the instance is."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached only by a local open() of an instance set_ftrace_filter/set_ftrace_notrace racing rmdir of that tracing instance under /sys/kernel/tracing/instances; there is no network or adjacent-protocol path into ftrace_filter_open().\nAC:L - The attacker drives both sides: mkdir an instance, open its filter file on one thread, and rmdir it on another. instance_rmdir drops inode locks and kfree()s ftrace_ops before unlinking the files, so the race is retryable with no condition outside attacker control.\nPR:L - ftrace_regex_open()/instance mkdir/rmdir check only LOCKDOWN_TRACEFS (off by default) and DAC, with no capable() call. Android/Perfetto, ChromeOS, and distro tracing-group gid= mounts routinely grant unprivileged users write on /sys/kernel/tracing/instances.\nUI:N - The attacker performs mkdir, concurrent open of set_ftrace_filter/set_ftrace_notrace, and rmdir entirely from their own threads; no victim mount, click, or other-user action is required.\nS:U - The use-after-free is of a kmalloc\u0027d struct ftrace_ops in the host kernel heap; any privilege escalation stays within the kernel\u0027s own security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free of heap-allocated ftrace_ops: open() reads ops-\u003eprivate, ops-\u003eflags, and ops-\u003efunc_hash from the freed object, so after slab reclaim/spray those fields become attacker-controlled and yield an arbitrary kernel read.\nI:H - ftrace_ops_init() writes flags, func_hash, and a mutex into the freed object and later mutex_lock()s ops-\u003efunc_hash-\u003eregex_lock; with spray this is an arbitrary-write primitive, and ftrace_ops also carries hijackable function pointers (func, ops_func).\nA:H - Dereferencing the freed ftrace_ops (ops-\u003eprivate, flags, func_hash) on the open-versus-rmdir race reliably oopses or panics the kernel, as described in the fix, and can be re-triggered by repeating instance create/open/rmdir."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:23.283Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/29266da8ee1d9be656b1f22460c49538e1930658"
},
{
"url": "https://git.kernel.org/stable/c/177cd8966325f0ffffa3c9381f9e0422019a3973"
},
{
"url": "https://git.kernel.org/stable/c/83fd7eca5ab0d3ac3f23bff889175d847e21af06"
},
{
"url": "https://git.kernel.org/stable/c/cee8f286794df916553d8d445eac5c323ec5b0f8"
},
{
"url": "https://git.kernel.org/stable/c/9100191e5acb2e5ea2313f436667bb5fce129f47"
}
],
"title": "ftrace: Take trace_array reference before accessing its ftrace_ops",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90002",
"datePublished": "2026-09-16T10:33:12.734Z",
"dateReserved": "2026-09-11T19:38:34.780Z",
"dateUpdated": "2026-10-21T12:49:23.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98208 (GCVE-0-2026-98208)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mmc: sdio_uart: fix xmit_fifo leak when the port table is full
sdio_uart_add_port() allocates the transmit fifo before claiming a
slot in sdio_uart_table[]. When all UART_NR slots are taken, it
returns -EBUSY with the fifo still allocated, but the probe error
path only kfree()s the port, leaking the transmit fifo.
Free the fifo in the failure path of sdio_uart_add_port() itself so
the function retains nothing on error.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8b197a5ce7a7218bb9fc721647ba0d5734f27348 Version: 8b197a5ce7a7218bb9fc721647ba0d5734f27348 Version: 8b197a5ce7a7218bb9fc721647ba0d5734f27348 Version: 8b197a5ce7a7218bb9fc721647ba0d5734f27348 Version: 8b197a5ce7a7218bb9fc721647ba0d5734f27348 Version: 8b197a5ce7a7218bb9fc721647ba0d5734f27348 Version: 8b197a5ce7a7218bb9fc721647ba0d5734f27348 Version: 8b197a5ce7a7218bb9fc721647ba0d5734f27348 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mmc/core/sdio_uart.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9e992d59138fcfaa4bad7cc0750265b0a8bca100",
"status": "affected",
"version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
"versionType": "git"
},
{
"lessThan": "b97b5b66c93cb4aaf6358727a73fff880a774dfd",
"status": "affected",
"version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
"versionType": "git"
},
{
"lessThan": "8a2c1bf209ba04cbd14153a771724bd5aa522fcd",
"status": "affected",
"version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
"versionType": "git"
},
{
"lessThan": "72f4c2b7a48423c708f2c348585419a1b71ab04c",
"status": "affected",
"version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
"versionType": "git"
},
{
"lessThan": "fd8223c53ad9553b2a349d2a40e19bbc6e60fc48",
"status": "affected",
"version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
"versionType": "git"
},
{
"lessThan": "ac866db277a4c73e84b4263773652e3aba326249",
"status": "affected",
"version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
"versionType": "git"
},
{
"lessThan": "5e142adbbdc54afbd01fad476c91cded41d22594",
"status": "affected",
"version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
"versionType": "git"
},
{
"lessThan": "53823e25793a97d07e6e98e0904bbf74cac8bc76",
"status": "affected",
"version": "8b197a5ce7a7218bb9fc721647ba0d5734f27348",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mmc/core/sdio_uart.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: sdio_uart: fix xmit_fifo leak when the port table is full\n\nsdio_uart_add_port() allocates the transmit fifo before claiming a\nslot in sdio_uart_table[]. When all UART_NR slots are taken, it\nreturns -EBUSY with the fifo still allocated, but the probe error\npath only kfree()s the port, leaking the transmit fifo.\n\nFree the fifo in the failure path of sdio_uart_add_port() itself so\nthe function retains nothing on error."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:39.242Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9e992d59138fcfaa4bad7cc0750265b0a8bca100"
},
{
"url": "https://git.kernel.org/stable/c/b97b5b66c93cb4aaf6358727a73fff880a774dfd"
},
{
"url": "https://git.kernel.org/stable/c/8a2c1bf209ba04cbd14153a771724bd5aa522fcd"
},
{
"url": "https://git.kernel.org/stable/c/72f4c2b7a48423c708f2c348585419a1b71ab04c"
},
{
"url": "https://git.kernel.org/stable/c/fd8223c53ad9553b2a349d2a40e19bbc6e60fc48"
},
{
"url": "https://git.kernel.org/stable/c/ac866db277a4c73e84b4263773652e3aba326249"
},
{
"url": "https://git.kernel.org/stable/c/5e142adbbdc54afbd01fad476c91cded41d22594"
},
{
"url": "https://git.kernel.org/stable/c/53823e25793a97d07e6e98e0904bbf74cac8bc76"
}
],
"title": "mmc: sdio_uart: fix xmit_fifo leak when the port table is full",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98208",
"datePublished": "2026-10-06T08:44:45.098Z",
"dateReserved": "2026-09-25T10:25:14.325Z",
"dateUpdated": "2026-10-19T09:15:39.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97619 (GCVE-0-2026-97619)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/rw: end write accounting from ->ki_complete
Commit b000145e9907 moved both the fsnotify calls and the write
accounting out of the kiocb completion handler and into the
io_req_rw_complete() task_work. However, only the fsnotify part actually
needed to move as it may sleep. Ending the write accounting is just a
percpu_up_read() on the superblock writers sem.
Deferring it is a problem, because it makes dropping SB_FREEZE_WRITE
protection depend on the ring owner getting to running task_work. But
the task may be blocked in freeze_super(), causing it to never get to
that:
task io-wq worker
--------------------------------------------------------------
io_write()
io_kiocb_start_write() (takes sb_writers, hidden from
lockdep by __sb_writers_release)
write_iter() -> -EIOCBQUEUED
ioctl(FS_IOC_SHUTDOWN)
bdev_freeze()
freeze_super()
percpu_down_write() <- waits for the reader above
io_write()
kiocb_start_write()
percpu_down_read() <- queued
behind the
writer
<bio completes>
io_complete_rw()
queues io_req_rw_complete() <- never runs, task is in D state
End the write from io_complete_rw() instead, and leave only the fsnotify
calls in task_work.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b000145e9907809406d8164c3b2b8861d95aecd1 Version: b000145e9907809406d8164c3b2b8861d95aecd1 Version: b000145e9907809406d8164c3b2b8861d95aecd1 Version: b000145e9907809406d8164c3b2b8861d95aecd1 Version: b000145e9907809406d8164c3b2b8861d95aecd1 Version: ea2e6286e3e89a115ae554e20ba9aec2b2e1ddff Version: 89a410dbd0f159ddd308f19d6eb682fc753e4771 Version: 2a853c206e553dd9c0a55c22858fd6a446d93e15 Version: 5.10.165 ≤ Version: 5.15.90 ≤ Version: 6.0.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/rw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed1cead97afb9c398bd7ab344a3c1ee34ab73af9",
"status": "affected",
"version": "b000145e9907809406d8164c3b2b8861d95aecd1",
"versionType": "git"
},
{
"lessThan": "696459029f3b65c070c91b729478475582f1dcdf",
"status": "affected",
"version": "b000145e9907809406d8164c3b2b8861d95aecd1",
"versionType": "git"
},
{
"lessThan": "cc580cee4dfa2ec9099c30ecbd4d804cbb996432",
"status": "affected",
"version": "b000145e9907809406d8164c3b2b8861d95aecd1",
"versionType": "git"
},
{
"lessThan": "055d43a1233edbd80e558889258105ce63051bcd",
"status": "affected",
"version": "b000145e9907809406d8164c3b2b8861d95aecd1",
"versionType": "git"
},
{
"lessThan": "796aa0547557e63338657ed1c487906f9fac4c73",
"status": "affected",
"version": "b000145e9907809406d8164c3b2b8861d95aecd1",
"versionType": "git"
},
{
"status": "affected",
"version": "ea2e6286e3e89a115ae554e20ba9aec2b2e1ddff",
"versionType": "git"
},
{
"status": "affected",
"version": "89a410dbd0f159ddd308f19d6eb682fc753e4771",
"versionType": "git"
},
{
"status": "affected",
"version": "2a853c206e553dd9c0a55c22858fd6a446d93e15",
"versionType": "git"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.165",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.90",
"versionType": "semver"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/rw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.165",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/rw: end write accounting from -\u003eki_complete\n\nCommit b000145e9907 moved both the fsnotify calls and the write\naccounting out of the kiocb completion handler and into the\nio_req_rw_complete() task_work. However, only the fsnotify part actually\nneeded to move as it may sleep. Ending the write accounting is just a\npercpu_up_read() on the superblock writers sem.\n\nDeferring it is a problem, because it makes dropping SB_FREEZE_WRITE\nprotection depend on the ring owner getting to running task_work. But\nthe task may be blocked in freeze_super(), causing it to never get to\nthat:\n\n task io-wq worker\n --------------------------------------------------------------\n io_write()\n io_kiocb_start_write() (takes sb_writers, hidden from\n lockdep by __sb_writers_release)\n write_iter() -\u003e -EIOCBQUEUED\n ioctl(FS_IOC_SHUTDOWN)\n bdev_freeze()\n freeze_super()\n percpu_down_write() \u003c- waits for the reader above\n io_write()\n kiocb_start_write()\n percpu_down_read() \u003c- queued\n behind the\n writer\n \u003cbio completes\u003e\n io_complete_rw()\n queues io_req_rw_complete() \u003c- never runs, task is in D state\n\nEnd the write from io_complete_rw() instead, and leave only the fsnotify\ncalls in task_work."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:30.123Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed1cead97afb9c398bd7ab344a3c1ee34ab73af9"
},
{
"url": "https://git.kernel.org/stable/c/696459029f3b65c070c91b729478475582f1dcdf"
},
{
"url": "https://git.kernel.org/stable/c/cc580cee4dfa2ec9099c30ecbd4d804cbb996432"
},
{
"url": "https://git.kernel.org/stable/c/055d43a1233edbd80e558889258105ce63051bcd"
},
{
"url": "https://git.kernel.org/stable/c/796aa0547557e63338657ed1c487906f9fac4c73"
}
],
"title": "io_uring/rw: end write accounting from -\u003eki_complete",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97619",
"datePublished": "2026-09-25T10:22:25.644Z",
"dateReserved": "2026-09-24T16:01:01.159Z",
"dateUpdated": "2026-10-21T12:53:30.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98210 (GCVE-0-2026-98210)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mmc: mxcmmc: cancel data work and watchdog on remove
mxcmci_remove() frees the host through the devm tail, but neither it nor
mmc_remove_host() drains the driver's own asynchronous state.
host->watchdog, a 10 s timer armed on the DMA path in mxcmci_setup_data(),
is deleted only by the DMA- and IRQ-complete paths, which the remove path
does not explicitly drain; it can therefore fire after the host is freed
and dereference it in mxcmci_watchdog(). host->datawork, armed from the
IRQ handler on the PIO path, is not cancelled by the remove path either.
Free the devm-registered IRQ, then cancel datawork and delete the watchdog
in mxcmci_remove(), before dma_release_channel(). Freeing the IRQ first
keeps a trailing handler from re-arming datawork between the cancel and
the host free. Both callbacks are non-self-rearming.
This issue was found by an in-house static analysis tool.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f6ad0a481342223b2e7ae9f55b154e14f1391ada Version: f6ad0a481342223b2e7ae9f55b154e14f1391ada Version: f6ad0a481342223b2e7ae9f55b154e14f1391ada Version: f6ad0a481342223b2e7ae9f55b154e14f1391ada Version: f6ad0a481342223b2e7ae9f55b154e14f1391ada Version: f6ad0a481342223b2e7ae9f55b154e14f1391ada Version: f6ad0a481342223b2e7ae9f55b154e14f1391ada Version: f6ad0a481342223b2e7ae9f55b154e14f1391ada |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/mxcmmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "740f595f8ad678cb4d79f13edd12851df2492bdd",
"status": "affected",
"version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
"versionType": "git"
},
{
"lessThan": "d3641afe6ee76d852834a34ef0669eefced32752",
"status": "affected",
"version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
"versionType": "git"
},
{
"lessThan": "314966b490323bdcfd3162a1398b00e587e0ced4",
"status": "affected",
"version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
"versionType": "git"
},
{
"lessThan": "ae10838a7cdf0e54caa9d0a4f488704fd04e7f01",
"status": "affected",
"version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
"versionType": "git"
},
{
"lessThan": "a1ff367e0dc961d73707add508a95df5c3509bd1",
"status": "affected",
"version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
"versionType": "git"
},
{
"lessThan": "23383e0578b58ba2dc0730cf9f7806bd66bf859a",
"status": "affected",
"version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
"versionType": "git"
},
{
"lessThan": "e2948c4232209e87c861a680f20f1e3cf8a57fec",
"status": "affected",
"version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
"versionType": "git"
},
{
"lessThan": "d3a421c82412344022982d5b91ba23194a0a6f29",
"status": "affected",
"version": "f6ad0a481342223b2e7ae9f55b154e14f1391ada",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/mxcmmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mxcmmc: cancel data work and watchdog on remove\n\nmxcmci_remove() frees the host through the devm tail, but neither it nor\nmmc_remove_host() drains the driver\u0027s own asynchronous state.\nhost-\u003ewatchdog, a 10 s timer armed on the DMA path in mxcmci_setup_data(),\nis deleted only by the DMA- and IRQ-complete paths, which the remove path\ndoes not explicitly drain; it can therefore fire after the host is freed\nand dereference it in mxcmci_watchdog(). host-\u003edatawork, armed from the\nIRQ handler on the PIO path, is not cancelled by the remove path either.\n\nFree the devm-registered IRQ, then cancel datawork and delete the watchdog\nin mxcmci_remove(), before dma_release_channel(). Freeing the IRQ first\nkeeps a trailing handler from re-arming datawork between the cancel and\nthe host free. Both callbacks are non-self-rearming.\n\nThis issue was found by an in-house static analysis tool."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:41.186Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/740f595f8ad678cb4d79f13edd12851df2492bdd"
},
{
"url": "https://git.kernel.org/stable/c/d3641afe6ee76d852834a34ef0669eefced32752"
},
{
"url": "https://git.kernel.org/stable/c/314966b490323bdcfd3162a1398b00e587e0ced4"
},
{
"url": "https://git.kernel.org/stable/c/ae10838a7cdf0e54caa9d0a4f488704fd04e7f01"
},
{
"url": "https://git.kernel.org/stable/c/a1ff367e0dc961d73707add508a95df5c3509bd1"
},
{
"url": "https://git.kernel.org/stable/c/23383e0578b58ba2dc0730cf9f7806bd66bf859a"
},
{
"url": "https://git.kernel.org/stable/c/e2948c4232209e87c861a680f20f1e3cf8a57fec"
},
{
"url": "https://git.kernel.org/stable/c/d3a421c82412344022982d5b91ba23194a0a6f29"
}
],
"title": "mmc: mxcmmc: cancel data work and watchdog on remove",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98210",
"datePublished": "2026-10-06T08:44:46.788Z",
"dateReserved": "2026-09-25T10:25:14.325Z",
"dateUpdated": "2026-10-19T09:15:41.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97532 (GCVE-0-2026-97532)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to
probe_hw_failed and calls qla2x00_mem_free(). Several error labels in
qla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool,
flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info)
but left the pointers dangling. qla2x00_mem_free() then freed them a
second time. Worse, for the dma_pool members it issued
dma_pool_free(ha->s_dma_pool, ...) after s_dma_pool had already been
destroyed and set to NULL at fail_s_dma_pool, dereferencing a NULL pool.
Clear each freed pointer (and its DMA handle) in the error labels so the
subsequent qla2x00_mem_free() skips them.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d64d6c5671db5e693a0caaee79f2571b098749c9 Version: d64d6c5671db5e693a0caaee79f2571b098749c9 Version: d64d6c5671db5e693a0caaee79f2571b098749c9 Version: d64d6c5671db5e693a0caaee79f2571b098749c9 Version: d64d6c5671db5e693a0caaee79f2571b098749c9 Version: 8540351ee8a4d540b1b7ee64b88d5e42c7c0bfbc Version: 7142b10b87d5b393a0688358b16a4b1d3680ec7d Version: 4.14.27 ≤ Version: 4.15.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_os.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5e0d6ffabbbd86b3fb9168b9dbb62190ecb20d84",
"status": "affected",
"version": "d64d6c5671db5e693a0caaee79f2571b098749c9",
"versionType": "git"
},
{
"lessThan": "84f5de696b8c924aeb4bf430a0bdc762fc50e99f",
"status": "affected",
"version": "d64d6c5671db5e693a0caaee79f2571b098749c9",
"versionType": "git"
},
{
"lessThan": "a57570229edb7a0990d5c8067daeb9ac8858a961",
"status": "affected",
"version": "d64d6c5671db5e693a0caaee79f2571b098749c9",
"versionType": "git"
},
{
"lessThan": "286d9594a022dd7e0caa3de9daa63b896bc70d43",
"status": "affected",
"version": "d64d6c5671db5e693a0caaee79f2571b098749c9",
"versionType": "git"
},
{
"lessThan": "6d90f0feb929f6c0f3010f9af4747c7230b75993",
"status": "affected",
"version": "d64d6c5671db5e693a0caaee79f2571b098749c9",
"versionType": "git"
},
{
"status": "affected",
"version": "8540351ee8a4d540b1b7ee64b88d5e42c7c0bfbc",
"versionType": "git"
},
{
"status": "affected",
"version": "7142b10b87d5b393a0688358b16a4b1d3680ec7d",
"versionType": "git"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.27",
"versionType": "semver"
},
{
"lessThan": "4.16",
"status": "affected",
"version": "4.15.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_os.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.15.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path\n\nWhen qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to\nprobe_hw_failed and calls qla2x00_mem_free(). Several error labels in\nqla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool,\nflt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info)\nbut left the pointers dangling. qla2x00_mem_free() then freed them a\nsecond time. Worse, for the dma_pool members it issued\ndma_pool_free(ha-\u003es_dma_pool, ...) after s_dma_pool had already been\ndestroyed and set to NULL at fail_s_dma_pool, dereferencing a NULL pool.\n\nClear each freed pointer (and its DMA handle) in the error labels so the\nsubsequent qla2x00_mem_free() skips them."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:08.333Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5e0d6ffabbbd86b3fb9168b9dbb62190ecb20d84"
},
{
"url": "https://git.kernel.org/stable/c/84f5de696b8c924aeb4bf430a0bdc762fc50e99f"
},
{
"url": "https://git.kernel.org/stable/c/a57570229edb7a0990d5c8067daeb9ac8858a961"
},
{
"url": "https://git.kernel.org/stable/c/286d9594a022dd7e0caa3de9daa63b896bc70d43"
},
{
"url": "https://git.kernel.org/stable/c/6d90f0feb929f6c0f3010f9af4747c7230b75993"
}
],
"title": "scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97532",
"datePublished": "2026-09-25T10:21:32.582Z",
"dateReserved": "2026-09-24T16:01:01.153Z",
"dateUpdated": "2026-10-21T12:53:08.333Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98248 (GCVE-0-2026-98248)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
arm64: percpu: Fix LSE operations on {8,16}-bit types
The assembly for __percpu_##name##_case_##sz() and
__percpu_##name##_return_case_##sz() doesn't use the 'sfx' macro
argument to form the LSE instruction. Without 'sfx', a W register
argument will imply a 32-bit memory location, and consequently
{8,16}-bit ops will erroneously read and write 32 bits of memory when
the LSE instruction is used.
Fix this by appending 'sfx' to 'op_lse' to LSE instruction. It is not
necessary (and not valid) to append 'sfx' to 'op_llsc', as 'op_llsc' is
a register-register operation which does not access memory (and does not
take a size suffix).
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/include/asm/percpu.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d69ab4480e49bf925f4781afcc9f284affcb96b6",
"status": "affected",
"version": "959bf2fd03b59fc107584c21425f3dc73c49f762",
"versionType": "git"
},
{
"lessThan": "390742871a723b52de9b92a94c0d1c85a2531e3e",
"status": "affected",
"version": "959bf2fd03b59fc107584c21425f3dc73c49f762",
"versionType": "git"
},
{
"lessThan": "843ace1d0a39e9b1cfcbfb3856a7b0fbdd9cd003",
"status": "affected",
"version": "959bf2fd03b59fc107584c21425f3dc73c49f762",
"versionType": "git"
},
{
"lessThan": "8cf2093f5372952a9ebc805c418d45df7112cd14",
"status": "affected",
"version": "959bf2fd03b59fc107584c21425f3dc73c49f762",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/include/asm/percpu.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: percpu: Fix LSE operations on {8,16}-bit types\n\nThe assembly for __percpu_##name##_case_##sz() and\n__percpu_##name##_return_case_##sz() doesn\u0027t use the \u0027sfx\u0027 macro\nargument to form the LSE instruction. Without \u0027sfx\u0027, a W register\nargument will imply a 32-bit memory location, and consequently\n{8,16}-bit ops will erroneously read and write 32 bits of memory when\nthe LSE instruction is used.\n\nFix this by appending \u0027sfx\u0027 to \u0027op_lse\u0027 to LSE instruction. It is not\nnecessary (and not valid) to append \u0027sfx\u0027 to \u0027op_llsc\u0027, as \u0027op_llsc\u0027 is\na register-register operation which does not access memory (and does not\ntake a size suffix)."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:19.730Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d69ab4480e49bf925f4781afcc9f284affcb96b6"
},
{
"url": "https://git.kernel.org/stable/c/390742871a723b52de9b92a94c0d1c85a2531e3e"
},
{
"url": "https://git.kernel.org/stable/c/843ace1d0a39e9b1cfcbfb3856a7b0fbdd9cd003"
},
{
"url": "https://git.kernel.org/stable/c/8cf2093f5372952a9ebc805c418d45df7112cd14"
}
],
"title": "arm64: percpu: Fix LSE operations on {8,16}-bit types",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98248",
"datePublished": "2026-10-06T08:45:16.693Z",
"dateReserved": "2026-09-25T10:25:14.330Z",
"dateUpdated": "2026-10-19T09:16:19.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89921 (GCVE-0-2026-89921)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: Zero initialize data structures for inject_pfault_token
__kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of
the on-stack struct kvm_s390_irq but the full ext substructure is copied
into the cpu local variable on inject. ext_params and pad contain stale
stack values.
Interrupt delivery only uses ext_params2, so nothing leaks to the guest,
but a host user can use the migration ioctls to get to the data.
Fix by zero-initializing the irq struct.
Do the same for the inti data structure.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/kvm-s390.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ab1a8a3c9971200938093370da4c67d4427c25f2",
"status": "affected",
"version": "383d0b050106abecb82f43101cac94fa423af5cd",
"versionType": "git"
},
{
"lessThan": "b8abc760fa18a389319d977834a30550b3ec18e8",
"status": "affected",
"version": "383d0b050106abecb82f43101cac94fa423af5cd",
"versionType": "git"
},
{
"lessThan": "9b046de62b8098af6e2ba820b125ec9dc5f162c8",
"status": "affected",
"version": "383d0b050106abecb82f43101cac94fa423af5cd",
"versionType": "git"
},
{
"lessThan": "134f235e0e8de54611a72d3cc3f63e5f31246baa",
"status": "affected",
"version": "383d0b050106abecb82f43101cac94fa423af5cd",
"versionType": "git"
},
{
"lessThan": "4e2c7f7cbc27418f9a290399b986c1b85ff93b90",
"status": "affected",
"version": "383d0b050106abecb82f43101cac94fa423af5cd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/kvm-s390.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: Zero initialize data structures for inject_pfault_token\n\n__kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of\nthe on-stack struct kvm_s390_irq but the full ext substructure is copied\ninto the cpu local variable on inject. ext_params and pad contain stale\nstack values.\n\nInterrupt delivery only uses ext_params2, so nothing leaks to the guest,\nbut a host user can use the migration ioctls to get to the data.\n\nFix by zero-initializing the irq struct.\nDo the same for the inti data structure."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:10.705Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ab1a8a3c9971200938093370da4c67d4427c25f2"
},
{
"url": "https://git.kernel.org/stable/c/b8abc760fa18a389319d977834a30550b3ec18e8"
},
{
"url": "https://git.kernel.org/stable/c/9b046de62b8098af6e2ba820b125ec9dc5f162c8"
},
{
"url": "https://git.kernel.org/stable/c/134f235e0e8de54611a72d3cc3f63e5f31246baa"
},
{
"url": "https://git.kernel.org/stable/c/4e2c7f7cbc27418f9a290399b986c1b85ff93b90"
}
],
"title": "KVM: s390: Zero initialize data structures for inject_pfault_token",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89921",
"datePublished": "2026-09-16T10:32:15.413Z",
"dateReserved": "2026-09-11T19:38:34.775Z",
"dateUpdated": "2026-10-21T12:49:10.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89832 (GCVE-0-2026-89832)
Vulnerability from cvelistv5
Published
2026-09-16 10:31
Modified
2026-10-21 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to clear dirty flag on folio in error path
If node block is corrupted due to chksum mismatch or inconsistent
footer info, it needs to drop clear flag of node folio, in order
to persist inconsistent node data to storage.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b42b179bda9ff11075a6fc2bac4d9e400513679a Version: b42b179bda9ff11075a6fc2bac4d9e400513679a Version: b42b179bda9ff11075a6fc2bac4d9e400513679a Version: b42b179bda9ff11075a6fc2bac4d9e400513679a Version: b42b179bda9ff11075a6fc2bac4d9e400513679a Version: 8d7ebdd109b4654ec5e0e9c3c6f08b06d6558f10 Version: b039536485970829918aa237a08417bd0ed5437c Version: 4.19.51 ≤ Version: 5.1.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "21b7f66716b4fd0dffac4fcd06602b888f3c4531",
"status": "affected",
"version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
"versionType": "git"
},
{
"lessThan": "34732e3a8713f3b7acd1a0ea37e3a6bee4c78550",
"status": "affected",
"version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
"versionType": "git"
},
{
"lessThan": "ab35ae07f2b5b4e118ea47b88577fc7d0e797b17",
"status": "affected",
"version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
"versionType": "git"
},
{
"lessThan": "3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2",
"status": "affected",
"version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
"versionType": "git"
},
{
"lessThan": "5b86eab84ac8e9289b5afc52ef88ab18ba5bacab",
"status": "affected",
"version": "b42b179bda9ff11075a6fc2bac4d9e400513679a",
"versionType": "git"
},
{
"status": "affected",
"version": "8d7ebdd109b4654ec5e0e9c3c6f08b06d6558f10",
"versionType": "git"
},
{
"status": "affected",
"version": "b039536485970829918aa237a08417bd0ed5437c",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.51",
"versionType": "semver"
},
{
"lessThan": "5.2",
"status": "affected",
"version": "5.1.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/node.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.1.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to clear dirty flag on folio in error path\n\nIf node block is corrupted due to chksum mismatch or inconsistent\nfooter info, it needs to drop clear flag of node folio, in order\nto persist inconsistent node data to storage."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - __get_node_folio is reached only through local VFS operations (lookup, open, read/write, fallocate, fsync, GC) on a mounted f2fs volume such as Android userdata or removable flash; it is not a ksmbd/nfsd/packet-processing path.\nAC:L - A crafted f2fs image lets the attacker pick node footers and nids so a dirty direct-node folio is later re-fetched as NODE_TYPE_INODE (or fails checksum) on ordinary file ops; triggering is deterministic with no race or rare config.\nPR:L - After automount (Android vold/udisks2 portable f2fs) or on already-mounted userdata, any unprivileged user with file access reaches __get_node_folio via write then lookup; no CAP_SYS_ADMIN is needed on that syscall path.\nUI:N - The attacker dirties the node and then looks up the type-confused nid themselves; removable f2fs is commonly auto-mounted and scanned without a separate victim mount or open step.\nS:U - Dirty-flag mishandling, persisted node metadata, and any page-cache fallout remain in the host kernel\u0027s authority; this is not a VM escape, container breakout, or IOMMU bypass.\nC:H - A still-dirty corrupted node folio can be written back with inconsistent mappings, and a later read_node_folio will read into that dirty folio; file offsets can then resolve to other files\u0027 or leftover blocks and disclose their contents.\nI:H - Writeback of the leftover dirty node persists inconsistent footer/checksum metadata, and the subsequent read into a dirty folio overwrites in-memory node contents from disk, corrupting block maps in an attacker-influenced way.\nA:H - Footer failure on a still-dirty node stops checkpoint (and panics with errors=panic), can leak F2FS_DIRTY_NODES so checkpoint retries hang, and dirty !uptodate node folios can oops or freeze filesystem I/O."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:48:55.786Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/21b7f66716b4fd0dffac4fcd06602b888f3c4531"
},
{
"url": "https://git.kernel.org/stable/c/34732e3a8713f3b7acd1a0ea37e3a6bee4c78550"
},
{
"url": "https://git.kernel.org/stable/c/ab35ae07f2b5b4e118ea47b88577fc7d0e797b17"
},
{
"url": "https://git.kernel.org/stable/c/3923ec2b98c96dda4a8bfab81d22553dbf0dd6c2"
},
{
"url": "https://git.kernel.org/stable/c/5b86eab84ac8e9289b5afc52ef88ab18ba5bacab"
}
],
"title": "f2fs: fix to clear dirty flag on folio in error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89832",
"datePublished": "2026-09-16T10:31:04.691Z",
"dateReserved": "2026-09-11T19:38:34.769Z",
"dateUpdated": "2026-10-21T12:48:55.786Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89972 (GCVE-0-2026-89972)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme: add missing SRCU grace period in error path
nvme_alloc_ns() error path at out_unlink_ns removes ns from the
namespace head siblings list with list_del_rcu(&ns->siblings) but
does not wait for SRCU readers before freeing the namespace struct.
Multipath code iterates the head->list under srcu_read_lock() in
nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent
reader can still hold a reference to ns when kfree(ns) runs.
The normal removal path in nvme_ns_remove() correctly calls
synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for
in-progress readers. Add the same grace period in the error path.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3868476cd39161f18720582df17a1b621e805b5d",
"status": "affected",
"version": "ed754e5deeb17f4e675c84e4b6c640cc7344e498",
"versionType": "git"
},
{
"lessThan": "0d4735418512ef825176726eaaa8bd6a35f6b46d",
"status": "affected",
"version": "ed754e5deeb17f4e675c84e4b6c640cc7344e498",
"versionType": "git"
},
{
"lessThan": "d663944dbad81bb0e3635d7090db4713e6300858",
"status": "affected",
"version": "ed754e5deeb17f4e675c84e4b6c640cc7344e498",
"versionType": "git"
},
{
"lessThan": "76023560d60f10b4f808941163aa2975f1631683",
"status": "affected",
"version": "ed754e5deeb17f4e675c84e4b6c640cc7344e498",
"versionType": "git"
},
{
"lessThan": "ef248d5de4469fb6bbaf8dbe0c4c47800080d648",
"status": "affected",
"version": "ed754e5deeb17f4e675c84e4b6c640cc7344e498",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: add missing SRCU grace period in error path\n\nnvme_alloc_ns() error path at out_unlink_ns removes ns from the\nnamespace head siblings list with list_del_rcu(\u0026ns-\u003esiblings) but\ndoes not wait for SRCU readers before freeing the namespace struct.\nMultipath code iterates the head-\u003elist under srcu_read_lock() in\nnvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent\nreader can still hold a reference to ns when kfree(ns) runs.\n\nThe normal removal path in nvme_ns_remove() correctly calls\nsynchronize_srcu(\u0026ns-\u003ehead-\u003esrcu) after list_del_rcu() to wait for\nin-progress readers. Add the same grace period in the error path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - NVMe host core scans namespaces from NVMe-oF (nvme-tcp/rdma/fc) when a remote target sends NS_CHANGED AENs or Identify data; a malicious or compromised fabric target drives nvme_scan_ns\u2192nvme_alloc_ns and the out_unlink_ns UAF over the network (typically TCP 4420).\nAC:L - The remote target controls both sides of the race: it can stall then fail Identify after list_add_tail_rcu so the new path is on head-\u003elist, while concurrent multipath I/O or ANA AENs walk that list under srcu_read_lock in nvme_find_path/nvme_mpath_revalidate_paths; CONFIG_NVME_MULTIPATH is the recommended default.\nPR:N - The attacker is the NVMe-oF peer and needs no host account or capability; NVMe/TCP is unauthenticated by default (TLS and DH-HMAC-CHAP are optional), and AENs plus Identify responses are accepted on an already-established fabrics session.\nUI:N - NVMe-oF controllers are persistent boot/autoconnect configuration; namespace rescans, ANA updates, and multipath I/O run from kernel workqueues and the block layer with no further victim action at exploit time.\nS:U - The use-after-free corrupts kernel heap (struct nvme_ns) inside the host NVMe driver and does not cross a VM, IOMMU, or other distinct security authority.\nC:H - Use-after-free of the namespace object on the multipath siblings list lets an attacker reclaim the kmalloc slab and obtain a kernel read primitive from stale ns-\u003edisk/ctrl/flags dereferences in nvme_find_path.\nI:H - The same UAF is heap-sprayable: multipath I/O and ioctl paths dereference fields of the freed nvme_ns, enabling arbitrary write and control-flow hijacking in kernel context.\nA:H - Any use-after-free of ns during the SRCU list walk can oops or panic the host kernel even without a full exploit, taking down the NVMe storage stack."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:17.240Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3868476cd39161f18720582df17a1b621e805b5d"
},
{
"url": "https://git.kernel.org/stable/c/0d4735418512ef825176726eaaa8bd6a35f6b46d"
},
{
"url": "https://git.kernel.org/stable/c/d663944dbad81bb0e3635d7090db4713e6300858"
},
{
"url": "https://git.kernel.org/stable/c/76023560d60f10b4f808941163aa2975f1631683"
},
{
"url": "https://git.kernel.org/stable/c/ef248d5de4469fb6bbaf8dbe0c4c47800080d648"
}
],
"title": "nvme: add missing SRCU grace period in error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89972",
"datePublished": "2026-09-16T10:32:51.701Z",
"dateReserved": "2026-09-11T19:38:34.778Z",
"dateUpdated": "2026-10-21T12:49:17.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97918 (GCVE-0-2026-97918)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Undo the registration when enabling the histogram trigger fails
Commit 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers
list") described how a trigger that is registered but not on file->triggers
ends up freed while still on the global named_triggers list, and moved the
registration down so that hist_trigger_enable() follows it immediately. One
path still gets there. hist_trigger_enable() adds the trigger and takes it
straight back out when the event cannot be enabled:
list_add_tail_rcu(&data->list, &file->triggers);
update_cond_flag(file);
if (trace_event_trigger_enable_disable(file, 1) < 0) {
list_del_rcu(&data->list);
update_cond_flag(file);
ret--;
}
so the list walk in hist_unregister_trigger() matches nothing, test stays
NULL, and the ->free() that would call del_named_trigger() is skipped.
out_unreg falls through to out_free, which frees the trigger anyway:
BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0
Read of size 8 at addr ffff8880091d3160 by task init/1
find_named_trigger+0xac/0xc0
hist_register_trigger+0xc1/0xa00
event_hist_trigger_parse+0x3146/0x6af0
event_trigger_write+0xce/0x160
Freed by task 69:
kfree+0x154/0x420
trigger_kthread_fn+0xfd/0x160
Leave the trigger where hist_unregister_trigger() can find it and let that
undo the registration, which is the only code that knows all of what
cmd_ops->init() took: the named list entry, the hist_pad reference, the
reference on the trigger a named histogram is shared with, and the copied
cmd_ops. It also pairs the failed trace_event_trigger_enable_disable(),
whose sm_ref and buffered event reference are otherwise left behind.
Since ->free() releases trigger_data and, for a trigger that does not share
its histogram, hist_data with it, out_unreg can no longer fall through to
out_free. For a trigger that does share, hist_register_trigger() has
already destroyed the caller's hist_data, so the fall-through was reading
freed memory there as well.
Move the enable_timestamps check in hist_unregister_trigger() above the
->free() call for the same reason: hist_data does not outlive it once the
trigger being removed is the one that owns it.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "880712b6f48103ba3a04b154ff076d45fe86dcec",
"status": "affected",
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
"versionType": "git"
},
{
"lessThan": "c7ee2d5733574d4694f7c0035e4381f54c1fca27",
"status": "affected",
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
"versionType": "git"
},
{
"lessThan": "51b07104d563d4be2be34158d3b9d922ca417642",
"status": "affected",
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
"versionType": "git"
},
{
"lessThan": "bfa6bc11aef93a3d9db0ac9564b734849a9d959b",
"status": "affected",
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
"versionType": "git"
},
{
"lessThan": "92383cef66791a0c63a2f27755cadbdb2fbf270b",
"status": "affected",
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Undo the registration when enabling the histogram trigger fails\n\nCommit 6f86bdeab633 (\"tracing: Fix bad hist from corrupting named_triggers\nlist\") described how a trigger that is registered but not on file-\u003etriggers\nends up freed while still on the global named_triggers list, and moved the\nregistration down so that hist_trigger_enable() follows it immediately. One\npath still gets there. hist_trigger_enable() adds the trigger and takes it\nstraight back out when the event cannot be enabled:\n\n\tlist_add_tail_rcu(\u0026data-\u003elist, \u0026file-\u003etriggers);\n\n\tupdate_cond_flag(file);\n\n\tif (trace_event_trigger_enable_disable(file, 1) \u003c 0) {\n\t\tlist_del_rcu(\u0026data-\u003elist);\n\t\tupdate_cond_flag(file);\n\t\tret--;\n\t}\n\nso the list walk in hist_unregister_trigger() matches nothing, test stays\nNULL, and the -\u003efree() that would call del_named_trigger() is skipped.\nout_unreg falls through to out_free, which frees the trigger anyway:\n\n BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n Read of size 8 at addr ffff8880091d3160 by task init/1\n find_named_trigger+0xac/0xc0\n hist_register_trigger+0xc1/0xa00\n event_hist_trigger_parse+0x3146/0x6af0\n event_trigger_write+0xce/0x160\n Freed by task 69:\n kfree+0x154/0x420\n trigger_kthread_fn+0xfd/0x160\n\nLeave the trigger where hist_unregister_trigger() can find it and let that\nundo the registration, which is the only code that knows all of what\ncmd_ops-\u003einit() took: the named list entry, the hist_pad reference, the\nreference on the trigger a named histogram is shared with, and the copied\ncmd_ops. It also pairs the failed trace_event_trigger_enable_disable(),\nwhose sm_ref and buffered event reference are otherwise left behind.\n\nSince -\u003efree() releases trigger_data and, for a trigger that does not share\nits histogram, hist_data with it, out_unreg can no longer fall through to\nout_free. For a trigger that does share, hist_register_trigger() has\nalready destroyed the caller\u0027s hist_data, so the fall-through was reading\nfreed memory there as well.\n\nMove the enable_timestamps check in hist_unregister_trigger() above the\n-\u003efree() call for the same reason: hist_data does not outlive it once the\ntrigger being removed is the one that owns it."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:37.796Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/880712b6f48103ba3a04b154ff076d45fe86dcec"
},
{
"url": "https://git.kernel.org/stable/c/c7ee2d5733574d4694f7c0035e4381f54c1fca27"
},
{
"url": "https://git.kernel.org/stable/c/51b07104d563d4be2be34158d3b9d922ca417642"
},
{
"url": "https://git.kernel.org/stable/c/bfa6bc11aef93a3d9db0ac9564b734849a9d959b"
},
{
"url": "https://git.kernel.org/stable/c/92383cef66791a0c63a2f27755cadbdb2fbf270b"
}
],
"title": "tracing: Undo the registration when enabling the histogram trigger fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97918",
"datePublished": "2026-09-25T10:22:39.162Z",
"dateReserved": "2026-09-25T10:18:58.202Z",
"dateUpdated": "2026-10-21T12:53:37.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98206 (GCVE-0-2026-98206)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: cyttsp5 - clamp the HID report size before memcpy
The size field comes from the device and is used as the memcpy()
length into response_buf, which is CY_MAX_INPUT bytes.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/cyttsp5.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b172c69e67bc71f71f6e3d8b3258b3dec29e42c6",
"status": "affected",
"version": "5b0c03e24a061f9c9e8b28fa157b80990c559a37",
"versionType": "git"
},
{
"lessThan": "d41a80d852f2948c6d388c520e76c0a72897f003",
"status": "affected",
"version": "5b0c03e24a061f9c9e8b28fa157b80990c559a37",
"versionType": "git"
},
{
"lessThan": "9eb261092d4c967679fa351b7190c6d9082b07c5",
"status": "affected",
"version": "5b0c03e24a061f9c9e8b28fa157b80990c559a37",
"versionType": "git"
},
{
"lessThan": "495955feb57750de4a641da13d7e51fb4d0a9764",
"status": "affected",
"version": "5b0c03e24a061f9c9e8b28fa157b80990c559a37",
"versionType": "git"
},
{
"lessThan": "85f080fb87ed5cd3e46121be677f52c82f26a0ab",
"status": "affected",
"version": "5b0c03e24a061f9c9e8b28fa157b80990c559a37",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/cyttsp5.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: cyttsp5 - clamp the HID report size before memcpy\n\nThe size field comes from the device and is used as the memcpy()\nlength into response_buf, which is CY_MAX_INPUT bytes."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:37.111Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b172c69e67bc71f71f6e3d8b3258b3dec29e42c6"
},
{
"url": "https://git.kernel.org/stable/c/d41a80d852f2948c6d388c520e76c0a72897f003"
},
{
"url": "https://git.kernel.org/stable/c/9eb261092d4c967679fa351b7190c6d9082b07c5"
},
{
"url": "https://git.kernel.org/stable/c/495955feb57750de4a641da13d7e51fb4d0a9764"
},
{
"url": "https://git.kernel.org/stable/c/85f080fb87ed5cd3e46121be677f52c82f26a0ab"
}
],
"title": "Input: cyttsp5 - clamp the HID report size before memcpy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98206",
"datePublished": "2026-10-06T08:44:43.399Z",
"dateReserved": "2026-09-25T10:25:14.325Z",
"dateUpdated": "2026-10-19T09:15:37.111Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98336 (GCVE-0-2026-98336)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't offload TC setup on AP_VLAN interfaces
AP_VLAN interfaces are purely virtual, so don't try to offload
TC setup to drivers. We can't really use the AP interface either
since we may not know it all the time, and it could technically
even change.
Just reject the TC offload so things get done in software.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/iface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "790221efbfece13a2347563b3785aaca48f192e2",
"status": "affected",
"version": "61587f1556fec39e8bafc40c8715f560639a4cf2",
"versionType": "git"
},
{
"lessThan": "40bc8a268c3b6e21fa3a8dd1b4fd85aa905b9718",
"status": "affected",
"version": "61587f1556fec39e8bafc40c8715f560639a4cf2",
"versionType": "git"
},
{
"lessThan": "9c34f01b8f2177dd4e1ee524ca1f9ca3fcd85a11",
"status": "affected",
"version": "61587f1556fec39e8bafc40c8715f560639a4cf2",
"versionType": "git"
},
{
"lessThan": "ea3ef2165e4751df2ee3bc1c07a192243a08faa5",
"status": "affected",
"version": "61587f1556fec39e8bafc40c8715f560639a4cf2",
"versionType": "git"
},
{
"lessThan": "362bd5bce29ed0f6fd3d39a7065567777d70606e",
"status": "affected",
"version": "61587f1556fec39e8bafc40c8715f560639a4cf2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/iface.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0027t offload TC setup on AP_VLAN interfaces\n\nAP_VLAN interfaces are purely virtual, so don\u0027t try to offload\nTC setup to drivers. We can\u0027t really use the AP interface either\nsince we may not know it all the time, and it could technically\neven change.\n\nJust reject the TC offload so things get done in software."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:47.387Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/790221efbfece13a2347563b3785aaca48f192e2"
},
{
"url": "https://git.kernel.org/stable/c/40bc8a268c3b6e21fa3a8dd1b4fd85aa905b9718"
},
{
"url": "https://git.kernel.org/stable/c/9c34f01b8f2177dd4e1ee524ca1f9ca3fcd85a11"
},
{
"url": "https://git.kernel.org/stable/c/ea3ef2165e4751df2ee3bc1c07a192243a08faa5"
},
{
"url": "https://git.kernel.org/stable/c/362bd5bce29ed0f6fd3d39a7065567777d70606e"
}
],
"title": "wifi: mac80211: don\u0027t offload TC setup on AP_VLAN interfaces",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98336",
"datePublished": "2026-10-06T08:46:27.634Z",
"dateReserved": "2026-09-25T10:25:14.342Z",
"dateUpdated": "2026-10-19T09:17:47.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89956 (GCVE-0-2026-89956)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
In order to traverse or add/remove ap_matrix_mdev objects in the
matrix_dev->mdev_list, the matrix_dev->guests_lock mutex must be held.
There are two functions that access the list without holding the mutex:
vfio_ap_mdev_probe function
~~~~~~~~~~~~~~~~~~~~~~~~~~~
The vfio_ap_mdev_probe function uses the matrix_dev->mdevs_lock
mutex to guard the add of a newly created ap_matrix_mdev object to the
matrix_dev->mdev_list. This mutex does not protect list access; its purpose
is to guard against concurrent access to fields contained in an
ap_matrix_mdev object. This could lead to kernel memory corruption or
use-after-free if another mdev is created or removed concurrently.
The adding of an ap_matrix_mdev object to matrix_dev->mdev_list
is now guarded by the matrix_dev->guests_lock which is the correct
way to protect against concurrent mdev_list access.
Also removed the following two lines of code because the matrix_mdev is
allocated via vfio_alloc_device macro which uses kzalloc, so req_trigger
and cfg_chg_trigger are already zero-initialised when the struct is
allocated before the call to vfio_register_emulated_iommu_dev. This
prevents a window whereby these triggers are set to NULL after
the device is exposed to userspace.
matrix_mdev->req_trigger = NULL;
matrix_mdev->cfg_chg_trigger = NULL;
vfio_ap_mdev_for_queue function
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The status_show function that supports display of the status attribute of
the devices in /sys/bus/ap/devices calls the vfio_ap_mdev_for_queue
function which iterates the matrix_dev->mdev_list to find the object
representing the queue device whose status is to be displayed. In order to
traverse this list, the matrix_dev->guests_lock mutex must be held.
To fix this, the guests_lock mutex is taken prior to taking the
matrix_dev->mdevs_lock mutex in the status_show function. It is taken
there rather than the vfio_ap_mdev_for_queue function - where it is
needed - because it must be taken prior to the mdevs_lock mutex in order to
adhere to the proper locking order and prevent a lockdep splat; also
because the mdevs_lock is needed there to access fields within
the matrix_mdev object in that function.
See the vfio-ap-locking.rst in the linux kernel tree.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/vfio_ap_ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "22dc712c170efc1a549e3f872467c880be995ac7",
"status": "affected",
"version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
"versionType": "git"
},
{
"lessThan": "530ee1cc71562b6799b9ece187b6c1b757a2c6fa",
"status": "affected",
"version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
"versionType": "git"
},
{
"lessThan": "647916988272fe5ecb4bb30cd02b51af9960618a",
"status": "affected",
"version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
"versionType": "git"
},
{
"lessThan": "0fd74477d05743d4cd9b25a3b667daa278d53b93",
"status": "affected",
"version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
"versionType": "git"
},
{
"lessThan": "7fa61c29850d05e40ca9ed41bfdf57673023f581",
"status": "affected",
"version": "2c1ee8983aa377fef4f725162f4f3aa5f9575d4a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/vfio_ap_ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects\n\nIn order to traverse or add/remove ap_matrix_mdev objects in the\nmatrix_dev-\u003emdev_list, the matrix_dev-\u003eguests_lock mutex must be held.\nThere are two functions that access the list without holding the mutex:\n\nvfio_ap_mdev_probe function\n~~~~~~~~~~~~~~~~~~~~~~~~~~~\nThe vfio_ap_mdev_probe function uses the matrix_dev-\u003emdevs_lock\nmutex to guard the add of a newly created ap_matrix_mdev object to the\nmatrix_dev-\u003emdev_list. This mutex does not protect list access; its purpose\nis to guard against concurrent access to fields contained in an\nap_matrix_mdev object. This could lead to kernel memory corruption or\nuse-after-free if another mdev is created or removed concurrently.\n\nThe adding of an ap_matrix_mdev object to matrix_dev-\u003emdev_list\nis now guarded by the matrix_dev-\u003eguests_lock which is the correct\nway to protect against concurrent mdev_list access.\n\nAlso removed the following two lines of code because the matrix_mdev is\nallocated via vfio_alloc_device macro which uses kzalloc, so req_trigger\nand cfg_chg_trigger are already zero-initialised when the struct is\nallocated before the call to vfio_register_emulated_iommu_dev. This\nprevents a window whereby these triggers are set to NULL after\nthe device is exposed to userspace.\n\nmatrix_mdev-\u003ereq_trigger = NULL;\nmatrix_mdev-\u003ecfg_chg_trigger = NULL;\n\nvfio_ap_mdev_for_queue function\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nThe status_show function that supports display of the status attribute of\nthe devices in /sys/bus/ap/devices calls the vfio_ap_mdev_for_queue\nfunction which iterates the matrix_dev-\u003emdev_list to find the object\nrepresenting the queue device whose status is to be displayed. In order to\ntraverse this list, the matrix_dev-\u003eguests_lock mutex must be held.\n\nTo fix this, the guests_lock mutex is taken prior to taking the\nmatrix_dev-\u003emdevs_lock mutex in the status_show function. It is taken\nthere rather than the vfio_ap_mdev_for_queue function - where it is\nneeded - because it must be taken prior to the mdevs_lock mutex in order to\nadhere to the proper locking order and prevent a lockdep splat; also\nbecause the mdevs_lock is needed there to access fields within\nthe matrix_mdev object in that function.\n\nSee the vfio-ap-locking.rst in the linux kernel tree."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:15.091Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/22dc712c170efc1a549e3f872467c880be995ac7"
},
{
"url": "https://git.kernel.org/stable/c/530ee1cc71562b6799b9ece187b6c1b757a2c6fa"
},
{
"url": "https://git.kernel.org/stable/c/647916988272fe5ecb4bb30cd02b51af9960618a"
},
{
"url": "https://git.kernel.org/stable/c/0fd74477d05743d4cd9b25a3b667daa278d53b93"
},
{
"url": "https://git.kernel.org/stable/c/7fa61c29850d05e40ca9ed41bfdf57673023f581"
}
],
"title": "s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89956",
"datePublished": "2026-09-16T10:32:39.847Z",
"dateReserved": "2026-09-11T19:38:34.778Z",
"dateUpdated": "2026-10-21T12:49:15.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98263 (GCVE-0-2026-98263)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
stream_config is not initialized before being passed to
sdw_stream_add_slave(). The type field may contain garbage and is
later copied to stream->type by sdw_config_stream().
Zero-initialize stream_config so type defaults to SDW_STREAM_PCM.
While at it, use snd_sdw_params_to_config() helper instead of
open-coding the same logic.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/rt712-sdca-dmic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6507055733a9d397289277408b52daf422f8a814",
"status": "affected",
"version": "63a511284c9ea72696a5dd0a2d2721bdef19f774",
"versionType": "git"
},
{
"lessThan": "c144447c207e2be24d6ac86d544691ba464caad8",
"status": "affected",
"version": "63a511284c9ea72696a5dd0a2d2721bdef19f774",
"versionType": "git"
},
{
"lessThan": "d93988c9e58d37b677f6ee8aceae741c8d1e30ad",
"status": "affected",
"version": "63a511284c9ea72696a5dd0a2d2721bdef19f774",
"versionType": "git"
},
{
"lessThan": "a318ee718e7448cd6bf62d9b3197b6a6a8d4701e",
"status": "affected",
"version": "63a511284c9ea72696a5dd0a2d2721bdef19f774",
"versionType": "git"
},
{
"lessThan": "03a5699a0a04309c597683967aaaf25d1e555ea2",
"status": "affected",
"version": "63a511284c9ea72696a5dd0a2d2721bdef19f774",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/rt712-sdca-dmic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype\n\nstream_config is not initialized before being passed to\nsdw_stream_add_slave(). The type field may contain garbage and is\nlater copied to stream-\u003etype by sdw_config_stream().\n\nZero-initialize stream_config so type defaults to SDW_STREAM_PCM.\n\nWhile at it, use snd_sdw_params_to_config() helper instead of\nopen-coding the same logic."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:34.265Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6507055733a9d397289277408b52daf422f8a814"
},
{
"url": "https://git.kernel.org/stable/c/c144447c207e2be24d6ac86d544691ba464caad8"
},
{
"url": "https://git.kernel.org/stable/c/d93988c9e58d37b677f6ee8aceae741c8d1e30ad"
},
{
"url": "https://git.kernel.org/stable/c/a318ee718e7448cd6bf62d9b3197b6a6a8d4701e"
},
{
"url": "https://git.kernel.org/stable/c/03a5699a0a04309c597683967aaaf25d1e555ea2"
}
],
"title": "ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config-\u003etype",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98263",
"datePublished": "2026-10-06T08:45:26.884Z",
"dateReserved": "2026-09-25T10:25:14.332Z",
"dateUpdated": "2026-10-19T09:16:34.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98193 (GCVE-0-2026-98193)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: libipw: reject TKIP frames without a full MIC
libipw_michael_mic_verify() assumes that an skb contains an eight-byte
Michael MIC. A short TKIP frame makes the unsigned payload length wrap,
causing michael_mic() to read past the skb.
Check that the MIC is present before verifying it, and use the existing
MICHAEL_MIC_LEN constant for all MIC lengths in the verifier.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/ipw2x00/libipw_crypto_tkip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f448b267968d0ee985e5927c868c8f858169ab34",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "9a7fb67364817710c96785ff86b71a2711ee92cb",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "ac7c08626f67844336086cf563f417566b76f0d7",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "bb7ae8910cc886885aea95abb7c2e578a2341646",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "06f42accaf3c6aecab1dcc57f68dde6c06c8b380",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/ipw2x00/libipw_crypto_tkip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"lessThan": "2.6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: reject TKIP frames without a full MIC\n\nlibipw_michael_mic_verify() assumes that an skb contains an eight-byte\nMichael MIC. A short TKIP frame makes the unsigned payload length wrap,\ncausing michael_mic() to read past the skb.\n\nCheck that the MIC is present before verifying it, and use the existing\nMICHAEL_MIC_LEN constant for all MIC lengths in the verifier."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:51.640Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f448b267968d0ee985e5927c868c8f858169ab34"
},
{
"url": "https://git.kernel.org/stable/c/9a7fb67364817710c96785ff86b71a2711ee92cb"
},
{
"url": "https://git.kernel.org/stable/c/ac7c08626f67844336086cf563f417566b76f0d7"
},
{
"url": "https://git.kernel.org/stable/c/bb7ae8910cc886885aea95abb7c2e578a2341646"
},
{
"url": "https://git.kernel.org/stable/c/06f42accaf3c6aecab1dcc57f68dde6c06c8b380"
}
],
"title": "wifi: libipw: reject TKIP frames without a full MIC",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98193",
"datePublished": "2026-10-06T08:44:33.584Z",
"dateReserved": "2026-09-25T10:25:14.323Z",
"dateUpdated": "2026-10-21T12:54:51.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80980 (GCVE-0-2026-80980)
Vulnerability from cvelistv5
Published
2026-09-11 19:42
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: stop killed, freed and out_of_sync sharing a byte
The three connection state flags are single-bit bitfields, so they occupy
one byte of struct smc_connection and every store to one is a
read-modify-write of the other two:
u8 killed : 1;
u8 freed : 1;
u8 out_of_sync : 1;
They are not written under a common lock. smc_cdc_msg_validate() sets
out_of_sync from the receive tasklet, while smc_conn_kill() sets killed
from process context under lock_sock(), and the receive path does not defer
to the backlog when the socket is owned -- smc_cdc_msg_recv() takes only
bh_lock_sock().
Give each flag its own byte so a store no longer touches its neighbours.
All readers test them as booleans and are unchanged. struct smc_connection
grows by two bytes.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80980",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:21:47.866329Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:37.381Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/smc.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "297e96f38d3e4f1a3b84068950dd5c7a55bbdc7b",
"status": "affected",
"version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
"versionType": "git"
},
{
"lessThan": "09a9cbadc05f452405de31012bd2c428b601291a",
"status": "affected",
"version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
"versionType": "git"
},
{
"lessThan": "313f79149eb337411c64e2c247234b62ef9a3cb9",
"status": "affected",
"version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
"versionType": "git"
},
{
"lessThan": "2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec",
"status": "affected",
"version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
"versionType": "git"
},
{
"lessThan": "db51a8658c11a82432b64999519a269c3aabb447",
"status": "affected",
"version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/smc.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: stop killed, freed and out_of_sync sharing a byte\n\nThe three connection state flags are single-bit bitfields, so they occupy\none byte of struct smc_connection and every store to one is a\nread-modify-write of the other two:\n\n u8 killed : 1;\n u8 freed : 1;\n u8 out_of_sync : 1;\n\nThey are not written under a common lock. smc_cdc_msg_validate() sets\nout_of_sync from the receive tasklet, while smc_conn_kill() sets killed\nfrom process context under lock_sock(), and the receive path does not defer\nto the backlog when the socket is owned -- smc_cdc_msg_recv() takes only\nbh_lock_sock().\n\nGive each flag its own byte so a store no longer touches its neighbours.\nAll readers test them as booleans and are unchanged. struct smc_connection\ngrows by two bytes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - smc_cdc_msg_validate() runs from the SMC-R CDC receive tasklet on RDMA completions, and teardown is driven by CLC DECLINE (FIRST_CONTACT) or LLC DELETE_LINK_ALL from the same peer. SMC-Rv2 is RoCEv2 over UDP/4791 (IP-routable) with the CLC handshake on plain TCP, so a remote host that can reach an AF_SMC listener hits the path.\nAC:L - The attacker controls both sides of the race: it sends CDC failover_validation messages that store out_of_sync from the receive tasklet (no sock lock) while concurrently forcing smc_conn_kill()/smc_conn_free() via CLC decline, CDC close/abort, or LLC link-delete, and can retry across many connections in the same link group.\nPR:N - SMC has no peer authentication. Completing the CLC handshake to a listening AF_SMC/IPPROTO_SMC socket and sending CDC/CLC/LLC messages requires no credentials, capabilities, or local account, matching other SMC remote bugs.\nUI:N - CDC is processed in a softirq tasklet from the RDMA completion queue and CLC decline is handled in the handshake worker; no local user or application action is required beyond the already-listening SMC server.\nS:U - The corrupted flags and resulting UAF stay inside kernel objects (smc_connection, smc_sock, smc_link_group) in the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A lost killed/freed/out_of_sync bit from the shared-byte RMW lets CDC continue after unregister or lets smc_conn_free() run twice (duplicate smc_lgr_put), a use-after-free of the socket and link group that can be reallocated to disclose kernel memory.\nI:H - The same UAF/double-free writes through a reused smc_sock (sk_err, sk_data_ready, queue_work on abort_work/close_work) and link-group refcounts, giving heap-spray primitives for arbitrary kernel write and control-flow hijack.\nA:H - Use-after-free and double-free of the connection and link group oops or panic in softirq/workqueue context (refcount underflow, as in related SMC UAFs), and the attacker can trigger it repeatedly without authentication."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:21.045Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/297e96f38d3e4f1a3b84068950dd5c7a55bbdc7b"
},
{
"url": "https://git.kernel.org/stable/c/09a9cbadc05f452405de31012bd2c428b601291a"
},
{
"url": "https://git.kernel.org/stable/c/313f79149eb337411c64e2c247234b62ef9a3cb9"
},
{
"url": "https://git.kernel.org/stable/c/2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec"
},
{
"url": "https://git.kernel.org/stable/c/db51a8658c11a82432b64999519a269c3aabb447"
}
],
"title": "net/smc: stop killed, freed and out_of_sync sharing a byte",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80980",
"datePublished": "2026-09-11T19:42:40.832Z",
"dateReserved": "2026-08-26T14:34:25.811Z",
"dateUpdated": "2026-10-21T12:47:21.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89971 (GCVE-0-2026-89971)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-19 08:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme: skip the zoned limits update if the zone info query failed
nvme_query_zone_info() returns either a negative errno or a positive
NVMe status code, but nvme_update_ns_info_block() only tests for the
negative case:
ret = nvme_query_zone_info(ns, lbaf, &zi);
if (ret < 0)
goto out;
If the device fails the Identify Namespace (I/O Command Set specific)
command, or the Identify Controller command issued by
nvme_set_max_append(), the positive status falls through and setup
continues with the zero-initialized zone info. nvme_update_zone_info()
then marks the queue zoned with chunk_sectors and ns->head->zsze set to
zero.
blk_validate_zoned_limits() does not check chunk_sectors, so the limits
commit succeeds. blk_revalidate_disk_zones() does reject the zero zone
size, but by then the limits are live and nothing rolls them back, so
I/O keeps being submitted to a zoned queue with a zero zone size and
disk_zone_no() shifts by ilog2(0):
nvme0n1: Invalid non power of two zone size (0)
UBSAN: shift-out-of-bounds in include/linux/blkdev.h:747:16
shift exponent -1 is negative
disk_zone_no include/linux/blkdev.h:747 [inline]
bio_straddles_zones include/linux/blkdev.h:1058 [inline]
blk_zone_wplug_handle_write block/blk-zoned.c:1423 [inline]
blk_zone_plug_bio.cold+0x25/0x1c8 block/blk-zoned.c:1605
blk_mq_submit_bio+0x18fb/0x2870 block/blk-mq.c:3196
submit_bh_wbc+0x575/0x740 fs/buffer.c:2824
__block_write_full_folio+0x728/0xdd0 fs/buffer.c:1933
Any device, firmware or NVMe-oF target that fails this one command
reaches this.
Skip the zoned limits update in that case, and log which of the two
things happened: during a revalidation the queue keeps the zone
geometry it was last validated with, and on a first scan the namespace
is registered without zoned limits, so that it is still available as a
handle for admin commands. Neither of the paths in
nvme_query_zone_info() that return a positive status logs anything, so
the failure would otherwise be silent.
zi.zone_size is an exact indicator: every path that returns a positive
status returns before it is assigned, and after that the only failure
left is -ENODEV, which the caller already handles.
Found by FuzzNvme.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a75258e651d91ec25424cd94d824d192c11ccc24",
"status": "affected",
"version": "c85c9ab926a592e2f59f7d9a6ca7d6562843d8fa",
"versionType": "git"
},
{
"lessThan": "7fad53ae2052a2b4fc7ca567d6555bdb1176ba35",
"status": "affected",
"version": "c85c9ab926a592e2f59f7d9a6ca7d6562843d8fa",
"versionType": "git"
},
{
"lessThan": "bb6dafa79040357cf5043836e1db108c2af8b1e1",
"status": "affected",
"version": "c85c9ab926a592e2f59f7d9a6ca7d6562843d8fa",
"versionType": "git"
},
{
"lessThan": "3838e80fcfb32e62baffb63c6dc0a60153665a4d",
"status": "affected",
"version": "c85c9ab926a592e2f59f7d9a6ca7d6562843d8fa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: skip the zoned limits update if the zone info query failed\n\nnvme_query_zone_info() returns either a negative errno or a positive\nNVMe status code, but nvme_update_ns_info_block() only tests for the\nnegative case:\n\n\tret = nvme_query_zone_info(ns, lbaf, \u0026zi);\n\tif (ret \u003c 0)\n\t\tgoto out;\n\nIf the device fails the Identify Namespace (I/O Command Set specific)\ncommand, or the Identify Controller command issued by\nnvme_set_max_append(), the positive status falls through and setup\ncontinues with the zero-initialized zone info. nvme_update_zone_info()\nthen marks the queue zoned with chunk_sectors and ns-\u003ehead-\u003ezsze set to\nzero.\n\nblk_validate_zoned_limits() does not check chunk_sectors, so the limits\ncommit succeeds. blk_revalidate_disk_zones() does reject the zero zone\nsize, but by then the limits are live and nothing rolls them back, so\nI/O keeps being submitted to a zoned queue with a zero zone size and\ndisk_zone_no() shifts by ilog2(0):\n\n nvme0n1: Invalid non power of two zone size (0)\n UBSAN: shift-out-of-bounds in include/linux/blkdev.h:747:16\n shift exponent -1 is negative\n disk_zone_no include/linux/blkdev.h:747 [inline]\n bio_straddles_zones include/linux/blkdev.h:1058 [inline]\n blk_zone_wplug_handle_write block/blk-zoned.c:1423 [inline]\n blk_zone_plug_bio.cold+0x25/0x1c8 block/blk-zoned.c:1605\n blk_mq_submit_bio+0x18fb/0x2870 block/blk-mq.c:3196\n submit_bh_wbc+0x575/0x740 fs/buffer.c:2824\n __block_write_full_folio+0x728/0xdd0 fs/buffer.c:1933\n\nAny device, firmware or NVMe-oF target that fails this one command\nreaches this.\n\nSkip the zoned limits update in that case, and log which of the two\nthings happened: during a revalidation the queue keeps the zone\ngeometry it was last validated with, and on a first scan the namespace\nis registered without zoned limits, so that it is still available as a\nhandle for admin commands. Neither of the paths in\nnvme_query_zone_info() that return a positive status logs anything, so\nthe failure would otherwise be silent.\n\nzi.zone_size is an exact indicator: every path that returns a positive\nstatus returns before it is assigned, and after that the only failure\nleft is -ENODEV, which the caller already handles.\n\nFound by FuzzNvme."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The NVMe host core parses Identify responses during namespace scan for PCIe and NVMe-oF (nvme-tcp/rdma/fc). A malicious or compromised NVMe-oF target over routable TCP (typically 4420) can fail the ZNS Identify command and trigger the bug from the network.\nAC:L - A malicious controller only needs to report CSI=ZNS then return a positive NVMe status on Identify CSI-NS or Identify CSI-CTRL; nvme_update_ns_info_block() treats that as success and installs zero zone geometry with no race or victim-specific layout.\nPR:N - The attacker is the connected NVMe-oF peer and needs no host account or capability. NVMe/TCP TLS and DH-HMAC-CHAP are optional and off by default, matching prior NVMe-oF host CNA scoring as PR:N.\nUI:N - Namespace scan and AEN Notice Namespace Changed rescans run in nvme_wq once a controller exists, including nvmf-autoconnect. Partition probe and filesystem writeback then submit I/O that hits disk_zone_no with no extra victim action at exploit time.\nS:U - The invalid zoned limits and UBSAN shift occur in the host kernel block layer. This is not a VM escape, IOMMU bypass, or other cross-authority boundary.\nC:N - The flaw leaves zi zero-initialized and later does sector \u003e\u003e ilog2(0) in disk_zone_no. That is an undefined shift, not an out-of-bounds read, use-after-free, or other kernel memory disclosure primitive.\nI:N - nvme_update_zone_info() only programs this queue\u0027s chunk_sectors and zsze to zero from uncleared zi. There is no out-of-bounds write, use-after-free, or attacker-controlled write/control-flow hijack primitive.\nA:H - FuzzNvme reproduced UBSAN shift-out-of-bounds in disk_zone_no on live I/O after zoned limits committed with zone size 0. CONFIG_UBSAN_TRAP and panic_on_warn panic the host, which kernel CNA guidance scores as high availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:55:46.135Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a75258e651d91ec25424cd94d824d192c11ccc24"
},
{
"url": "https://git.kernel.org/stable/c/7fad53ae2052a2b4fc7ca567d6555bdb1176ba35"
},
{
"url": "https://git.kernel.org/stable/c/bb6dafa79040357cf5043836e1db108c2af8b1e1"
},
{
"url": "https://git.kernel.org/stable/c/3838e80fcfb32e62baffb63c6dc0a60153665a4d"
}
],
"title": "nvme: skip the zoned limits update if the zone info query failed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89971",
"datePublished": "2026-09-16T10:32:50.995Z",
"dateReserved": "2026-09-11T19:38:34.778Z",
"dateUpdated": "2026-10-19T08:55:46.135Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97594 (GCVE-0-2026-97594)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
landlock: Fix use-after-free of the source's parent directory
current_check_refer_path() reads old_dentry->d_parent without holding a
reference nor a lock on it, and then dereferences it in
collect_domain_accesses() and in the audit record.
A reference on a child does not pin its parent: __d_move() reassigns
dentry->d_parent and drops the reference the child held on its former
parent. hook_path_rename() is not affected because the rename path
calls lock_rename() before the hook, so the source cannot be reparented
under it. hook_path_link() has no such protection: filename_linkat()
holds a reference on the source dentry but neither locks nor references
its parent, so a concurrent rename(2) can reparent the source while
security_path_link() runs, and the former parent can then be removed and
freed while the hook walks it.
A process can trigger this after entering a Landlock domain that handles
at least one filesystem access right. The process can then race a
linkat(2) loop against rename(2) and rmdir(2):
BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290
Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549
collect_domain_accesses+0x278/0x290
current_check_refer_path+0x952/0x1120
security_path_link+0x1be/0x320
filename_linkat+0x342/0x6d0
__x64_sys_linkat+0xfa/0x150
Freed by task 562:
kmem_cache_free+0x139/0x4c0
i_callback+0x4b/0x80
rcu_core+0x7dc/0x10a0
Take a reference on the dentry selected as the source parent, using
dget() for the common-mount-root case and dget_parent() otherwise.
Release it after the hierarchy walk and synchronous audit logging.
[mic: Clarify the caller, reachability, and reference handling]
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/landlock/fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "48fc1c74052c956c59d5b16b5e18e0dd36b76aa2",
"status": "affected",
"version": "b91c3e4ea756b12b7d992529226edce1cfd854d7",
"versionType": "git"
},
{
"lessThan": "4c37992b9668c4f37aae41dd95c369f7b6009915",
"status": "affected",
"version": "b91c3e4ea756b12b7d992529226edce1cfd854d7",
"versionType": "git"
},
{
"lessThan": "379efd2ce8b26fd35feb13ccc2f671ff105a5052",
"status": "affected",
"version": "b91c3e4ea756b12b7d992529226edce1cfd854d7",
"versionType": "git"
},
{
"lessThan": "ba29c46ccfe3ebadfb8aa18149186c49f84b14f8",
"status": "affected",
"version": "b91c3e4ea756b12b7d992529226edce1cfd854d7",
"versionType": "git"
},
{
"lessThan": "2c6dc792538260a8087ac5b22c31b3b8e47c85d6",
"status": "affected",
"version": "b91c3e4ea756b12b7d992529226edce1cfd854d7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/landlock/fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Fix use-after-free of the source\u0027s parent directory\n\ncurrent_check_refer_path() reads old_dentry-\u003ed_parent without holding a\nreference nor a lock on it, and then dereferences it in\ncollect_domain_accesses() and in the audit record.\n\nA reference on a child does not pin its parent: __d_move() reassigns\ndentry-\u003ed_parent and drops the reference the child held on its former\nparent. hook_path_rename() is not affected because the rename path\ncalls lock_rename() before the hook, so the source cannot be reparented\nunder it. hook_path_link() has no such protection: filename_linkat()\nholds a reference on the source dentry but neither locks nor references\nits parent, so a concurrent rename(2) can reparent the source while\nsecurity_path_link() runs, and the former parent can then be removed and\nfreed while the hook walks it.\n\nA process can trigger this after entering a Landlock domain that handles\nat least one filesystem access right. The process can then race a\nlinkat(2) loop against rename(2) and rmdir(2):\n\n BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290\n Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549\n collect_domain_accesses+0x278/0x290\n current_check_refer_path+0x952/0x1120\n security_path_link+0x1be/0x320\n filename_linkat+0x342/0x6d0\n __x64_sys_linkat+0xfa/0x150\n Freed by task 562:\n kmem_cache_free+0x139/0x4c0\n i_callback+0x4b/0x80\n rcu_core+0x7dc/0x10a0\n\nTake a reference on the dentry selected as the source parent, using\ndget() for the common-mount-root case and dget_parent() otherwise.\nRelease it after the hierarchy walk and synchronous audit logging.\n\n[mic: Clarify the caller, reachability, and reference handling]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The trigger is a local linkat(2) syscall: filename_linkat() -\u003e security_path_link() -\u003e hook_path_link() -\u003e current_check_refer_path(), raced against local rename(2)/rmdir(2). No remote protocol supplies any of the input.\nAC:L - The attacker runs every side of the race: a linkat() loop on their own file, plus rename() to reparent the source and rmdir() to free the old parent, all in directories they create (e.g. /tmp). No condition outside the attacker\u0027s control is needed; the window can be retried at will.\nPR:L - An ordinary unprivileged user can enter a Landlock domain that handles any FS right (landlock_create_ruleset + landlock_restrict_self after PR_SET_NO_NEW_PRIVS, no capability needed); that makes landlock_get_applicable_subject() non-NULL and reaches the unpinned d_parent read.\nUI:N - The attacker\u0027s own syscalls on files and directories they own trigger the bug; no other user or administrator has to do anything.\nS:U - The corruption happens in kernel memory under the same kernel authority; exploiting it is standard local privilege escalation, not a crossing into a separate authority such as a hypervisor.\nC:H - collect_domain_accesses() dereferences the freed old_parent dentry and follows its d_parent/d_inode pointers into the Landlock inode blob via find_rule(). If the attacker reallocates the freed slab, they control pointers that the kernel then follows and reads.\nI:H - collect_domain_accesses() calls dget() and later dput() on the freed dentry. That writes the lockref inside the freed or reallocated object and can run dentry teardown on it, a write primitive that can lead to a double free or control-flow hijack.\nA:H - The KASAN report in the commit shows a slab use-after-free in collect_domain_accesses(). On production kernels the refcount changes on freed memory or the stale pointer walk can oops or panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:22.513Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/48fc1c74052c956c59d5b16b5e18e0dd36b76aa2"
},
{
"url": "https://git.kernel.org/stable/c/4c37992b9668c4f37aae41dd95c369f7b6009915"
},
{
"url": "https://git.kernel.org/stable/c/379efd2ce8b26fd35feb13ccc2f671ff105a5052"
},
{
"url": "https://git.kernel.org/stable/c/ba29c46ccfe3ebadfb8aa18149186c49f84b14f8"
},
{
"url": "https://git.kernel.org/stable/c/2c6dc792538260a8087ac5b22c31b3b8e47c85d6"
}
],
"title": "landlock: Fix use-after-free of the source\u0027s parent directory",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97594",
"datePublished": "2026-09-25T10:22:10.548Z",
"dateReserved": "2026-09-24T16:01:01.157Z",
"dateUpdated": "2026-10-21T12:53:22.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98236 (GCVE-0-2026-98236)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
mhi_mbim_rx() ignores the return value of skb_copy_bits() when it
copies each datagram out of the NTB. The datagram offset and length
come from the DPE, which is only checked to lie within the NTB
itself, so a modem can point a datagram outside the received skb.
The copy then fails and the freshly allocated skbn is passed to
netif_rx() with its uninitialized contents still in place, leaking
kernel heap memory into the network stack.
Free the skb and account an error when the copy fails.
Verified in a QEMU guest with a fault injector pointing a DPE
outside the received NTB: the copy fails, and the unpatched driver
hands the uninitialized skbn to the network stack (observed as
"unknown protocol" on bytes that were never written). With this
check the failed datagram is dropped and counted as an rx error.
Changes in v2: factor the free-and-count sequence out into
mhi_mbim_rx_drop(), shared with the unknown-protocol path, as
suggested by Loic Poulain.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wwan/mhi_wwan_mbim.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "650af68435eaee783824457d2ef78cc5c03c1e88",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
},
{
"lessThan": "350fd3125ee26b5243935fd9e2b4d162ffba430a",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
},
{
"lessThan": "dd136f1fdd1059f3bc25ede3a8def8f0ee151ce7",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
},
{
"lessThan": "298659c3677bf622afa9d77549cb4a967f9541e9",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
},
{
"lessThan": "02eba5f36d20283f144f75d47f0354a85e4f78f0",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
},
{
"lessThan": "7e98216e9da08b79e07a514d2a4f7646f8c9ccb9",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
},
{
"lessThan": "31550d585589fde1ae95bf7f7a8188b2d2fdf1c7",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wwan/mhi_wwan_mbim.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: mhi_wwan_mbim: check skb_copy_bits() return value\n\nmhi_mbim_rx() ignores the return value of skb_copy_bits() when it\ncopies each datagram out of the NTB. The datagram offset and length\ncome from the DPE, which is only checked to lie within the NTB\nitself, so a modem can point a datagram outside the received skb.\nThe copy then fails and the freshly allocated skbn is passed to\nnetif_rx() with its uninitialized contents still in place, leaking\nkernel heap memory into the network stack.\n\nFree the skb and account an error when the copy fails.\n\n\nVerified in a QEMU guest with a fault injector pointing a DPE\noutside the received NTB: the copy fails, and the unpatched driver\nhands the uninitialized skbn to the network stack (observed as\n\"unknown protocol\" on bytes that were never written). With this\ncheck the failed datagram is dropped and counted as an rx error.\n\nChanges in v2: factor the free-and-count sequence out into\nmhi_mbim_rx_drop(), shared with the unknown-protocol path, as\nsuggested by Loic Poulain."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:08.044Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/650af68435eaee783824457d2ef78cc5c03c1e88"
},
{
"url": "https://git.kernel.org/stable/c/350fd3125ee26b5243935fd9e2b4d162ffba430a"
},
{
"url": "https://git.kernel.org/stable/c/dd136f1fdd1059f3bc25ede3a8def8f0ee151ce7"
},
{
"url": "https://git.kernel.org/stable/c/298659c3677bf622afa9d77549cb4a967f9541e9"
},
{
"url": "https://git.kernel.org/stable/c/02eba5f36d20283f144f75d47f0354a85e4f78f0"
},
{
"url": "https://git.kernel.org/stable/c/7e98216e9da08b79e07a514d2a4f7646f8c9ccb9"
},
{
"url": "https://git.kernel.org/stable/c/31550d585589fde1ae95bf7f7a8188b2d2fdf1c7"
}
],
"title": "net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98236",
"datePublished": "2026-10-06T08:45:08.600Z",
"dateReserved": "2026-09-25T10:25:14.329Z",
"dateUpdated": "2026-10-19T09:16:08.044Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98203 (GCVE-0-2026-98203)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: soc_button_array - check btns_desc->package.count
Check that btns_desc->package.count is not 0 before accessing
btns_desc->package.elements[0].
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4c3362f44980aba8e1e69cd6970effbd9f17dc69 Version: 4c3362f44980aba8e1e69cd6970effbd9f17dc69 Version: 4c3362f44980aba8e1e69cd6970effbd9f17dc69 Version: 4c3362f44980aba8e1e69cd6970effbd9f17dc69 Version: 4c3362f44980aba8e1e69cd6970effbd9f17dc69 Version: 4c3362f44980aba8e1e69cd6970effbd9f17dc69 Version: 4c3362f44980aba8e1e69cd6970effbd9f17dc69 Version: 4c3362f44980aba8e1e69cd6970effbd9f17dc69 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/misc/soc_button_array.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c3a94bfedfa2e4c4d37d1181e8db1ab010f1321a",
"status": "affected",
"version": "4c3362f44980aba8e1e69cd6970effbd9f17dc69",
"versionType": "git"
},
{
"lessThan": "ec0576dabd6bf4f6532c5f0a58c9bf57095e45a4",
"status": "affected",
"version": "4c3362f44980aba8e1e69cd6970effbd9f17dc69",
"versionType": "git"
},
{
"lessThan": "c62c6944c680bc4ae188ca9045daada32fcd10ec",
"status": "affected",
"version": "4c3362f44980aba8e1e69cd6970effbd9f17dc69",
"versionType": "git"
},
{
"lessThan": "42c7afc0e5f5b5e12e9689e9a9815b5824cf0efb",
"status": "affected",
"version": "4c3362f44980aba8e1e69cd6970effbd9f17dc69",
"versionType": "git"
},
{
"lessThan": "eb5563386fb8c5dbb55d902a71a0ce10e4f307eb",
"status": "affected",
"version": "4c3362f44980aba8e1e69cd6970effbd9f17dc69",
"versionType": "git"
},
{
"lessThan": "8a70a192e3e5b3ccbeeaf149c931cf45b8e82155",
"status": "affected",
"version": "4c3362f44980aba8e1e69cd6970effbd9f17dc69",
"versionType": "git"
},
{
"lessThan": "12d80e6351556cfecbdd09416e5e4c73d6ca08ba",
"status": "affected",
"version": "4c3362f44980aba8e1e69cd6970effbd9f17dc69",
"versionType": "git"
},
{
"lessThan": "fb5022278b6ea7f1838e3ef78028d5d5e3375f65",
"status": "affected",
"version": "4c3362f44980aba8e1e69cd6970effbd9f17dc69",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/misc/soc_button_array.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: soc_button_array - check btns_desc-\u003epackage.count\n\nCheck that btns_desc-\u003epackage.count is not 0 before accessing\nbtns_desc-\u003epackage.elements[0]."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:34.197Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c3a94bfedfa2e4c4d37d1181e8db1ab010f1321a"
},
{
"url": "https://git.kernel.org/stable/c/ec0576dabd6bf4f6532c5f0a58c9bf57095e45a4"
},
{
"url": "https://git.kernel.org/stable/c/c62c6944c680bc4ae188ca9045daada32fcd10ec"
},
{
"url": "https://git.kernel.org/stable/c/42c7afc0e5f5b5e12e9689e9a9815b5824cf0efb"
},
{
"url": "https://git.kernel.org/stable/c/eb5563386fb8c5dbb55d902a71a0ce10e4f307eb"
},
{
"url": "https://git.kernel.org/stable/c/8a70a192e3e5b3ccbeeaf149c931cf45b8e82155"
},
{
"url": "https://git.kernel.org/stable/c/12d80e6351556cfecbdd09416e5e4c73d6ca08ba"
},
{
"url": "https://git.kernel.org/stable/c/fb5022278b6ea7f1838e3ef78028d5d5e3375f65"
}
],
"title": "Input: soc_button_array - check btns_desc-\u003epackage.count",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98203",
"datePublished": "2026-10-06T08:44:40.883Z",
"dateReserved": "2026-09-25T10:25:14.324Z",
"dateUpdated": "2026-10-19T09:15:34.197Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98357 (GCVE-0-2026-98357)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/isert: wait for deferred control PDU completions before releasing the connection
isert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and
ISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns. The work
item then runs isert_completion_put() -> isert_put_cmd(), which reads
isert_conn->conn and takes conn->cmd_lock.
Nothing orders that work item against teardown. isert_wait_conn() queues
isert_release_work, which frees isert_conn, and iscsit_close_connection()
frees the iscsit_conn right after it returns, so the queued work can run
against freed memory.
Count the deferred control PDU completions per connection and let
isert_wait_conn() wait for them before the release work is queued.
ISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs
iscsit_logout_post_handler(), which ends up waiting for
conn->conn_wait_comp, and that completion is only sent by
iscsit_close_connection() after it has called iscsit_wait_conn().
Waiting for it here would deadlock. Its wait stays the existing
isert_wait4logout().
The splat below is from a kernel with tracing printk()s and an msleep(200)
injected into isert_do_control_comp() to widen the window:
BUG: KASAN: slab-use-after-free in isert_put_cmd+0x53d/0x620
Read of size 8 at addr ffff8881054f1038 by task kworker/u17:1/182
CPU: 0 UID: 0 PID: 182 Comm: kworker/u17:1 Tainted: G B 7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: isert_comp_wq isert_do_control_comp
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
print_report+0xd0/0x630
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? _raw_spin_unlock_irqrestore+0x3e/0x70
? isert_put_cmd+0x53d/0x620
kasan_report+0xce/0x100
? isert_put_cmd+0x53d/0x620
isert_put_cmd+0x53d/0x620
? isert_completion_put+0x305/0x330
? isert_do_control_comp+0x2ef/0x310
process_one_work+0x633/0x1030
? assign_work+0x11d/0x370
worker_thread+0x45b/0xd10
? __pfx_worker_thread+0x10/0x10
? __pfx_worker_thread+0x10/0x10
kthread+0x2c6/0x3b0
? recalc_sigpending+0x15c/0x1e0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x36e/0x5a0
? __pfx_ret_from_fork+0x10/0x10
? __switch_to+0x572/0xdd0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 48:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0x8f/0xa0
__kmalloc_cache_noprof+0x158/0x370
isert_cma_handler+0x1e3/0x2ae0
cma_cm_event_handler+0x3e/0x240
cma_ib_req_handler+0x17d9/0x4490
cm_process_work+0x41/0x330
cm_work_handler+0x5727/0xc160
process_one_work+0x633/0x1030
worker_thread+0x45b/0xd10
kthread+0x2c6/0x3b0
ret_from_fork+0x36e/0x5a0
ret_from_fork_asm+0x1a/0x30
Freed by task 184:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x43/0x70
kfree+0x121/0x380
iscsit_close_connection+0x7cf/0x1e60
iscsit_take_action_for_connection_exit+0x1b6/0x360
iscsi_target_tx_thread+0x472/0x690
kthread+0x2c6/0x3b0
ret_from_fork+0x36e/0x5a0
ret_from_fork_asm+0x1a/0x30
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/isert/ib_isert.c",
"drivers/infiniband/ulp/isert/ib_isert.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f5613acbe2e346d5c466ef0bd264fca936b69f82",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "ccdb1523f12bc8a9646de65055d1aafed9e9bcc6",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "0e230917670c6e6fe3243abfa11299fcbe05b1f4",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "505b242d9351690d1385bbe508ab4666f60363ce",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "7edb8a88d6c76237c8b4435765bee1009e26a50a",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "b96b8b3e41c308f606ffd10cfef1a7b9f97414cd",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "7908fbc597a694bbd99bfb59ece73bc3daded68e",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/isert/ib_isert.c",
"drivers/infiniband/ulp/isert/ib_isert.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: wait for deferred control PDU completions before releasing the connection\n\nisert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and\nISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns. The work\nitem then runs isert_completion_put() -\u003e isert_put_cmd(), which reads\nisert_conn-\u003econn and takes conn-\u003ecmd_lock.\n\nNothing orders that work item against teardown. isert_wait_conn() queues\nisert_release_work, which frees isert_conn, and iscsit_close_connection()\nfrees the iscsit_conn right after it returns, so the queued work can run\nagainst freed memory.\n\nCount the deferred control PDU completions per connection and let\nisert_wait_conn() wait for them before the release work is queued.\n\nISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs\niscsit_logout_post_handler(), which ends up waiting for\nconn-\u003econn_wait_comp, and that completion is only sent by\niscsit_close_connection() after it has called iscsit_wait_conn().\nWaiting for it here would deadlock. Its wait stays the existing\nisert_wait4logout().\n\nThe splat below is from a kernel with tracing printk()s and an msleep(200)\ninjected into isert_do_control_comp() to widen the window:\n\n BUG: KASAN: slab-use-after-free in isert_put_cmd+0x53d/0x620\n Read of size 8 at addr ffff8881054f1038 by task kworker/u17:1/182\n\n CPU: 0 UID: 0 PID: 182 Comm: kworker/u17:1 Tainted: G B 7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy)\n Tainted: [B]=BAD_PAGE\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Workqueue: isert_comp_wq isert_do_control_comp\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x53/0x70\n print_report+0xd0/0x630\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? _raw_spin_unlock_irqrestore+0x3e/0x70\n ? isert_put_cmd+0x53d/0x620\n kasan_report+0xce/0x100\n ? isert_put_cmd+0x53d/0x620\n isert_put_cmd+0x53d/0x620\n ? isert_completion_put+0x305/0x330\n ? isert_do_control_comp+0x2ef/0x310\n process_one_work+0x633/0x1030\n ? assign_work+0x11d/0x370\n worker_thread+0x45b/0xd10\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2c6/0x3b0\n ? recalc_sigpending+0x15c/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x36e/0x5a0\n ? __pfx_ret_from_fork+0x10/0x10\n ? __switch_to+0x572/0xdd0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\n Allocated by task 48:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc_cache_noprof+0x158/0x370\n isert_cma_handler+0x1e3/0x2ae0\n cma_cm_event_handler+0x3e/0x240\n cma_ib_req_handler+0x17d9/0x4490\n cm_process_work+0x41/0x330\n cm_work_handler+0x5727/0xc160\n process_one_work+0x633/0x1030\n worker_thread+0x45b/0xd10\n kthread+0x2c6/0x3b0\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n\n Freed by task 184:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kfree+0x121/0x380\n iscsit_close_connection+0x7cf/0x1e60\n iscsit_take_action_for_connection_exit+0x1b6/0x360\n iscsi_target_tx_thread+0x472/0x690\n kthread+0x2c6/0x3b0\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The iSER initiator triggers it remotely over RDMA (iWARP/RoCEv2 are IP-routable). Its iSCSI Text Request (or a TMF or a malformed PDU that draws a Reject) makes isert_send_done() queue isert_do_control_comp(); an RDMA CM disconnect from the same initiator then starts teardown via iscsit_close_connection().\nAC:H - The attacker sends both the request and the disconnect, but the free only wins if the already-queued isert_comp_wq work stays delayed through ib_drain_qp, isert_wait4cmds and the release work. The attacker can\u0027t control that scheduling; the reporter needed an injected msleep(200) to reproduce it.\nPR:N - The attacker only needs a full-feature iSCSI session, and LIO allows login with AuthMethod=None, where the initiator IQN is merely asserted. No credentials are checked before the Text/TMF/Reject paths that queue the deferred completion.\nUI:N - The initiator triggers the response PDU and the connection teardown entirely through its own iSCSI PDUs and RDMA CM disconnect; no action by a target administrator is needed.\nS:U - The use-after-free is in the target host\u0027s own kernel memory (isert_conn and iscsit_conn), so the impact stays within the same kernel security authority.\nC:H - isert_put_cmd() dereferences the freed isert_conn-\u003econn and reads the freed iscsit_conn and cmd structures. Reclaiming those slab objects lets attacker-shaped data steer kernel pointer reads.\nI:H - On the freed iscsit_conn, isert_put_cmd() takes spin_lock_bh(\u0026conn-\u003ecmd_lock), runs list_del_init(\u0026cmd-\u003ei_conn_node) and calls iscsit_release_cmd()/transport_generic_free_cmd(). These are writes and frees through freed memory, which can corrupt the heap.\nA:H - The isert_comp_wq worker hits a slab use-after-free in isert_put_cmd() (KASAN splat in the fix commit), which on production kernels can crash or oops the iSCSI target host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:07.886Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f5613acbe2e346d5c466ef0bd264fca936b69f82"
},
{
"url": "https://git.kernel.org/stable/c/ccdb1523f12bc8a9646de65055d1aafed9e9bcc6"
},
{
"url": "https://git.kernel.org/stable/c/0e230917670c6e6fe3243abfa11299fcbe05b1f4"
},
{
"url": "https://git.kernel.org/stable/c/505b242d9351690d1385bbe508ab4666f60363ce"
},
{
"url": "https://git.kernel.org/stable/c/7edb8a88d6c76237c8b4435765bee1009e26a50a"
},
{
"url": "https://git.kernel.org/stable/c/b96b8b3e41c308f606ffd10cfef1a7b9f97414cd"
},
{
"url": "https://git.kernel.org/stable/c/7908fbc597a694bbd99bfb59ece73bc3daded68e"
},
{
"url": "https://git.kernel.org/stable/c/a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f"
}
],
"title": "IB/isert: wait for deferred control PDU completions before releasing the connection",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98357",
"datePublished": "2026-10-06T08:46:44.216Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:07.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98196 (GCVE-0-2026-98196)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmsmac: fix UAF in brcms_free_timer()
brcms_free_timer() calls brcms_del_timer() which uses the non-synchronous
cancel_delayed_work() to cancel the timer's underlying delayed work. If
the work callback (_brcms_timer) is already running, cancel_delayed_work()
returns false without waiting, and brcms_free_timer() proceeds to kfree(t)
while the callback still accesses t through container_of().
Add an explicit cancel_delayed_work_sync() after brcms_del_timer() to
guarantee that any in-flight callback has completed before the timer
structure is freed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "10eeb0b29fd7f52487c9ae573e8d79c210a0095d",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "74acccc928851f69184271832d690607877122af",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "050d2486e8ed2c0a23b87249ccd23e8072721391",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "856dabd5f2617efb23c043be9e1b22a9e6e97c41",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "2a4841ff0b74b495cddd31ae324e922217fc2f13",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "1edb3ddd261e973a4d577c0547e63bfa25a8170d",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "777cb6bba59e875b16a1d8897a483a5fecfcd5d2",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "1eeca1d5e0920fbdad6449768fd2d4364e714180",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmsmac: fix UAF in brcms_free_timer()\n\nbrcms_free_timer() calls brcms_del_timer() which uses the non-synchronous\ncancel_delayed_work() to cancel the timer\u0027s underlying delayed work. If\nthe work callback (_brcms_timer) is already running, cancel_delayed_work()\nreturns false without waiting, and brcms_free_timer() proceeds to kfree(t)\nwhile the callback still accesses t through container_of().\n\nAdd an explicit cancel_delayed_work_sync() after brcms_del_timer() to\nguarantee that any in-flight callback has completed before the timer\nstructure is freed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:27.411Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/10eeb0b29fd7f52487c9ae573e8d79c210a0095d"
},
{
"url": "https://git.kernel.org/stable/c/74acccc928851f69184271832d690607877122af"
},
{
"url": "https://git.kernel.org/stable/c/050d2486e8ed2c0a23b87249ccd23e8072721391"
},
{
"url": "https://git.kernel.org/stable/c/856dabd5f2617efb23c043be9e1b22a9e6e97c41"
},
{
"url": "https://git.kernel.org/stable/c/2a4841ff0b74b495cddd31ae324e922217fc2f13"
},
{
"url": "https://git.kernel.org/stable/c/1edb3ddd261e973a4d577c0547e63bfa25a8170d"
},
{
"url": "https://git.kernel.org/stable/c/777cb6bba59e875b16a1d8897a483a5fecfcd5d2"
},
{
"url": "https://git.kernel.org/stable/c/1eeca1d5e0920fbdad6449768fd2d4364e714180"
}
],
"title": "wifi: brcmsmac: fix UAF in brcms_free_timer()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98196",
"datePublished": "2026-10-06T08:44:35.616Z",
"dateReserved": "2026-09-25T10:25:14.324Z",
"dateUpdated": "2026-10-19T09:15:27.411Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98269 (GCVE-0-2026-98269)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: abort transaction on failure to update inode for hole punching and reflinking
If we fail to update the inode we error out without aborting the
transaction, which can result in a persistent inconsistency if after
the failure the transaction is committed, as we have dropped file
extent items from a range and either punched a hole or insert a new file
extent item for that range (for reflinks).
So add the missing transaction abort.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067d",
"status": "affected",
"version": "2aaa66558172b017f36bf38ae69372813dedee9d",
"versionType": "git"
},
{
"lessThan": "834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6",
"status": "affected",
"version": "2aaa66558172b017f36bf38ae69372813dedee9d",
"versionType": "git"
},
{
"lessThan": "9588850bfa75c78ce73c2f6f72544d19d2e9beb6",
"status": "affected",
"version": "2aaa66558172b017f36bf38ae69372813dedee9d",
"versionType": "git"
},
{
"lessThan": "36c68dc909845c049e0286d229bc502947239452",
"status": "affected",
"version": "2aaa66558172b017f36bf38ae69372813dedee9d",
"versionType": "git"
},
{
"lessThan": "97fcd34aa9fd73cefe3120ac9a82ca9d7763922f",
"status": "affected",
"version": "2aaa66558172b017f36bf38ae69372813dedee9d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort transaction on failure to update inode for hole punching and reflinking\n\nIf we fail to update the inode we error out without aborting the\ntransaction, which can result in a persistent inconsistency if after\nthe failure the transaction is committed, as we have dropped file\nextent items from a range and either punched a hole or insert a new file\nextent item for that range (for reflinks).\n\nSo add the missing transaction abort."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:40.051Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2605eb9ba3bbd4c9f455cfe6b85bd28a1da7067d"
},
{
"url": "https://git.kernel.org/stable/c/834a3b5c5f1ec0df48c1a6208f9989f4ffdaa0b6"
},
{
"url": "https://git.kernel.org/stable/c/9588850bfa75c78ce73c2f6f72544d19d2e9beb6"
},
{
"url": "https://git.kernel.org/stable/c/36c68dc909845c049e0286d229bc502947239452"
},
{
"url": "https://git.kernel.org/stable/c/97fcd34aa9fd73cefe3120ac9a82ca9d7763922f"
}
],
"title": "btrfs: abort transaction on failure to update inode for hole punching and reflinking",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98269",
"datePublished": "2026-10-06T08:45:31.727Z",
"dateReserved": "2026-09-25T10:25:14.333Z",
"dateUpdated": "2026-10-19T09:16:40.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89633 (GCVE-0-2026-89633)
Vulnerability from cvelistv5
Published
2026-09-11 19:45
Modified
2026-10-21 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
coalesce_t2() computes data pointers directly from server-supplied
DataOffset fields with no validation against buffer bounds:
data_area_of_tgt = (char *)&pSMBt->hdr.Protocol +
get_unaligned_le16(&pSMBt->t2_rsp.DataOffset);
data_area_of_src = (char *)&pSMBs->hdr.Protocol +
get_unaligned_le16(&pSMBs->t2_rsp.DataOffset);
data_area_of_tgt += total_in_tgt;
...
memcpy(data_area_of_tgt, data_area_of_src, total_in_src);
A small DataOffset can push a pointer below the actual byte area,
overwriting header fields; a large one can push it past the buffer
end, causing out-of-bounds heap reads (source) or writes (target).
The BCC overflow guard does not prevent this: BCC reflects how much
data is present, while DataOffset controls where in the buffer it
starts.
The "validate target area" comment present since the function was
first written in 2005 was a placeholder that was never implemented.
Add lower- and upper-bound checks for both data pointers before the
memcpy, and before any target header fields are modified.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb1transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6eb70b78e48b0031bd1a05fe1b58959a48e87739",
"status": "affected",
"version": "e4eb295d38b57f4d4b956942a48887eb252d97c6",
"versionType": "git"
},
{
"lessThan": "36d01415d881d5326a0dd3384f781cd7e69aff2d",
"status": "affected",
"version": "e4eb295d38b57f4d4b956942a48887eb252d97c6",
"versionType": "git"
},
{
"lessThan": "672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e",
"status": "affected",
"version": "e4eb295d38b57f4d4b956942a48887eb252d97c6",
"versionType": "git"
},
{
"lessThan": "033bc80019f07d158630df4e69b19a49010f54f1",
"status": "affected",
"version": "e4eb295d38b57f4d4b956942a48887eb252d97c6",
"versionType": "git"
},
{
"lessThan": "6343c1da561962688f203362d80d6a3bfa39fa1b",
"status": "affected",
"version": "e4eb295d38b57f4d4b956942a48887eb252d97c6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb1transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()\n\ncoalesce_t2() computes data pointers directly from server-supplied\nDataOffset fields with no validation against buffer bounds:\n\n data_area_of_tgt = (char *)\u0026pSMBt-\u003ehdr.Protocol +\n get_unaligned_le16(\u0026pSMBt-\u003et2_rsp.DataOffset);\n data_area_of_src = (char *)\u0026pSMBs-\u003ehdr.Protocol +\n get_unaligned_le16(\u0026pSMBs-\u003et2_rsp.DataOffset);\n data_area_of_tgt += total_in_tgt;\n ...\n memcpy(data_area_of_tgt, data_area_of_src, total_in_src);\n\nA small DataOffset can push a pointer below the actual byte area,\noverwriting header fields; a large one can push it past the buffer\nend, causing out-of-bounds heap reads (source) or writes (target).\nThe BCC overflow guard does not prevent this: BCC reflects how much\ndata is present, while DataOffset controls where in the buffer it\nstarts.\n\nThe \"validate target area\" comment present since the function was\nfirst written in 2005 was a placeholder that was never implemented.\n\nAdd lower- and upper-bound checks for both data pointers before the\nmemcpy, and before any target header fields are modified."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - coalesce_t2() runs in cifs_demultiplex_thread on SMB1 TRANS2 responses received over TCP/445; a malicious or compromised SMB1 server (or MITM on an unsigned session) delivers the crafted DataOffset/DataCount fields entirely over the network.\nAC:L - The server fully controls DataOffset, DataCount, and TotalDataCount in both primary and secondary TRANS2 PDUs and can force a large first fragment so mid-\u003eresp_buf is set; the unbounded memcpy is deterministic with no race or condition outside the attacker\u2019s control.\nPR:N - The attacker is the remote SMB peer and needs no account or privileges on the victim; coalesce_t2() runs in the demux thread before validate_t2() or any local capability check, and session credentials belong to the client mount, not the attacking server.\nUI:N - Once an SMB1 CIFS mount exists (fstab, autofs, embedded/industrial NAS; CONFIG_CIFS_ALLOW_INSECURE_LEGACY defaults on), reconnect and ordinary lookup/readdir/getattr plus cifs_qfs_tcon QUERY_FS_INFO issue TRANS2 automatically, so the server can trigger coalescing with no further user action.\nS:U - The out-of-bounds heap read/write corrupts the client kernel\u2019s own cifs_request slab within the same host security authority; this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - An unvalidated source DataOffset lets memcpy read far past the secondary response (DataOffset is a 16-bit value up to 65535 versus a ~16KB cifs_request object), disclosing adjacent kernel heap; the same memory-corruption primitive can be leveraged for further disclosure.\nI:H - An unvalidated target DataOffset lets memcpy write attacker-controlled bytes past the primary buffer (or backward into the SMB header); the BCC-size guard does not constrain where the copy starts, yielding an out-of-bounds write exploitable for control-flow hijacking.\nA:H - Reading or writing tens of kilobytes past the cifs_request allocation can fault on unmapped pages and oops or panic the demux thread, and a malicious server can retrigger it on every multi-part TRANS2."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:48:05.616Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6eb70b78e48b0031bd1a05fe1b58959a48e87739"
},
{
"url": "https://git.kernel.org/stable/c/36d01415d881d5326a0dd3384f781cd7e69aff2d"
},
{
"url": "https://git.kernel.org/stable/c/672cf86aa6aa0fb4012ce4c3b3498df42ad67a4e"
},
{
"url": "https://git.kernel.org/stable/c/033bc80019f07d158630df4e69b19a49010f54f1"
},
{
"url": "https://git.kernel.org/stable/c/6343c1da561962688f203362d80d6a3bfa39fa1b"
}
],
"title": "smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89633",
"datePublished": "2026-09-11T19:45:28.083Z",
"dateReserved": "2026-09-11T19:38:34.739Z",
"dateUpdated": "2026-10-21T12:48:05.616Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97549 (GCVE-0-2026-97549)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-19 09:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix under-reservation of blocks when repairing sf directories
Whilst running QA on XFS for-next as of 7.3-rc2 with MKFS_OPTIONS="-n
size=8192", I observed the following (trimmed) dmesg splat:
XFS: Assertion failed: args->total >= dp->i_nblocks - nblks, file: fs/xfs/libxfs/xfs_da_btree.c, line: 2387
WARNING: fs/xfs/xfs_message.c:104 at assfail+0x46/0x4a [xfs], CPU#0: xfs_scrub/1426511
CPU: 0 UID: 0 PID: 1426511 Comm: xfs_scrub Tainted: G W 7.3.0-rc2-djwx #rc2 PREEMPT(lazy) 6e418570b606a39783b0e7e7b30dc407b965f9e8
Tainted: [W]=WARN
RIP: 0010:assfail+0x46/0x4a [xfs]
RSP: 0018:ffffc900010d7890 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000ffffffd1
RDX: 0000000000000000 RSI: 0000000000000021 RDI: ffffffffa059fd38
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000000a R11: 000000007fffffff R12: ffffc900010d7940
R13: ffff888368d8f980 R14: ffffc900010d7a48 R15: ffffc900010d78d0
FS: 00007f445c5ce680(0000) GS:ffff8884a97ea000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f443803b9a8 CR3: 0000000107a4b000 CR4: 00000000003506f0
Call Trace:
<TASK>
xfs_da_grow_inode_int+0x2e0/0x300 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xfs_dir2_grow_inode+0x6e/0x150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xfs_dir2_sf_to_block+0x149/0x870 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xrep_dir_swap_prep+0xe2/0x110 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xrep_dir_swap+0xfb/0x2f0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xrep_dir_rebuild_tree+0x99/0x100 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xrep_directory+0x83/0x1c0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xrep_attempt+0x4f/0x1e0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xfs_scrub_metadata+0x393/0x5b0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xfs_ioc_scrubv_metadata+0x306/0x570 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
xfs_file_ioctl+0xa4f/0x1150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]
__x64_sys_ioctl+0x76/0xc0
do_syscall_64+0x7a/0x3b0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
This is a consequence of commit 0fe77e57588b98, which added the
following assertion to xfs_da_grow_inode_int:
ASSERT(args->total >= dp->i_nblocks - nblks);
Tracing this back to xrep_dir_swap_prep, I noticed that the xfs_da_args
object that's passed to xfs_dir2_sf_to_block sets args->total to 1.
This is incorrect because mkfs set the directory block size to 8k and
the filesystem block size to 4k. In other words, args->total should be
2 here, not 1.
Dave Chinner tripped over the same problem with the same branch through
a different channel -- his test setup set the fs block size to 1k, in
which case the directory block size is still set to 4k. Here,
args->total should be 4.
Changing the assignment of args->total to sc->mp->m_dir_geo->fsbcount
makes the assertion go away, but that isn't a complete fix. In
xrep_tempexch_estimate, we also incorrectly assume that a shortform
conversion requires 1 fsblock when it should be m_dir_geo->fsbcount.
Without that, we can under-reserve space in the transaction and cause a
filesystem shutdown.
Note that the xfs_dabuf_nfsb helper will compute the correct value for
directories and xattr, so we use that instead of open-coding the logic.
Also fix xrep_xattr_swap_prep to assign args->total via xfs_dabuf_nfsb
to avoid one logic bomb if we ever support multi-fsblock attrs.
Tripped-by: 0fe77e57588b98 ("xfs: assert the reservation covers each da fork growth")
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_da_btree.c",
"fs/xfs/libxfs/xfs_da_btree.h",
"fs/xfs/scrub/attr_repair.c",
"fs/xfs/scrub/dir_repair.c",
"fs/xfs/scrub/tempfile.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "996cce0c422b66a0e8b1a99505f896b0669ee5b6",
"status": "affected",
"version": "629fdaf5f5b1b7f7107ed4de04e0991a99501ced",
"versionType": "git"
},
{
"lessThan": "b8f46ca5cbd629ffb91489ad7f970b3837835b0a",
"status": "affected",
"version": "629fdaf5f5b1b7f7107ed4de04e0991a99501ced",
"versionType": "git"
},
{
"lessThan": "b950e84acd072ac648ace4fea53c0b1212da4b2c",
"status": "affected",
"version": "629fdaf5f5b1b7f7107ed4de04e0991a99501ced",
"versionType": "git"
},
{
"lessThan": "4d3c07591534517c633945c8d8e6526f10e3fabc",
"status": "affected",
"version": "629fdaf5f5b1b7f7107ed4de04e0991a99501ced",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_da_btree.c",
"fs/xfs/libxfs/xfs_da_btree.h",
"fs/xfs/scrub/attr_repair.c",
"fs/xfs/scrub/dir_repair.c",
"fs/xfs/scrub/tempfile.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix under-reservation of blocks when repairing sf directories\n\nWhilst running QA on XFS for-next as of 7.3-rc2 with MKFS_OPTIONS=\"-n\nsize=8192\", I observed the following (trimmed) dmesg splat:\n\n XFS: Assertion failed: args-\u003etotal \u003e= dp-\u003ei_nblocks - nblks, file: fs/xfs/libxfs/xfs_da_btree.c, line: 2387\n WARNING: fs/xfs/xfs_message.c:104 at assfail+0x46/0x4a [xfs], CPU#0: xfs_scrub/1426511\n CPU: 0 UID: 0 PID: 1426511 Comm: xfs_scrub Tainted: G W 7.3.0-rc2-djwx #rc2 PREEMPT(lazy) 6e418570b606a39783b0e7e7b30dc407b965f9e8\n Tainted: [W]=WARN\n RIP: 0010:assfail+0x46/0x4a [xfs]\n RSP: 0018:ffffc900010d7890 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000ffffffd1\n RDX: 0000000000000000 RSI: 0000000000000021 RDI: ffffffffa059fd38\n RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000\n R10: 000000000000000a R11: 000000007fffffff R12: ffffc900010d7940\n R13: ffff888368d8f980 R14: ffffc900010d7a48 R15: ffffc900010d78d0\n FS: 00007f445c5ce680(0000) GS:ffff8884a97ea000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f443803b9a8 CR3: 0000000107a4b000 CR4: 00000000003506f0\n Call Trace:\n \u003cTASK\u003e\n xfs_da_grow_inode_int+0x2e0/0x300 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_dir2_grow_inode+0x6e/0x150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_dir2_sf_to_block+0x149/0x870 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_dir_swap_prep+0xe2/0x110 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_dir_swap+0xfb/0x2f0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_dir_rebuild_tree+0x99/0x100 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_directory+0x83/0x1c0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xrep_attempt+0x4f/0x1e0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_scrub_metadata+0x393/0x5b0 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_ioc_scrubv_metadata+0x306/0x570 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n xfs_file_ioctl+0xa4f/0x1150 [xfs 5de2257e14108c136f11317e6bbb8ac77efd392c]\n __x64_sys_ioctl+0x76/0xc0\n do_syscall_64+0x7a/0x3b0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nThis is a consequence of commit 0fe77e57588b98, which added the\nfollowing assertion to xfs_da_grow_inode_int:\n\n ASSERT(args-\u003etotal \u003e= dp-\u003ei_nblocks - nblks);\n\nTracing this back to xrep_dir_swap_prep, I noticed that the xfs_da_args\nobject that\u0027s passed to xfs_dir2_sf_to_block sets args-\u003etotal to 1.\nThis is incorrect because mkfs set the directory block size to 8k and\nthe filesystem block size to 4k. In other words, args-\u003etotal should be\n2 here, not 1.\n\nDave Chinner tripped over the same problem with the same branch through\na different channel -- his test setup set the fs block size to 1k, in\nwhich case the directory block size is still set to 4k. Here,\nargs-\u003etotal should be 4.\n\nChanging the assignment of args-\u003etotal to sc-\u003emp-\u003em_dir_geo-\u003efsbcount\nmakes the assertion go away, but that isn\u0027t a complete fix. In\nxrep_tempexch_estimate, we also incorrectly assume that a shortform\nconversion requires 1 fsblock when it should be m_dir_geo-\u003efsbcount.\nWithout that, we can under-reserve space in the transaction and cause a\nfilesystem shutdown.\n\nNote that the xfs_dabuf_nfsb helper will compute the correct value for\ndirectories and xattr, so we use that instead of open-coding the logic.\nAlso fix xrep_xattr_swap_prep to assign args-\u003etotal via xfs_dabuf_nfsb\nto avoid one logic bomb if we ever support multi-fsblock attrs.\n\nTripped-by: 0fe77e57588b98 (\"xfs: assert the reservation covers each da fork growth\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:09:12.382Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/996cce0c422b66a0e8b1a99505f896b0669ee5b6"
},
{
"url": "https://git.kernel.org/stable/c/b8f46ca5cbd629ffb91489ad7f970b3837835b0a"
},
{
"url": "https://git.kernel.org/stable/c/b950e84acd072ac648ace4fea53c0b1212da4b2c"
},
{
"url": "https://git.kernel.org/stable/c/4d3c07591534517c633945c8d8e6526f10e3fabc"
}
],
"title": "xfs: fix under-reservation of blocks when repairing sf directories",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97549",
"datePublished": "2026-09-25T10:21:42.852Z",
"dateReserved": "2026-09-24T16:01:01.154Z",
"dateUpdated": "2026-10-19T09:09:12.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98235 (GCVE-0-2026-98235)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_api: release tail references on DELACTION failure
A batched RTM_DELACTION request takes a temporary reference on each
action before attempting any deletion. tcf_action_delete() clears
each processed slot and drops its temporary reference before attempting
the deletion. If deletion fails, tca_action_gd() calls
tcf_action_put_many() to release the remaining references, but its
tcf_act_for_each_action() iterator stops at the first NULL slot.
When a batch stops at an action bound to a filter, this leaks a
reference on each subsequent action. A later delete of an unbound
action can then return success without removing it from the IDR.
Walk the full array in tcf_action_put_many() and skip NULL slots to
release the references held on the unprocessed actions.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9eaba16f1b6ee19b249e6afd82c27f958d441458",
"status": "affected",
"version": "a0e947c9ccffe47d45aca793d9e7fe4f4494e381",
"versionType": "git"
},
{
"lessThan": "1be63e4579af408d596f0f3165faf1a880631d3b",
"status": "affected",
"version": "a0e947c9ccffe47d45aca793d9e7fe4f4494e381",
"versionType": "git"
},
{
"lessThan": "57b477e46ef2df3483f3488cc713c61c4b384aab",
"status": "affected",
"version": "a0e947c9ccffe47d45aca793d9e7fe4f4494e381",
"versionType": "git"
},
{
"lessThan": "6e05e46fa821a5c1b281355f1f622ac76cb6080a",
"status": "affected",
"version": "a0e947c9ccffe47d45aca793d9e7fe4f4494e381",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/act_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_api: release tail references on DELACTION failure\n\nA batched RTM_DELACTION request takes a temporary reference on each\naction before attempting any deletion. tcf_action_delete() clears\neach processed slot and drops its temporary reference before attempting\nthe deletion. If deletion fails, tca_action_gd() calls\ntcf_action_put_many() to release the remaining references, but its\ntcf_act_for_each_action() iterator stops at the first NULL slot.\n\nWhen a batch stops at an action bound to a filter, this leaks a\nreference on each subsequent action. A later delete of an unbound\naction can then return success without removing it from the IDR.\n\nWalk the full array in tcf_action_put_many() and skip NULL slots to\nrelease the references held on the unprocessed actions."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:07.068Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9eaba16f1b6ee19b249e6afd82c27f958d441458"
},
{
"url": "https://git.kernel.org/stable/c/1be63e4579af408d596f0f3165faf1a880631d3b"
},
{
"url": "https://git.kernel.org/stable/c/57b477e46ef2df3483f3488cc713c61c4b384aab"
},
{
"url": "https://git.kernel.org/stable/c/6e05e46fa821a5c1b281355f1f622ac76cb6080a"
}
],
"title": "net/sched: act_api: release tail references on DELACTION failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98235",
"datePublished": "2026-10-06T08:45:07.909Z",
"dateReserved": "2026-09-25T10:25:14.329Z",
"dateUpdated": "2026-10-19T09:16:07.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80937 (GCVE-0-2026-80937)
Vulnerability from cvelistv5
Published
2026-09-11 19:42
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's
dev->mt76.eeprom.data buffer at the offset reported by the MCU response
(res->addr, a device-controlled __le32) without checking it against the
buffer size. A malicious or malfunctioning device can report an arbitrary
address and drive a 16-byte out-of-bounds write past eeprom.data.
Reject a response whose address would place the copy outside eeprom.data
before deriving the destination pointer. Devices that echo the requested
in-bounds offset are unaffected.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7915/mcu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d6774f6af3711143a93281904a928a78652c8b7e",
"status": "affected",
"version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
"versionType": "git"
},
{
"lessThan": "394e8cb56fc732d71041599cdb4e01f82cfd11c5",
"status": "affected",
"version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
"versionType": "git"
},
{
"lessThan": "5fdaf7016d7684ef756a229fd5d96b4a140eeb40",
"status": "affected",
"version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
"versionType": "git"
},
{
"lessThan": "5f48b0d752a76590e2c613aae5345c2474627d1b",
"status": "affected",
"version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
"versionType": "git"
},
{
"lessThan": "44b5adfe49499f53002737f5fe81d608c08122fc",
"status": "affected",
"version": "e57b7901469fc0b021930b83a8094baaf3d81b09",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7915/mcu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy\n\nmt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver\u0027s\ndev-\u003emt76.eeprom.data buffer at the offset reported by the MCU response\n(res-\u003eaddr, a device-controlled __le32) without checking it against the\nbuffer size. A malicious or malfunctioning device can report an arbitrary\naddress and drive a 16-byte out-of-bounds write past eeprom.data.\n\nReject a response whose address would place the copy outside eeprom.data\nbefore deriving the destination pointer. Devices that echo the requested\nin-bounds offset are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The OOB write is driven by a MediaTek Wi-Fi 6 MCU EFUSE query response (mt7915/mt7916/mt7981/mt7986), not a routed IP service; the highest reasonable exposure is an adjacent attacker who can drive malicious firmware or device behavior on the local radio.\nAC:L - A malicious MCU response can set an arbitrary res-\u003eaddr and 16 device-controlled payload bytes; the host then memcpy\u0027s MT7915_EEPROM_BLOCK_SIZE bytes to eeprom.data+addr with no race or other condition beyond attacker control.\nPR:N - MCU EEPROM responses are consumed in mt7915_eeprom_load() during driver bring-up with no OS credential, capability, or Wi-Fi authentication check; an adjacent attacker needs no local account.\nUI:N - The copy runs automatically in mt7915_eeprom_load() during pci_probe/platform probe after firmware load; no victim action such as mounting a filesystem or opening a file is required.\nS:U - The write corrupts host kernel heap around the mt76 EEPROM buffer and is standard kernel memory corruption, not a VM escape, IOMMU bypass, or other crossed security authority.\nC:H - Attacker-controlled destination offset and payload are kernel memory corruption that can overwrite adjacent objects and pointers and be leveraged for information disclosure, so confidentiality impact is high.\nI:H - Sixteen bytes of device-controlled data are written at a device-chosen offset past the 3584/4096-byte eeprom.data allocation, an out-of-bounds write primitive that can yield arbitrary kernel writes or control-flow hijacking.\nA:H - An unbounded kernel heap write during EEPROM init can oops, panic, or hang the host, a high availability impact on Wi-Fi 6 APs, routers, and workstations."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:16.610Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d6774f6af3711143a93281904a928a78652c8b7e"
},
{
"url": "https://git.kernel.org/stable/c/394e8cb56fc732d71041599cdb4e01f82cfd11c5"
},
{
"url": "https://git.kernel.org/stable/c/5fdaf7016d7684ef756a229fd5d96b4a140eeb40"
},
{
"url": "https://git.kernel.org/stable/c/5f48b0d752a76590e2c613aae5345c2474627d1b"
},
{
"url": "https://git.kernel.org/stable/c/44b5adfe49499f53002737f5fe81d608c08122fc"
}
],
"title": "wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80937",
"datePublished": "2026-09-11T19:42:10.822Z",
"dateReserved": "2026-08-26T14:34:25.803Z",
"dateUpdated": "2026-10-21T12:47:16.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98407 (GCVE-0-2026-98407)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rsi: fix heap OOB write on key removal
When a key is removed (data == NULL), rsi_hal_load_key() runs:
memset(&set_key[FRAME_DESC_SZ], 0, frame_len - FRAME_DESC_SZ);
set_key is a struct rsi_set_key *, so the subscript is scaled by
sizeof(struct rsi_set_key) (160 bytes): &set_key[FRAME_DESC_SZ] is
skb->data + 2560, and the memset writes 144 zero bytes starting
2.4KB past the end of the 160-byte skb data buffer, corrupting
unrelated heap objects. The intended byte offset would have been
(u8 *)set_key + FRAME_DESC_SZ.
The write fires on every DISABLE_KEY callback, so plain disconnects,
roams and interface teardowns trigger it on real networks.
The memset is redundant: the whole buffer is zeroed right after
allocation, so the frame sent to the device is byte-identical
without it. Drop the else branch; normal operation is unaffected.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dad0d04fa7ba41ce603a01e8e64967650303e9a2 Version: dad0d04fa7ba41ce603a01e8e64967650303e9a2 Version: dad0d04fa7ba41ce603a01e8e64967650303e9a2 Version: dad0d04fa7ba41ce603a01e8e64967650303e9a2 Version: dad0d04fa7ba41ce603a01e8e64967650303e9a2 Version: dad0d04fa7ba41ce603a01e8e64967650303e9a2 Version: dad0d04fa7ba41ce603a01e8e64967650303e9a2 Version: dad0d04fa7ba41ce603a01e8e64967650303e9a2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/rsi/rsi_91x_mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b79e2f6585c014c42384f4caa7a37b3e5d26179c",
"status": "affected",
"version": "dad0d04fa7ba41ce603a01e8e64967650303e9a2",
"versionType": "git"
},
{
"lessThan": "c67fb3b875a83f9ba92afea4036c7b541f77512a",
"status": "affected",
"version": "dad0d04fa7ba41ce603a01e8e64967650303e9a2",
"versionType": "git"
},
{
"lessThan": "62d40db89180cfab7a917395f9ffc1dac62b0019",
"status": "affected",
"version": "dad0d04fa7ba41ce603a01e8e64967650303e9a2",
"versionType": "git"
},
{
"lessThan": "00bea3589255603c38766cac4a4d6d36493b2556",
"status": "affected",
"version": "dad0d04fa7ba41ce603a01e8e64967650303e9a2",
"versionType": "git"
},
{
"lessThan": "ac599cf8edf8aa2dae546f04d3f1849e32c2e738",
"status": "affected",
"version": "dad0d04fa7ba41ce603a01e8e64967650303e9a2",
"versionType": "git"
},
{
"lessThan": "f4f2852b664c3ff1436785cd11258a0ce25b74b3",
"status": "affected",
"version": "dad0d04fa7ba41ce603a01e8e64967650303e9a2",
"versionType": "git"
},
{
"lessThan": "8dab6ee020b2cd951b670626ba44a95cd4deac3d",
"status": "affected",
"version": "dad0d04fa7ba41ce603a01e8e64967650303e9a2",
"versionType": "git"
},
{
"lessThan": "e6c5ed7a98d7bc8b0f7918246f1c90ddb3f79dfa",
"status": "affected",
"version": "dad0d04fa7ba41ce603a01e8e64967650303e9a2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/rsi/rsi_91x_mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: fix heap OOB write on key removal\n\nWhen a key is removed (data == NULL), rsi_hal_load_key() runs:\n\n\tmemset(\u0026set_key[FRAME_DESC_SZ], 0, frame_len - FRAME_DESC_SZ);\n\nset_key is a struct rsi_set_key *, so the subscript is scaled by\nsizeof(struct rsi_set_key) (160 bytes): \u0026set_key[FRAME_DESC_SZ] is\nskb-\u003edata + 2560, and the memset writes 144 zero bytes starting\n2.4KB past the end of the 160-byte skb data buffer, corrupting\nunrelated heap objects. The intended byte offset would have been\n(u8 *)set_key + FRAME_DESC_SZ.\n\nThe write fires on every DISABLE_KEY callback, so plain disconnects,\nroams and interface teardowns trigger it on real networks.\n\nThe memset is redundant: the whole buffer is zeroed right after\nallocation, so the frame sent to the device is byte-identical\nwithout it. Drop the else branch; normal operation is unaffected.\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:00.454Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b79e2f6585c014c42384f4caa7a37b3e5d26179c"
},
{
"url": "https://git.kernel.org/stable/c/c67fb3b875a83f9ba92afea4036c7b541f77512a"
},
{
"url": "https://git.kernel.org/stable/c/62d40db89180cfab7a917395f9ffc1dac62b0019"
},
{
"url": "https://git.kernel.org/stable/c/00bea3589255603c38766cac4a4d6d36493b2556"
},
{
"url": "https://git.kernel.org/stable/c/ac599cf8edf8aa2dae546f04d3f1849e32c2e738"
},
{
"url": "https://git.kernel.org/stable/c/f4f2852b664c3ff1436785cd11258a0ce25b74b3"
},
{
"url": "https://git.kernel.org/stable/c/8dab6ee020b2cd951b670626ba44a95cd4deac3d"
},
{
"url": "https://git.kernel.org/stable/c/e6c5ed7a98d7bc8b0f7918246f1c90ddb3f79dfa"
}
],
"title": "wifi: rsi: fix heap OOB write on key removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98407",
"datePublished": "2026-10-14T13:27:41.799Z",
"dateReserved": "2026-09-25T10:25:14.347Z",
"dateUpdated": "2026-10-19T09:19:00.454Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98170 (GCVE-0-2026-98170)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
In move_smb2_ea_to_cifs(), the while (src_size > 0) loop condition is
insufficient. It allows iteration to continue even if the remaining
src_size is too small to contain a complete smb2_ea_info structure.
Consequently, reads of ea_name_length and ea_value_length can occur
out-of-bounds.
Fix this by ensuring src_size >= sizeof(*src) before attempting to read
any structure fields. Additionally, reject any next_entry_offset that is
smaller than sizeof(*src) or that would advance the pointer beyond the
available buffer.
Note that for calls where the server returns a malformed EA list, the
error returned to userspace changes from -ENODATA (getxattr) or
-ERANGE (listxattr) to -EIO. This correctly signals a server protocol
error rather than misleadingly indicating "attribute not present" or
"output buffer too small".
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c",
"fs/smb/client/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "61812323c037a94e2e7f0db7ee740c34b126bffe",
"status": "affected",
"version": "95907fea4fd8ccc736e0a428e52159b4d42b9958",
"versionType": "git"
},
{
"lessThan": "d3546cecbf81d98bf3b472d341f981eb48c04f47",
"status": "affected",
"version": "95907fea4fd8ccc736e0a428e52159b4d42b9958",
"versionType": "git"
},
{
"lessThan": "34a3942e787b9c59758115bd65fe1ec89d68c7a4",
"status": "affected",
"version": "95907fea4fd8ccc736e0a428e52159b4d42b9958",
"versionType": "git"
},
{
"lessThan": "13efcd37a9b3d6ffa1579c3dda3e29c893ed9bca",
"status": "affected",
"version": "95907fea4fd8ccc736e0a428e52159b4d42b9958",
"versionType": "git"
},
{
"lessThan": "eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb",
"status": "affected",
"version": "95907fea4fd8ccc736e0a428e52159b4d42b9958",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c",
"fs/smb/client/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()\n\nIn move_smb2_ea_to_cifs(), the while (src_size \u003e 0) loop condition is\ninsufficient. It allows iteration to continue even if the remaining\nsrc_size is too small to contain a complete smb2_ea_info structure.\nConsequently, reads of ea_name_length and ea_value_length can occur\nout-of-bounds.\n\nFix this by ensuring src_size \u003e= sizeof(*src) before attempting to read\nany structure fields. Additionally, reject any next_entry_offset that is\nsmaller than sizeof(*src) or that would advance the pointer beyond the\navailable buffer.\n\nNote that for calls where the server returns a malformed EA list, the\nerror returned to userspace changes from -ENODATA (getxattr) or\n-ERANGE (listxattr) to -EIO. This correctly signals a server protocol\nerror rather than misleadingly indicating \"attribute not present\" or\n\"output buffer too small\"."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:48.314Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/61812323c037a94e2e7f0db7ee740c34b126bffe"
},
{
"url": "https://git.kernel.org/stable/c/d3546cecbf81d98bf3b472d341f981eb48c04f47"
},
{
"url": "https://git.kernel.org/stable/c/34a3942e787b9c59758115bd65fe1ec89d68c7a4"
},
{
"url": "https://git.kernel.org/stable/c/13efcd37a9b3d6ffa1579c3dda3e29c893ed9bca"
},
{
"url": "https://git.kernel.org/stable/c/eeb5ef6083e1cefa2ef75041b5597ff228b8d7bb"
}
],
"title": "smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98170",
"datePublished": "2026-10-06T08:44:15.138Z",
"dateReserved": "2026-09-25T10:25:14.322Z",
"dateUpdated": "2026-10-21T12:54:48.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98283 (GCVE-0-2026-98283)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops
mmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a
reference on the kvm_nested_guest pointer obtained from the IDR. A
concurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race
through kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove /
--refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving
the iterating vCPU with a dangling pointer. The subsequent
mutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable,
gp->shadow_lpid and gp->l1_host all touch freed memory. The free path
is fully L1-controlled.
Fix this by incrementing gp->refcnt inside the loop before dropping
mmu_lock, mirroring what kvmhv_get_nested() does, and releasing the
reference with kvmhv_put_nested() after the per-guest work completes.
This is the same get/put discipline already used at every other
call site that drops mmu_lock while holding a nested-guest pointer.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e3b6b4661527e821ffbe3db83952fdb1e6e47c49 Version: e3b6b4661527e821ffbe3db83952fdb1e6e47c49 Version: e3b6b4661527e821ffbe3db83952fdb1e6e47c49 Version: e3b6b4661527e821ffbe3db83952fdb1e6e47c49 Version: e3b6b4661527e821ffbe3db83952fdb1e6e47c49 Version: e3b6b4661527e821ffbe3db83952fdb1e6e47c49 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/powerpc/kvm/book3s_hv_nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4d8f7b1f586375df8bce23a0909566ad5e852259",
"status": "affected",
"version": "e3b6b4661527e821ffbe3db83952fdb1e6e47c49",
"versionType": "git"
},
{
"lessThan": "e37fba1ba69385cff2d0e60b371ee19e7d1852d1",
"status": "affected",
"version": "e3b6b4661527e821ffbe3db83952fdb1e6e47c49",
"versionType": "git"
},
{
"lessThan": "24b634852413229bb8340d908b115c3365f3a247",
"status": "affected",
"version": "e3b6b4661527e821ffbe3db83952fdb1e6e47c49",
"versionType": "git"
},
{
"lessThan": "fbf69b7d0555ee83c871f58750770f74b7179ad1",
"status": "affected",
"version": "e3b6b4661527e821ffbe3db83952fdb1e6e47c49",
"versionType": "git"
},
{
"lessThan": "ec2d7a52b3996ae81131617b4afc0af31583c1b4",
"status": "affected",
"version": "e3b6b4661527e821ffbe3db83952fdb1e6e47c49",
"versionType": "git"
},
{
"lessThan": "51938dfa8a51a4f85328413fca9b6e21f9d2d088",
"status": "affected",
"version": "e3b6b4661527e821ffbe3db83952fdb1e6e47c49",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/powerpc/kvm/book3s_hv_nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()\n\nkvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops\nmmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a\nreference on the kvm_nested_guest pointer obtained from the IDR. A\nconcurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race\nthrough kvmhv_flush_nested() -\u003e kvmhv_remove_nested() -\u003e idr_remove /\n--refcnt -\u003e kvmhv_release_nested() -\u003e kfree(gp) in that window, leaving\nthe iterating vCPU with a dangling pointer. The subsequent\nmutex_lock(\u0026gp-\u003etlb_lock) and accesses to gp-\u003eshadow_pgtable,\ngp-\u003eshadow_lpid and gp-\u003el1_host all touch freed memory. The free path\nis fully L1-controlled.\n\nFix this by incrementing gp-\u003erefcnt inside the loop before dropping\nmmu_lock, mirroring what kvmhv_get_nested() does, and releasing the\nreference with kvmhv_put_nested() after the per-guest work completes.\nThis is the same get/put discipline already used at every other\ncall site that drops mmu_lock while holding a nested-guest pointer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The trigger is the H_TLB_INVALIDATE hcall made by code running inside an L1 guest on the POWER KVM-HV host, via kvmppc_pseries_do_hcall -\u003e kvmhv_do_nested_tlbie -\u003e kvmhv_emulate_priv_tlbie -\u003e kvmhv_emulate_tlbie_all_lpid. No network protocol carries the input; the attacker needs code execution in a local guest.\nAC:L - The L1 controls both sides of the race: one vCPU issues tlbie is=3 (all-LPID walk), another issues is=2 ric=2 after zeroing its own partition-table entry so kvmhv_flush_nested() calls kvmhv_remove_nested() and kfree(gp). Contention on gp-\u003etlb_lock widens the window and the attempt can be repeated. The only outside requirement is the VMM enabling KVM_CAP_PPC_NESTED_HV.\nPR:L - The attacker needs kernel/hypervisor-mode code in a nested-enabled L1 guest, which an ordinary tenant owns, but holds no privilege on the L0 host. The nesting_enabled() check is the only gate before kvmhv_do_nested_tlbie().\nUI:N - The L1 guest issues every hcall and controls every partition-table entry involved. No host operator or other user has to do anything.\nS:C - A guest-controlled vulnerability corrupts memory in the L0 host kernel (the kfree\u0027d kvm_nested_guest object), which crosses the guest-to-host boundary.\nC:H - After the free, kvmhv_emulate_tlbie_lpid() reads gp-\u003eshadow_pgtable, gp-\u003eshadow_lpid and gp-\u003el1_host from the dangling object. A reclaimed object lets the guest steer host page-table walks and host data reads.\nI:H - The freed gp is used for mutex_lock(\u0026gp-\u003etlb_lock), kvmppc_free_pgtable_radix() on gp-\u003eshadow_pgtable, and kvmhv_flush_nested()/kvmhv_put_nested() refcount writes. With a reclaimed object, these become host-kernel write and free primitives the guest controls.\nA:H - Using the freed kvm_nested_guest in the host can oops or panic the L0 host kernel, taking down every guest on the machine. The L1 can trigger it again at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:54.747Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4d8f7b1f586375df8bce23a0909566ad5e852259"
},
{
"url": "https://git.kernel.org/stable/c/e37fba1ba69385cff2d0e60b371ee19e7d1852d1"
},
{
"url": "https://git.kernel.org/stable/c/24b634852413229bb8340d908b115c3365f3a247"
},
{
"url": "https://git.kernel.org/stable/c/fbf69b7d0555ee83c871f58750770f74b7179ad1"
},
{
"url": "https://git.kernel.org/stable/c/ec2d7a52b3996ae81131617b4afc0af31583c1b4"
},
{
"url": "https://git.kernel.org/stable/c/51938dfa8a51a4f85328413fca9b6e21f9d2d088"
}
],
"title": "KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98283",
"datePublished": "2026-10-06T08:45:44.593Z",
"dateReserved": "2026-09-25T10:25:14.335Z",
"dateUpdated": "2026-10-19T09:16:54.747Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98411 (GCVE-0-2026-98411)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()
If dev_set_name() fails in pwrseq_device_register(), we jump to the
err_put_pwrseq label before initializing pwrseq->targets.
pwrseq_release() will try to iterate over targets unconditionally and
subsequently dereference an invalid pointer. Move the call to
dev_set_name() after the list head is initialized.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/sequencing/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a2fb51ec8920279e9e908010f37b448775f42eff",
"status": "affected",
"version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
"versionType": "git"
},
{
"lessThan": "a2890c1eb96d1dd0bec1cce5fbc4ed5af1dfd55d",
"status": "affected",
"version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
"versionType": "git"
},
{
"lessThan": "efe21a5c5bfe23bd30a8e4ba4e2b04ae265348bb",
"status": "affected",
"version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
"versionType": "git"
},
{
"lessThan": "242da4318d97380741516b595af3920207b2f0f1",
"status": "affected",
"version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/sequencing/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: sequencing: fix NULL-pointer dereference in pwrseq_device_register()\n\nIf dev_set_name() fails in pwrseq_device_register(), we jump to the\nerr_put_pwrseq label before initializing pwrseq-\u003etargets.\npwrseq_release() will try to iterate over targets unconditionally and\nsubsequently dereference an invalid pointer. Move the call to\ndev_set_name() after the list head is initialized."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:05.338Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a2fb51ec8920279e9e908010f37b448775f42eff"
},
{
"url": "https://git.kernel.org/stable/c/a2890c1eb96d1dd0bec1cce5fbc4ed5af1dfd55d"
},
{
"url": "https://git.kernel.org/stable/c/efe21a5c5bfe23bd30a8e4ba4e2b04ae265348bb"
},
{
"url": "https://git.kernel.org/stable/c/242da4318d97380741516b595af3920207b2f0f1"
}
],
"title": "power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98411",
"datePublished": "2026-10-14T13:27:44.175Z",
"dateReserved": "2026-09-25T10:25:14.347Z",
"dateUpdated": "2026-10-19T09:19:05.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98272 (GCVE-0-2026-98272)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: prevent buffer overflow in page_pool allocation
The per‑processor buffering scheme is supported only if the
number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS (8).
This is already checked in mvpp2_probe() during the initial
activation of percpu_pools.
However, mvpp2_change_mtu() may later call
mvpp2_bm_switch_buffers(priv, true) without this check, which can
lead to an out-of-bounds access in the priv->page_pool array in
mvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ
entries, and mvpp2_get_nrxqs() may return exactly that value. The
per-CPU scheme then doubles it to nrxqs * 2, exceeding the array
bounds.
Check that the hardware version is MVPP22 or newer and that the
number of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS
before switching to per-CPU mode.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f Version: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f Version: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f Version: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f Version: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f Version: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f Version: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f Version: 7d04b0b13b1175ce0c4bdc77f1278c1f120f874f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c",
"status": "affected",
"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
"versionType": "git"
},
{
"lessThan": "4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545",
"status": "affected",
"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
"versionType": "git"
},
{
"lessThan": "dfd46b5584a5881b131008767950e1ab82713c8c",
"status": "affected",
"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
"versionType": "git"
},
{
"lessThan": "6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0",
"status": "affected",
"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
"versionType": "git"
},
{
"lessThan": "e7f30dcfa6c64033bf9137362517bd248e5be384",
"status": "affected",
"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
"versionType": "git"
},
{
"lessThan": "f0e7d62c1eb984dd204095118973c59604144cd8",
"status": "affected",
"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
"versionType": "git"
},
{
"lessThan": "1734c3fc0066e228ce1c11e434b7c2527f0a949a",
"status": "affected",
"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
"versionType": "git"
},
{
"lessThan": "14cb1e7702e5cb3c58888f6aed498381a73927d2",
"status": "affected",
"version": "7d04b0b13b1175ce0c4bdc77f1278c1f120f874f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: prevent buffer overflow in page_pool allocation\n\nThe per\u2011processor buffering scheme is supported only if the\nnumber of pools (nrxqs\u202f*\u202f2) does not exceed MVPP2_BM_MAX_POOLS (8).\nThis is already checked in mvpp2_probe() during the initial\nactivation of percpu_pools.\n\nHowever, mvpp2_change_mtu() may later call\nmvpp2_bm_switch_buffers(priv, true) without this check, which can\nlead to an out-of-bounds access in the priv-\u003epage_pool array in\nmvpp2_bm_init(). The array is sized to hold MVPP2_PORT_MAX_RXQ\nentries, and mvpp2_get_nrxqs() may return exactly that value. The\nper-CPU scheme then doubles it to nrxqs * 2, exceeding the array\nbounds.\n\nCheck that the hardware version is MVPP22 or newer and that the\nnumber of pools (nrxqs * 2) does not exceed MVPP2_BM_MAX_POOLS\nbefore switching to per-CPU mode.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:44.017Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5cefdb7acfc646fbded59ae77dfe0aac4c9e4a3c"
},
{
"url": "https://git.kernel.org/stable/c/4ac1d5adc4f4dbafbfd270b55cc6d8bf9849d545"
},
{
"url": "https://git.kernel.org/stable/c/dfd46b5584a5881b131008767950e1ab82713c8c"
},
{
"url": "https://git.kernel.org/stable/c/6569fd85b0ef9a8a6f20b7eb868420b8c7c0c2a0"
},
{
"url": "https://git.kernel.org/stable/c/e7f30dcfa6c64033bf9137362517bd248e5be384"
},
{
"url": "https://git.kernel.org/stable/c/f0e7d62c1eb984dd204095118973c59604144cd8"
},
{
"url": "https://git.kernel.org/stable/c/1734c3fc0066e228ce1c11e434b7c2527f0a949a"
},
{
"url": "https://git.kernel.org/stable/c/14cb1e7702e5cb3c58888f6aed498381a73927d2"
}
],
"title": "net: mvpp2: prevent buffer overflow in page_pool allocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98272",
"datePublished": "2026-10-06T08:45:33.974Z",
"dateReserved": "2026-09-25T10:25:14.333Z",
"dateUpdated": "2026-10-19T09:16:44.017Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98291 (GCVE-0-2026-98291)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit
btintel_pcie_submit_rx() used frbd_index > rxq->count to guard the
FRBD array access, allowing frbd_index == rxq->count to pass through
and index one element past the end of the array. Change the check to
>= rxq->count so every out-of-range index is rejected.
This issue was reported by Claude Mythos.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btintel_pcie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b5214d72bfdf8ef7744d0c8147e6ebb09b36b259",
"status": "affected",
"version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e",
"versionType": "git"
},
{
"lessThan": "18464860ce27af0dccd2fc72830610b85b518cff",
"status": "affected",
"version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e",
"versionType": "git"
},
{
"lessThan": "de4c3c72bcc6e8474f70c22427f94ca44bccd890",
"status": "affected",
"version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e",
"versionType": "git"
},
{
"lessThan": "2ea5a87a5a7ae58cb2662b8a7d06f209383e1765",
"status": "affected",
"version": "c2b636b3f788d10486a6691ad6dd3ec4c93bd78e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btintel_pcie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel_pcie: fix off-by-one bounds check in RX submit\n\nbtintel_pcie_submit_rx() used frbd_index \u003e rxq-\u003ecount to guard the\nFRBD array access, allowing frbd_index == rxq-\u003ecount to pass through\nand index one element past the end of the array. Change the check to\n\u003e= rxq-\u003ecount so every out-of-range index is rejected.\n\nThis issue was reported by Claude Mythos."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:02.456Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b5214d72bfdf8ef7744d0c8147e6ebb09b36b259"
},
{
"url": "https://git.kernel.org/stable/c/18464860ce27af0dccd2fc72830610b85b518cff"
},
{
"url": "https://git.kernel.org/stable/c/de4c3c72bcc6e8474f70c22427f94ca44bccd890"
},
{
"url": "https://git.kernel.org/stable/c/2ea5a87a5a7ae58cb2662b8a7d06f209383e1765"
}
],
"title": "Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98291",
"datePublished": "2026-10-06T08:45:51.021Z",
"dateReserved": "2026-09-25T10:25:14.336Z",
"dateUpdated": "2026-10-19T09:17:02.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98326 (GCVE-0-2026-98326)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: mesh: release the channel if start fails
ieee80211_join_mesh() acquires a channel context and then calls
ieee80211_start_mesh(), which can fail. In that case, the chanctx
isn't released then interface removal will attempt to unassign it
after it's removed from the driver, hitting:
wlan0: Failed check-sdata-in-driver check, flags: 0x0
WARNING: net/mac80211/driver-ops.c:366 at drv_unassign_vif_chanctx
ieee80211_assign_link_chanctx
__ieee80211_link_release_channel
ieee80211_link_release_channel
ieee80211_teardown_sdata
unregister_netdevice_many_notify
_cfg80211_unregister_wdev
ieee80211_remove_interfaces
ieee80211_unregister_hw
mac80211_hwsim_del_radio
hwsim_exit_net
Correctly release the channel on start failures.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2b5e19677592c167d012c2d129407f39d2bdeb8d Version: 2b5e19677592c167d012c2d129407f39d2bdeb8d Version: 2b5e19677592c167d012c2d129407f39d2bdeb8d Version: 2b5e19677592c167d012c2d129407f39d2bdeb8d Version: 2b5e19677592c167d012c2d129407f39d2bdeb8d Version: 2b5e19677592c167d012c2d129407f39d2bdeb8d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/cfg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f0afcec2129c166e61821d6ae097061155f01b12",
"status": "affected",
"version": "2b5e19677592c167d012c2d129407f39d2bdeb8d",
"versionType": "git"
},
{
"lessThan": "b51f5a310bd6888b90bb9546a8081215dcfe6fbe",
"status": "affected",
"version": "2b5e19677592c167d012c2d129407f39d2bdeb8d",
"versionType": "git"
},
{
"lessThan": "632f7acfe6dac1278a9314eaaab14fada400ddaf",
"status": "affected",
"version": "2b5e19677592c167d012c2d129407f39d2bdeb8d",
"versionType": "git"
},
{
"lessThan": "41bee71112db53651ba9a9030de1b843255a4a7f",
"status": "affected",
"version": "2b5e19677592c167d012c2d129407f39d2bdeb8d",
"versionType": "git"
},
{
"lessThan": "4a4e3fa77ea36d3419d806fb5883ef425a605a5d",
"status": "affected",
"version": "2b5e19677592c167d012c2d129407f39d2bdeb8d",
"versionType": "git"
},
{
"lessThan": "ae97fff6495a8764bc0ef281cfe5444f701e527f",
"status": "affected",
"version": "2b5e19677592c167d012c2d129407f39d2bdeb8d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/cfg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: mesh: release the channel if start fails\n\nieee80211_join_mesh() acquires a channel context and then calls\nieee80211_start_mesh(), which can fail. In that case, the chanctx\nisn\u0027t released then interface removal will attempt to unassign it\nafter it\u0027s removed from the driver, hitting:\n\n wlan0: Failed check-sdata-in-driver check, flags: 0x0\n WARNING: net/mac80211/driver-ops.c:366 at drv_unassign_vif_chanctx\n ieee80211_assign_link_chanctx\n __ieee80211_link_release_channel\n ieee80211_link_release_channel\n ieee80211_teardown_sdata\n unregister_netdevice_many_notify\n _cfg80211_unregister_wdev\n ieee80211_remove_interfaces\n ieee80211_unregister_hw\n mac80211_hwsim_del_radio\n hwsim_exit_net\n\nCorrectly release the channel on start failures."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:36.726Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f0afcec2129c166e61821d6ae097061155f01b12"
},
{
"url": "https://git.kernel.org/stable/c/b51f5a310bd6888b90bb9546a8081215dcfe6fbe"
},
{
"url": "https://git.kernel.org/stable/c/632f7acfe6dac1278a9314eaaab14fada400ddaf"
},
{
"url": "https://git.kernel.org/stable/c/41bee71112db53651ba9a9030de1b843255a4a7f"
},
{
"url": "https://git.kernel.org/stable/c/4a4e3fa77ea36d3419d806fb5883ef425a605a5d"
},
{
"url": "https://git.kernel.org/stable/c/ae97fff6495a8764bc0ef281cfe5444f701e527f"
}
],
"title": "wifi: mac80211: mesh: release the channel if start fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98326",
"datePublished": "2026-10-06T08:46:19.534Z",
"dateReserved": "2026-09-25T10:25:14.340Z",
"dateUpdated": "2026-10-19T09:17:36.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98425 (GCVE-0-2026-98425)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't warn when an IBSS has no channel to scan
ieee80211_request_ibss_scan() warns when regulatory leaves no
allowed channel, but that can happen as the regdomain can change
while IBSS is operating, and it can continue to operate briefly
during the 60s grace period until it's shut down.
Just remove the warning in this case.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 34bcf71502413f8903ade93746f2d0f04b937a78 Version: 34bcf71502413f8903ade93746f2d0f04b937a78 Version: 34bcf71502413f8903ade93746f2d0f04b937a78 Version: 34bcf71502413f8903ade93746f2d0f04b937a78 Version: 5ca99e71a9a6cf33a217690f5d87bc0129d1effd Version: 1cf18948040a40fa4497e40bcde2ffa8d6b1196e Version: 3.4.26 ≤ Version: 3.7.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb91c15953705445778c170a2523f12351c4d928",
"status": "affected",
"version": "34bcf71502413f8903ade93746f2d0f04b937a78",
"versionType": "git"
},
{
"lessThan": "5f139e17f5bdba6b68177dd8afe13fa4549dfc5f",
"status": "affected",
"version": "34bcf71502413f8903ade93746f2d0f04b937a78",
"versionType": "git"
},
{
"lessThan": "23d51c0bc18f21d957756ba4650520bb3bc726b2",
"status": "affected",
"version": "34bcf71502413f8903ade93746f2d0f04b937a78",
"versionType": "git"
},
{
"lessThan": "a7491b7efbd9136b120a12ed72af9c12121dd134",
"status": "affected",
"version": "34bcf71502413f8903ade93746f2d0f04b937a78",
"versionType": "git"
},
{
"status": "affected",
"version": "5ca99e71a9a6cf33a217690f5d87bc0129d1effd",
"versionType": "git"
},
{
"status": "affected",
"version": "1cf18948040a40fa4497e40bcde2ffa8d6b1196e",
"versionType": "git"
},
{
"lessThan": "3.5",
"status": "affected",
"version": "3.4.26",
"versionType": "semver"
},
{
"lessThan": "3.8",
"status": "affected",
"version": "3.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.4.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0027t warn when an IBSS has no channel to scan\n\nieee80211_request_ibss_scan() warns when regulatory leaves no\nallowed channel, but that can happen as the regdomain can change\nwhile IBSS is operating, and it can continue to operate briefly\nduring the 60s grace period until it\u0027s shut down.\n\nJust remove the warning in this case."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:19.012Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb91c15953705445778c170a2523f12351c4d928"
},
{
"url": "https://git.kernel.org/stable/c/5f139e17f5bdba6b68177dd8afe13fa4549dfc5f"
},
{
"url": "https://git.kernel.org/stable/c/23d51c0bc18f21d957756ba4650520bb3bc726b2"
},
{
"url": "https://git.kernel.org/stable/c/a7491b7efbd9136b120a12ed72af9c12121dd134"
}
],
"title": "wifi: mac80211: don\u0027t warn when an IBSS has no channel to scan",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98425",
"datePublished": "2026-10-14T13:27:52.569Z",
"dateReserved": "2026-09-25T10:25:14.348Z",
"dateUpdated": "2026-10-19T09:19:19.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89996 (GCVE-0-2026-89996)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
DMA_HEAP_IOCTL_ALLOC allocates a dma-buf and installs an fd into the
caller's fd table via dma_buf_fd() -> fd_install() before
dma_heap_ioctl() copies the result back to userspace. If the trailing
copy_to_user() fails, userspace never learns the fd number, but the
fd (and the underlying dma-buf reference) are already visible to
other threads in the same process and are leaked for the lifetime of
the process.
The obvious "close it on the failure path" fix is unsafe: once
fd_install() has run, another thread can already dup() the fd, send
it via SCM_RIGHTS, or close() it and let its number be reused, so a
subsequent close_fd() from the ioctl path can operate on an unrelated
file. This was pointed out by Christian König on v1 [1].
Restructure the allocation path so that fd_install() is the last,
unfailable step of a successful ioctl:
1. heap->ops->allocate() creates the dma_buf.
2. get_unused_fd_flags() reserves an fd number in the caller's
fd table without publishing it, so
no other thread can observe it.
3. copy_to_user() delivers the fd number to userspace;
on failure the fd is returned with
put_unused_fd() and the dma_buf
reference is dropped with
dma_buf_put(), leaving no user-
visible state behind.
4. dma_buf_fd_install() publishes the fd and emits the
trace_dma_buf_fd tracepoint -- from
here on the ioctl cannot fail.
A new dma_buf_fd_install() helper is introduced in dma-buf.c to wrap
fd_install() together with the DMA_BUF_TRACE() call, preserving the
export tracing that dma_buf_fd() provides. dma_heap_ioctl_allocate()
is refactored to return the struct dma_buf * directly (returning
ERR_PTR on failure) so the caller holds the dmabuf reference across
steps 3 and 4.
The failure at step 3 is easily reachable from userspace: pass a
struct dma_heap_allocation_data that lives in a page whose protection
is flipped to PROT_READ between copy_from_user() and copy_to_user()
(e.g. via mprotect()). Before this change each such ioctl leaks one
dmabuf fd; after it, the fd table is unchanged on failure and only
/dev/dma_heap/<name> remains open.
No UAPI or heap-driver interface change.
[1] https://lore.kernel.org/dri-devel/175e98de-f414-47d7-81c1-c0fe0a8f7f62@amd.com/
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma-buf/dma-buf.c",
"drivers/dma-buf/dma-heap.c",
"include/linux/dma-buf.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ad61defb3e66ac0c598ad6f39b57f15784543d46",
"status": "affected",
"version": "c02a81fba74fe3488ad6b08bfb5a1329005418f8",
"versionType": "git"
},
{
"lessThan": "1bf6083a41f810d760c4dcd1b80c5194a92575aa",
"status": "affected",
"version": "c02a81fba74fe3488ad6b08bfb5a1329005418f8",
"versionType": "git"
},
{
"lessThan": "69d57dbadb27ffd5eef34fd184bab145500cdabc",
"status": "affected",
"version": "c02a81fba74fe3488ad6b08bfb5a1329005418f8",
"versionType": "git"
},
{
"lessThan": "0d4a5d218055db29b50cc07d3d73d27007c2a391",
"status": "affected",
"version": "c02a81fba74fe3488ad6b08bfb5a1329005418f8",
"versionType": "git"
},
{
"lessThan": "30d0aff2c65a277135cfd8ea28fa1ee75e0ea4e0",
"status": "affected",
"version": "c02a81fba74fe3488ad6b08bfb5a1329005418f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma-buf/dma-buf.c",
"drivers/dma-buf/dma-heap.c",
"include/linux/dma-buf.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf: dma-heap: don\u0027t publish fd before copy_to_user() succeeds\n\nDMA_HEAP_IOCTL_ALLOC allocates a dma-buf and installs an fd into the\ncaller\u0027s fd table via dma_buf_fd() -\u003e fd_install() before\ndma_heap_ioctl() copies the result back to userspace. If the trailing\ncopy_to_user() fails, userspace never learns the fd number, but the\nfd (and the underlying dma-buf reference) are already visible to\nother threads in the same process and are leaked for the lifetime of\nthe process.\n\nThe obvious \"close it on the failure path\" fix is unsafe: once\nfd_install() has run, another thread can already dup() the fd, send\nit via SCM_RIGHTS, or close() it and let its number be reused, so a\nsubsequent close_fd() from the ioctl path can operate on an unrelated\nfile. This was pointed out by Christian K\u00f6nig on v1 [1].\n\nRestructure the allocation path so that fd_install() is the last,\nunfailable step of a successful ioctl:\n\n 1. heap-\u003eops-\u003eallocate() creates the dma_buf.\n 2. get_unused_fd_flags() reserves an fd number in the caller\u0027s\n fd table without publishing it, so\n no other thread can observe it.\n 3. copy_to_user() delivers the fd number to userspace;\n on failure the fd is returned with\n put_unused_fd() and the dma_buf\n reference is dropped with\n dma_buf_put(), leaving no user-\n visible state behind.\n 4. dma_buf_fd_install() publishes the fd and emits the\n trace_dma_buf_fd tracepoint -- from\n here on the ioctl cannot fail.\n\nA new dma_buf_fd_install() helper is introduced in dma-buf.c to wrap\nfd_install() together with the DMA_BUF_TRACE() call, preserving the\nexport tracing that dma_buf_fd() provides. dma_heap_ioctl_allocate()\nis refactored to return the struct dma_buf * directly (returning\nERR_PTR on failure) so the caller holds the dmabuf reference across\nsteps 3 and 4.\n\nThe failure at step 3 is easily reachable from userspace: pass a\nstruct dma_heap_allocation_data that lives in a page whose protection\nis flipped to PROT_READ between copy_from_user() and copy_to_user()\n(e.g. via mprotect()). Before this change each such ioctl leaks one\ndmabuf fd; after it, the fd table is unchanged on failure and only\n/dev/dma_heap/\u003cname\u003e remains open.\n\nNo UAPI or heap-driver interface change.\n\n[1] https://lore.kernel.org/dri-devel/175e98de-f414-47d7-81c1-c0fe0a8f7f62@amd.com/"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:22.023Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ad61defb3e66ac0c598ad6f39b57f15784543d46"
},
{
"url": "https://git.kernel.org/stable/c/1bf6083a41f810d760c4dcd1b80c5194a92575aa"
},
{
"url": "https://git.kernel.org/stable/c/69d57dbadb27ffd5eef34fd184bab145500cdabc"
},
{
"url": "https://git.kernel.org/stable/c/0d4a5d218055db29b50cc07d3d73d27007c2a391"
},
{
"url": "https://git.kernel.org/stable/c/30d0aff2c65a277135cfd8ea28fa1ee75e0ea4e0"
}
],
"title": "dma-buf: dma-heap: don\u0027t publish fd before copy_to_user() succeeds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89996",
"datePublished": "2026-09-16T10:33:08.620Z",
"dateReserved": "2026-09-11T19:38:34.780Z",
"dateUpdated": "2026-10-21T12:49:22.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98202 (GCVE-0-2026-98202)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
Transport drivers (such as rmi_i2c and rmi_spi) invoke
rmi_driver_suspend() and rmi_driver_resume() on their child rmi_dev
device during system power management events. However, transport drivers
are fully registered and operational even if the physical RMI driver
failed to bind or probe the rmi_dev device.
When rmi_driver_suspend() or rmi_driver_resume() is called on an unbound
rmi_dev, dev_get_drvdata() returns NULL. Calling rmi_disable_irq() or
rmi_enable_irq() without driver data attached causes a NULL pointer
dereference and General Protection Fault when attempting to lock
data->enabled_mutex.
Fix this by checking if driver data is attached to rmi_dev in
rmi_driver_suspend() and rmi_driver_resume(), exiting early if
no driver data is present.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56 Version: 2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56 Version: 2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56 Version: 2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56 Version: 2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56 Version: 2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56 Version: 2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56 Version: 2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_driver.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a3d7c68aa36f68e2a4824da4782c0e5d7c4eba4",
"status": "affected",
"version": "2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56",
"versionType": "git"
},
{
"lessThan": "fafca210631d8c2d4311bdfccc5ec46b9fe65977",
"status": "affected",
"version": "2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56",
"versionType": "git"
},
{
"lessThan": "84145a4a1dc58f8959811913c5f61f3235dd9f6c",
"status": "affected",
"version": "2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56",
"versionType": "git"
},
{
"lessThan": "e2b6703465c1ce43edb91c1626604b7092b3c431",
"status": "affected",
"version": "2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56",
"versionType": "git"
},
{
"lessThan": "30366f507ce3e408caf7f7375bb343df54b9a4f9",
"status": "affected",
"version": "2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56",
"versionType": "git"
},
{
"lessThan": "fa1713dc3d43d028d6cb66e5659d9d7e83b73362",
"status": "affected",
"version": "2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56",
"versionType": "git"
},
{
"lessThan": "942b06a19252908d0f952c0590caf20e47f88252",
"status": "affected",
"version": "2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56",
"versionType": "git"
},
{
"lessThan": "fe10579b6dc3f0dac61e51e1797cacbba5039ac2",
"status": "affected",
"version": "2b6a321da9a2d8725a1d3dbb0b2e96a7618ebe56",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_driver.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: synaptics-rmi4 - fix GPF in suspend and resume when unbound\n\nTransport drivers (such as rmi_i2c and rmi_spi) invoke\nrmi_driver_suspend() and rmi_driver_resume() on their child rmi_dev\ndevice during system power management events. However, transport drivers\nare fully registered and operational even if the physical RMI driver\nfailed to bind or probe the rmi_dev device.\n\nWhen rmi_driver_suspend() or rmi_driver_resume() is called on an unbound\nrmi_dev, dev_get_drvdata() returns NULL. Calling rmi_disable_irq() or\nrmi_enable_irq() without driver data attached causes a NULL pointer\ndereference and General Protection Fault when attempting to lock\ndata-\u003eenabled_mutex.\n\nFix this by checking if driver data is attached to rmi_dev in\nrmi_driver_suspend() and rmi_driver_resume(), exiting early if\nno driver data is present."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:33.226Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a3d7c68aa36f68e2a4824da4782c0e5d7c4eba4"
},
{
"url": "https://git.kernel.org/stable/c/fafca210631d8c2d4311bdfccc5ec46b9fe65977"
},
{
"url": "https://git.kernel.org/stable/c/84145a4a1dc58f8959811913c5f61f3235dd9f6c"
},
{
"url": "https://git.kernel.org/stable/c/e2b6703465c1ce43edb91c1626604b7092b3c431"
},
{
"url": "https://git.kernel.org/stable/c/30366f507ce3e408caf7f7375bb343df54b9a4f9"
},
{
"url": "https://git.kernel.org/stable/c/fa1713dc3d43d028d6cb66e5659d9d7e83b73362"
},
{
"url": "https://git.kernel.org/stable/c/942b06a19252908d0f952c0590caf20e47f88252"
},
{
"url": "https://git.kernel.org/stable/c/fe10579b6dc3f0dac61e51e1797cacbba5039ac2"
}
],
"title": "Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98202",
"datePublished": "2026-10-06T08:44:40.045Z",
"dateReserved": "2026-09-25T10:25:14.324Z",
"dateUpdated": "2026-10-19T09:15:33.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93196 (GCVE-0-2026-93196)
Vulnerability from cvelistv5
Published
2026-09-17 16:12
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvdimm: virtio_pmem: refcount requests for token lifetime
KASAN reports slab-use-after-free in __wake_up_common():
BUG: KASAN: slab-use-after-free in __wake_up_common+0x114/0x160
Read of size 8 at addr ffff88810fdcb710 by task swapper/0/0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted
6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux
1.17.0-2-2 04/01/2014
Call Trace:
<IRQ>
dump_stack_lvl+0x6d/0xb0
print_report+0x170/0x4e2
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? __virt_addr_valid+0x1dc/0x380
kasan_report+0xbc/0xf0
? __wake_up_common+0x114/0x160
? __wake_up_common+0x114/0x160
__wake_up_common+0x114/0x160
? __pfx__raw_spin_lock_irqsave+0x10/0x10
__wake_up+0x36/0x60
virtio_pmem_host_ack+0x11d/0x3b0
? sched_balance_domains+0x29f/0xb00
? __pfx_virtio_pmem_host_ack+0x10/0x10
? _raw_spin_lock_irqsave+0x98/0x100
? __pfx__raw_spin_lock_irqsave+0x10/0x10
vring_interrupt+0x1c9/0x5e0
? __pfx_vp_interrupt+0x10/0x10
vp_vring_interrupt+0x87/0x100
? __pfx_vp_interrupt+0x10/0x10
__handle_irq_event_percpu+0x17f/0x550
? __pfx__raw_spin_lock+0x10/0x10
handle_irq_event+0xab/0x1c0
handle_fasteoi_irq+0x276/0xae0
__common_interrupt+0x65/0x130
common_interrupt+0x78/0xa0
</IRQ>
virtio_pmem_host_ack() wakes a request that has already been freed by the
submitter.
This happens when the request token is still reachable via the virtqueue,
but virtio_pmem_flush() returns and frees it.
Fix the token lifetime by refcounting struct virtio_pmem_request.
virtio_pmem_flush() holds a submitter reference, and the virtqueue holds an
extra reference once the request is queued. The completion path drops the
virtqueue reference, and the submitter drops its reference before
returning.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/nd_virtio.c",
"drivers/nvdimm/virtio_pmem.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "41b2025709ec104a07d15540399809ae5851246e",
"status": "affected",
"version": "6e84200c0a2994b991259d19450eee561029bf70",
"versionType": "git"
},
{
"lessThan": "4691c137e9cbe76137d730a26d663d900ac7279b",
"status": "affected",
"version": "6e84200c0a2994b991259d19450eee561029bf70",
"versionType": "git"
},
{
"lessThan": "be072a5d5e35f4bdf2da22f600b5d6dc6c5ff491",
"status": "affected",
"version": "6e84200c0a2994b991259d19450eee561029bf70",
"versionType": "git"
},
{
"lessThan": "b1e740b9156621afd4c4aa66257f4dde8df1febe",
"status": "affected",
"version": "6e84200c0a2994b991259d19450eee561029bf70",
"versionType": "git"
},
{
"lessThan": "e57140944b5a47a7fd5a142faab29a02af040bc8",
"status": "affected",
"version": "6e84200c0a2994b991259d19450eee561029bf70",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/nd_virtio.c",
"drivers/nvdimm/virtio_pmem.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: virtio_pmem: refcount requests for token lifetime\n\nKASAN reports slab-use-after-free in __wake_up_common():\nBUG: KASAN: slab-use-after-free in __wake_up_common+0x114/0x160\nRead of size 8 at addr ffff88810fdcb710 by task swapper/0/0\n\nCPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted\n6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux\n1.17.0-2-2 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x6d/0xb0\n print_report+0x170/0x4e2\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __virt_addr_valid+0x1dc/0x380\n kasan_report+0xbc/0xf0\n ? __wake_up_common+0x114/0x160\n ? __wake_up_common+0x114/0x160\n __wake_up_common+0x114/0x160\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n __wake_up+0x36/0x60\n virtio_pmem_host_ack+0x11d/0x3b0\n ? sched_balance_domains+0x29f/0xb00\n ? __pfx_virtio_pmem_host_ack+0x10/0x10\n ? _raw_spin_lock_irqsave+0x98/0x100\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n vring_interrupt+0x1c9/0x5e0\n ? __pfx_vp_interrupt+0x10/0x10\n vp_vring_interrupt+0x87/0x100\n ? __pfx_vp_interrupt+0x10/0x10\n __handle_irq_event_percpu+0x17f/0x550\n ? __pfx__raw_spin_lock+0x10/0x10\n handle_irq_event+0xab/0x1c0\n handle_fasteoi_irq+0x276/0xae0\n __common_interrupt+0x65/0x130\n common_interrupt+0x78/0xa0\n \u003c/IRQ\u003e\n\nvirtio_pmem_host_ack() wakes a request that has already been freed by the\nsubmitter.\n\nThis happens when the request token is still reachable via the virtqueue,\nbut virtio_pmem_flush() returns and frees it.\n\nFix the token lifetime by refcounting struct virtio_pmem_request.\nvirtio_pmem_flush() holds a submitter reference, and the virtqueue holds an\nextra reference once the request is queued. The completion path drops the\nvirtqueue reference, and the submitter drops its reference before\nreturning."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - virtio_pmem_host_ack() is the flush_queue callback registered in init_vq() and invoked from vring_interrupt() when the virtio-pmem backend completes a token; pmem_submit_bio() (REQ_PREFLUSH/REQ_FUA) and nd_pmem_remove() reach virtio_pmem_flush() only on that paravirtual device, not via a routable protocol message.\nAC:L - virtio_pmem_flush() kfree()s req_data after virtqueue_kick() fails while the token remains in req_vq, and on the success path kfree()s it while virtio_pmem_host_ack() still runs wake_up(\u0026req_data-\u003ehost_acked); a backend writing the used ring, or concurrent PREFLUSH/FUA bios (flush_lock only exists after a9ba6733), drives that lifetime hole.\nPR:N - virtio_pmem_host_ack() authenticates nothing and holds no guest credential. Host-initiated unplug runs virtio_pmem_remove()\u2192nvdimm_bus_unregister()\u2192nd_pmem_remove(), which calls nvdimm_flush(nd_region, NULL)\u2192virtio_pmem_flush() with no capable() check before the token is queued on req_vq.\nUI:N - nd_pmem_remove()/nd_pmem_shutdown() submit virtio_pmem_flush() during teardown the backend/VMM initiates, and virtio_pmem_host_ack() then runs from vring_interrupt with no guest ioctl, mount, or file open; a local user of /dev/pmem likewise issues their own PREFLUSH/FUA bios.\nS:U - The freed object is a guest kmalloc struct virtio_pmem_request used only inside virtio_pmem_flush() and virtio_pmem_host_ack(); corruption stays in that guest kernel and is not a KVM/Xen guest-to-host escape or IOMMU/DMA bypass.\nC:H - virtio_pmem_host_ack() takes the freed token from virtqueue_get_buf() and writes req_data-\u003edone then wake_up(\u0026req_data-\u003ehost_acked) on the kfree\u0027d slab; reuse of that virtio_pmem_request is a use-after-free read primitive once the object is sprayed.\nI:H - KASAN reports slab-use-after-free in __wake_up_common() from virtio_pmem_host_ack(): wake_up() walks the freed host_acked wait_queue_head, so a sprayed wait_queue_entry.func yields an indirect call and list-pointer write.\nA:H - KASAN reports slab-use-after-free in __wake_up_common() from virtio_pmem_host_ack() in vring_interrupt IRQ context on swapper/0, which oopses or panics the guest even when the UAF is not turned into a full exploit."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:16.262Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41b2025709ec104a07d15540399809ae5851246e"
},
{
"url": "https://git.kernel.org/stable/c/4691c137e9cbe76137d730a26d663d900ac7279b"
},
{
"url": "https://git.kernel.org/stable/c/be072a5d5e35f4bdf2da22f600b5d6dc6c5ff491"
},
{
"url": "https://git.kernel.org/stable/c/b1e740b9156621afd4c4aa66257f4dde8df1febe"
},
{
"url": "https://git.kernel.org/stable/c/e57140944b5a47a7fd5a142faab29a02af040bc8"
}
],
"title": "nvdimm: virtio_pmem: refcount requests for token lifetime",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93196",
"datePublished": "2026-09-17T16:12:19.125Z",
"dateReserved": "2026-09-17T16:02:15.092Z",
"dateUpdated": "2026-10-21T12:52:16.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98172 (GCVE-0-2026-98172)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
When an RDMA connection is successfully established via
smbd_get_connection() but cifs_get_tcp_session() later fails (e.g.
kthread_create() returns an error), the error path frees tcp_ses
without first destroying the smbd_connection.
Fix this by calling smbd_destroy() in the out_err cleanup path before
kfree(tcp_ses). smbd_destroy() safely handles the case where
smbd_conn is NULL, so it can be called unconditionally.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2f8946464b11822169b9f10c7cf58a2440b51d54 Version: 2f8946464b11822169b9f10c7cf58a2440b51d54 Version: 2f8946464b11822169b9f10c7cf58a2440b51d54 Version: 2f8946464b11822169b9f10c7cf58a2440b51d54 Version: 2f8946464b11822169b9f10c7cf58a2440b51d54 Version: 2f8946464b11822169b9f10c7cf58a2440b51d54 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/connect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3164402c58940ff58a3cecdb026405f07b0253af",
"status": "affected",
"version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
"versionType": "git"
},
{
"lessThan": "e3344bb0ff5ec8a276f42239e140f5442841ef23",
"status": "affected",
"version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
"versionType": "git"
},
{
"lessThan": "5c908e49d349266dff0c86dda6a05df0ff19b824",
"status": "affected",
"version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
"versionType": "git"
},
{
"lessThan": "928edc4bd6a617caabeb575fc13c254d9df623c4",
"status": "affected",
"version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
"versionType": "git"
},
{
"lessThan": "b26a3fcf2f1c2cadba400290b639f01395db8fc8",
"status": "affected",
"version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
"versionType": "git"
},
{
"lessThan": "e75c96157d45e498970158c8f7373d90102e33b9",
"status": "affected",
"version": "2f8946464b11822169b9f10c7cf58a2440b51d54",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/connect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbd_connection leak on cifs_get_tcp_session() error\n\nWhen an RDMA connection is successfully established via\nsmbd_get_connection() but cifs_get_tcp_session() later fails (e.g.\nkthread_create() returns an error), the error path frees tcp_ses\nwithout first destroying the smbd_connection.\n\nFix this by calling smbd_destroy() in the out_err cleanup path before\nkfree(tcp_ses). smbd_destroy() safely handles the case where\nsmbd_conn is NULL, so it can be called unconditionally."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:03.619Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3164402c58940ff58a3cecdb026405f07b0253af"
},
{
"url": "https://git.kernel.org/stable/c/e3344bb0ff5ec8a276f42239e140f5442841ef23"
},
{
"url": "https://git.kernel.org/stable/c/5c908e49d349266dff0c86dda6a05df0ff19b824"
},
{
"url": "https://git.kernel.org/stable/c/928edc4bd6a617caabeb575fc13c254d9df623c4"
},
{
"url": "https://git.kernel.org/stable/c/b26a3fcf2f1c2cadba400290b639f01395db8fc8"
},
{
"url": "https://git.kernel.org/stable/c/e75c96157d45e498970158c8f7373d90102e33b9"
}
],
"title": "smb: client: fix smbd_connection leak on cifs_get_tcp_session() error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98172",
"datePublished": "2026-10-06T08:44:16.721Z",
"dateReserved": "2026-09-25T10:25:14.322Z",
"dateUpdated": "2026-10-19T09:15:03.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98328 (GCVE-0-2026-98328)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: add HE 6 GHz capability in the scan elems len
The HE 6 GHz Band Capability element is in the probe request for
every band if 6 GHz is supported, so add the size to scan_ies_len.
Otherwise, building probe request elements can fail, triggering the
WARN_ON in __ieee80211_start_scan().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77 Version: 2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77 Version: 2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77 Version: 2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77 Version: 2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77 Version: 2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "db19d5414227d86cee77a000607a6710d7f36853",
"status": "affected",
"version": "2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77",
"versionType": "git"
},
{
"lessThan": "be7bfdea1ec9b672a80c736bd6ed932e1adebef8",
"status": "affected",
"version": "2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77",
"versionType": "git"
},
{
"lessThan": "8659bd6c4c852096b6621086d1ea38eed84b454a",
"status": "affected",
"version": "2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77",
"versionType": "git"
},
{
"lessThan": "ad5bd0f6a0c337a80c141ea8e6c7a1d9c145be79",
"status": "affected",
"version": "2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77",
"versionType": "git"
},
{
"lessThan": "9d83c08dcce808c732988a5291e3ef4f59d09edb",
"status": "affected",
"version": "2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77",
"versionType": "git"
},
{
"lessThan": "cd54bf333f5631d3630bab0a832e9ae648f73515",
"status": "affected",
"version": "2ad2274c58ee2dcaf9ccde5c63ff30f59b138f77",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: add HE 6 GHz capability in the scan elems len\n\nThe HE 6 GHz Band Capability element is in the probe request for\nevery band if 6 GHz is supported, so add the size to scan_ies_len.\n\nOtherwise, building probe request elements can fail, triggering the\nWARN_ON in __ieee80211_start_scan()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:38.625Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/db19d5414227d86cee77a000607a6710d7f36853"
},
{
"url": "https://git.kernel.org/stable/c/be7bfdea1ec9b672a80c736bd6ed932e1adebef8"
},
{
"url": "https://git.kernel.org/stable/c/8659bd6c4c852096b6621086d1ea38eed84b454a"
},
{
"url": "https://git.kernel.org/stable/c/ad5bd0f6a0c337a80c141ea8e6c7a1d9c145be79"
},
{
"url": "https://git.kernel.org/stable/c/9d83c08dcce808c732988a5291e3ef4f59d09edb"
},
{
"url": "https://git.kernel.org/stable/c/cd54bf333f5631d3630bab0a832e9ae648f73515"
}
],
"title": "wifi: mac80211: add HE 6 GHz capability in the scan elems len",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98328",
"datePublished": "2026-10-06T08:46:21.099Z",
"dateReserved": "2026-09-25T10:25:14.341Z",
"dateUpdated": "2026-10-19T09:17:38.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52988 (GCVE-0-2026-52988)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-10-19 19:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
Publish new hooks in the list into the basechain/flowtable using
splice_list_rcu() to ensure netlink dump list traversal via rcu is safe
while concurrent ruleset update is going on.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 Version: 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 Version: 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 Version: 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 Version: 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 Version: 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 Version: 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 Version: 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-52988",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:24:11.399025Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:47:12.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed8d3bd8272e49ea987100de2abfb13710329a9b",
"status": "affected",
"version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
"versionType": "git"
},
{
"lessThan": "8fdd2204503ab1ce07dc000c277e2c3edf96a67b",
"status": "affected",
"version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
"versionType": "git"
},
{
"lessThan": "5593c640f9daedec8de61555c41e1019fa675aa6",
"status": "affected",
"version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
"versionType": "git"
},
{
"lessThan": "00e370627f2e1fb3585f9d26348b1abddc75442b",
"status": "affected",
"version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
"versionType": "git"
},
{
"lessThan": "28ecfb3d1fe8dea70319de7051cb6718c25b5b52",
"status": "affected",
"version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
"versionType": "git"
},
{
"lessThan": "a557816c6e38e9473d99aa9ea8c662f55fc85847",
"status": "affected",
"version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
"versionType": "git"
},
{
"lessThan": "1346be9379639c30877083b12747d4eacb83c24f",
"status": "affected",
"version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
"versionType": "git"
},
{
"lessThan": "a6134e62dba2ea4f760b29d5226907f447c92400",
"status": "affected",
"version": "78d9f48f7f44431a25da2b46b3a8812f6ff2b981",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: join hook list via splice_list_rcu() in commit phase\n\nPublish new hooks in the list into the basechain/flowtable using\nsplice_list_rcu() to ensure netlink dump list traversal via rcu is safe\nwhile concurrent ruleset update is going on."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Reachability is through nfnetlink/nftables netlink operations (`NFT_MSG_NEWCHAIN`/`NEWFLOWTABLE` and concurrent `GETCHAIN`/`GETFLOWTABLE` dumps), which require local ability to send netlink messages.\nAC:L - The bug is a race between an attacker-controlled ruleset update and an attacker-controlled concurrent RCU dump; both sides can be generated repeatedly from local processes.\nPR:L - nfnetlink checks `CAP_NET_ADMIN` in the target network namespace, and nftables/netfilter administration is reachable from unprivileged users via user+network namespaces on affected configurations.\nUI:N - No victim interaction is required; the attacker triggers both the update and dump operations directly.\nS:U - The impact remains within the kernel/local host security authority and does not cross a VM, IOMMU, or separate security-scope boundary.\nC:H - Unsafe non-RCU list publication can make an RCU netlink dump interpret a transaction list head or freed transaction memory as `struct nft_hook`, leading to out-of-bounds/use-after-free reads returned through netlink hook device-name serialization.\nI:N - The reachable affected dump path reads hook-list entries and serializes names; I did not find a defensible attacker-controlled write or control-flow primitive from this bug.\nA:H - The malformed RCU traversal can dereference invalid/freed memory or loop over an inconsistent list, making kernel oops, panic, or soft lockup a plausible outcome."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T10:55:33.999Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed8d3bd8272e49ea987100de2abfb13710329a9b"
},
{
"url": "https://git.kernel.org/stable/c/8fdd2204503ab1ce07dc000c277e2c3edf96a67b"
},
{
"url": "https://git.kernel.org/stable/c/5593c640f9daedec8de61555c41e1019fa675aa6"
},
{
"url": "https://git.kernel.org/stable/c/00e370627f2e1fb3585f9d26348b1abddc75442b"
},
{
"url": "https://git.kernel.org/stable/c/28ecfb3d1fe8dea70319de7051cb6718c25b5b52"
},
{
"url": "https://git.kernel.org/stable/c/a557816c6e38e9473d99aa9ea8c662f55fc85847"
},
{
"url": "https://git.kernel.org/stable/c/1346be9379639c30877083b12747d4eacb83c24f"
},
{
"url": "https://git.kernel.org/stable/c/a6134e62dba2ea4f760b29d5226907f447c92400"
}
],
"title": "netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52988",
"datePublished": "2026-06-24T16:29:02.580Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-10-19T19:47:12.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72463 (GCVE-0-2026-72463)
Vulnerability from cvelistv5
Published
2026-08-15 05:57
Modified
2026-10-21 12:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Fix dev use-after-free in xfrm async resumption
xfrm async resumption hold skb->dev refcnt until after transport_finish.
However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking
device reference, such as vti_rcv_cb. The subsequent async resumption
will decrement the tunnel device's reference count, which lead to uaf
of tunnel dev and refcnt leak of orig dev as below:
unregister_netdevice: waiting for vti1 to become free. Usage count = -2
Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set
by xfrm_rcv_cb can race with device teardown. Extend rcu protection over
xfrm_rcv_cb and transport_finish to prevent races.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4236c30b437b80f673b9e08c8fae38b8d471ac9e Version: 0f451b43c88bf2b9c038b414be580efee42e031b Version: 1c428b03840094410c5fb6a5db30640486bbbfcb Version: 1c428b03840094410c5fb6a5db30640486bbbfcb Version: 94439cbe478b53f92223da9aae95fffb28623c3f Version: 5002beda5cac69d522dc54da0d5d463ed9c963d2 Version: 6.12.94 ≤ Version: 6.18.23 ≤ Version: 6.6.160 ≤ Version: 6.19.13 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/xfrm4_input.c",
"net/ipv6/xfrm6_input.c",
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fed4d3195a31125566876952ce66113ec1eb9008",
"status": "affected",
"version": "4236c30b437b80f673b9e08c8fae38b8d471ac9e",
"versionType": "git"
},
{
"lessThan": "1acd93259b6be269e26be5d71c224bccd1f8352f",
"status": "affected",
"version": "0f451b43c88bf2b9c038b414be580efee42e031b",
"versionType": "git"
},
{
"lessThan": "63a30015199912bd5055bead8001b1ae68a67cdb",
"status": "affected",
"version": "1c428b03840094410c5fb6a5db30640486bbbfcb",
"versionType": "git"
},
{
"lessThan": "8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff",
"status": "affected",
"version": "1c428b03840094410c5fb6a5db30640486bbbfcb",
"versionType": "git"
},
{
"status": "affected",
"version": "94439cbe478b53f92223da9aae95fffb28623c3f",
"versionType": "git"
},
{
"status": "affected",
"version": "5002beda5cac69d522dc54da0d5d463ed9c963d2",
"versionType": "git"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThan": "6.18.54",
"status": "affected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/xfrm4_input.c",
"net/ipv6/xfrm6_input.c",
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12.94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.18.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Fix dev use-after-free in xfrm async resumption\n\nxfrm async resumption hold skb-\u003edev refcnt until after transport_finish.\nHowever, xfrm_rcv_cb may modify skb-\u003edev to tunnel dev without taking\ndevice reference, such as vti_rcv_cb. The subsequent async resumption\nwill decrement the tunnel device\u0027s reference count, which lead to uaf\nof tunnel dev and refcnt leak of orig dev as below:\n\nunregister_netdevice: waiting for vti1 to become free. Usage count = -2\n\nStash the original skb-\u003edev to fix refcnt imbalance. The new skb-\u003edev set\nby xfrm_rcv_cb can race with device teardown. Extend rcu protection over\nxfrm_rcv_cb and transport_finish to prevent races."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Reachable from the network receive path: remote ESP/AH (or UDP-encapsulated IPsec) packets hit ip_rcv \u2192 xfrm4/xfrm6 protocol handlers \u2192 vti/xfrmi input \u2192 xfrm_input() \u2192 async crypto resume, on Internet-facing IPsec/VTI/xfrmi VPN gateways and cloud endpoints.\nAC:L - Once async decryption resumes (encap_type=-1), vti_rcv_cb/xfrmi_rcv_cb retarget skb-\u003edev and the stale dev_put is deterministic; the attacker controls packet rate/volume to drive -EINPROGRESS and can race netdev teardown, so no uncontrollable victim-only conditions apply.\nPR:N - No local account, shell, or capability on the victim is required\u2014only network-delivered IPsec traffic accepted by a pre-configured VTI/xfrmi gateway (e.g., VPN peer, site-to-site endpoint); administrative IPsec setup is deployment state, not attacker privilege on the host.\nUI:N - Exploitation is fully automated by sending IPsec packets; no victim interaction such as mounting filesystems, opening files, or clicking links is needed.\nS:U - Impact is kernel net_device refcount corruption/UAF within the host kernel security authority; it does not cross VM, IOMMU, or sandbox boundaries (standard kernel privilege escalation, not escape).\nC:H - Use-after-free of a net_device after refcount underflow (e.g., usage count=-2) exposes freed netdev/slab memory; per kernel UAF guidance this provides a high-impact arbitrary-read primitive via heap grooming.\nI:H - Corrupting freed net_device structures and reference counts is classic heap UAF that can be shaped into arbitrary kernel writes and control-flow hijack for code execution, per kernel memory-corruption guidance.\nA:H - Refcount imbalance causes unregister_netdevice to hang (usage count=-2), kernel oops/panic during tunnel teardown, and reliable denial of service on IPsec gateways even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:44:58.359Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fed4d3195a31125566876952ce66113ec1eb9008"
},
{
"url": "https://git.kernel.org/stable/c/1acd93259b6be269e26be5d71c224bccd1f8352f"
},
{
"url": "https://git.kernel.org/stable/c/63a30015199912bd5055bead8001b1ae68a67cdb"
},
{
"url": "https://git.kernel.org/stable/c/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff"
}
],
"title": "xfrm: Fix dev use-after-free in xfrm async resumption",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72463",
"datePublished": "2026-08-15T05:57:07.413Z",
"dateReserved": "2026-08-09T03:40:39.933Z",
"dateUpdated": "2026-10-21T12:44:58.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98314 (GCVE-0-2026-98314)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: set timer->private_data before registering the PCM timer
snd_pcm_timer_init() calls snd_device_register() to link the new
struct snd_timer into the global timer list while it still carries
hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop),
and only afterwards sets timer->private_data = substream.
Once the timer is on the list under register_mutex, a concurrent
reader can already reach it through the same mutex and invoke these
callbacks. /proc/asound/timers does this via c_resolution(), and
snd_timer_open()+snd_timer_start() reach start()/stop() the same way.
All three dereference timer->private_data, which for this brief
window is NULL, giving a NULL-pointer dereference:
substream = timer->private_data;
return substream->runtime ? ... // substream is NULL
Move the private_data/private_free assignment before
snd_device_register() so the timer is never visible on the list
without its private_data set. On the snd_device_register() failure
path, private_free() (snd_pcm_timer_free()) can now run, but it only
does substream->timer = NULL, which is already NULL at that point
since substream->timer is set to the new timer just once, after a
successful registration -- so the failure path stays safe.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/pcm_timer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "27f167e117eca310661fbcbacb352ea08face067",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "555d168bd98daa46daccc68c908201388c834293",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8c869d5cf5affb20994bdbb60e7d46d65c91b55f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "686c7a6af1eea8d2a919303e4c6bbec3de79dbdc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e1eee8f16628f8b6bcae0a366fd6a2dd65e71edd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d63f5a9f8121fb43c798056d7dd34c58f47185d7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0b349249d572633d7c8cdeb917623d1676a2b7c3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1e713f9bb2ac583521f06b0eb4e22440b1e3d078",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/pcm_timer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer\n\nsnd_pcm_timer_init() calls snd_device_register() to link the new\nstruct snd_timer into the global timer list while it still carries\nhw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop),\nand only afterwards sets timer-\u003eprivate_data = substream.\n\nOnce the timer is on the list under register_mutex, a concurrent\nreader can already reach it through the same mutex and invoke these\ncallbacks. /proc/asound/timers does this via c_resolution(), and\nsnd_timer_open()+snd_timer_start() reach start()/stop() the same way.\nAll three dereference timer-\u003eprivate_data, which for this brief\nwindow is NULL, giving a NULL-pointer dereference:\n\n substream = timer-\u003eprivate_data;\n return substream-\u003eruntime ? ... // substream is NULL\n\nMove the private_data/private_free assignment before\nsnd_device_register() so the timer is never visible on the list\nwithout its private_data set. On the snd_device_register() failure\npath, private_free() (snd_pcm_timer_free()) can now run, but it only\ndoes substream-\u003etimer = NULL, which is already NULL at that point\nsince substream-\u003etimer is set to the new timer just once, after a\nsuccessful registration -- so the failure path stays safe."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:24.800Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/27f167e117eca310661fbcbacb352ea08face067"
},
{
"url": "https://git.kernel.org/stable/c/555d168bd98daa46daccc68c908201388c834293"
},
{
"url": "https://git.kernel.org/stable/c/8c869d5cf5affb20994bdbb60e7d46d65c91b55f"
},
{
"url": "https://git.kernel.org/stable/c/686c7a6af1eea8d2a919303e4c6bbec3de79dbdc"
},
{
"url": "https://git.kernel.org/stable/c/e1eee8f16628f8b6bcae0a366fd6a2dd65e71edd"
},
{
"url": "https://git.kernel.org/stable/c/d63f5a9f8121fb43c798056d7dd34c58f47185d7"
},
{
"url": "https://git.kernel.org/stable/c/0b349249d572633d7c8cdeb917623d1676a2b7c3"
},
{
"url": "https://git.kernel.org/stable/c/1e713f9bb2ac583521f06b0eb4e22440b1e3d078"
}
],
"title": "ALSA: pcm: set timer-\u003eprivate_data before registering the PCM timer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98314",
"datePublished": "2026-10-06T08:46:09.965Z",
"dateReserved": "2026-09-25T10:25:14.339Z",
"dateUpdated": "2026-10-19T09:17:24.800Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98227 (GCVE-0-2026-98227)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
memstick: ms_block: destroy io_queue workqueue on removal
msb_init_disk() creates the per-card ordered workqueue msb->io_queue with
alloc_ordered_workqueue(). It is torn down with destroy_workqueue() only
on the init error path; msb_remove() never destroys it. msb_stop() merely
flushes the queue, and neither msb_data_clear() nor put_disk() free it. As
a result every card insert/remove cycle leaks the workqueue and its
kworker, exhausting kernel memory over repeated cycles.
Destroy the workqueue in msb_remove() after the disk has been removed and
the queue drained.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0ab30494bc4f3bc1ea4659b7c5d97c5218554a63 Version: 0ab30494bc4f3bc1ea4659b7c5d97c5218554a63 Version: 0ab30494bc4f3bc1ea4659b7c5d97c5218554a63 Version: 0ab30494bc4f3bc1ea4659b7c5d97c5218554a63 Version: 0ab30494bc4f3bc1ea4659b7c5d97c5218554a63 Version: 0ab30494bc4f3bc1ea4659b7c5d97c5218554a63 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/memstick/core/ms_block.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0ff795163f37109a134b5a421558530f8d091544",
"status": "affected",
"version": "0ab30494bc4f3bc1ea4659b7c5d97c5218554a63",
"versionType": "git"
},
{
"lessThan": "19c3da6621a253f1f8b937ed91bc22330a930d9c",
"status": "affected",
"version": "0ab30494bc4f3bc1ea4659b7c5d97c5218554a63",
"versionType": "git"
},
{
"lessThan": "9a2e7cdc0880e735aff0968ee402f2c92a992b9b",
"status": "affected",
"version": "0ab30494bc4f3bc1ea4659b7c5d97c5218554a63",
"versionType": "git"
},
{
"lessThan": "6611f78ec3fd4b33a00bfda20725b254a22979f6",
"status": "affected",
"version": "0ab30494bc4f3bc1ea4659b7c5d97c5218554a63",
"versionType": "git"
},
{
"lessThan": "f222bb8c30cf5699c560b29179ff2bddcac1f950",
"status": "affected",
"version": "0ab30494bc4f3bc1ea4659b7c5d97c5218554a63",
"versionType": "git"
},
{
"lessThan": "90af7fde083e1b22c349c3a8b1626728e44e474c",
"status": "affected",
"version": "0ab30494bc4f3bc1ea4659b7c5d97c5218554a63",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/memstick/core/ms_block.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: ms_block: destroy io_queue workqueue on removal\n\nmsb_init_disk() creates the per-card ordered workqueue msb-\u003eio_queue with\nalloc_ordered_workqueue(). It is torn down with destroy_workqueue() only\non the init error path; msb_remove() never destroys it. msb_stop() merely\nflushes the queue, and neither msb_data_clear() nor put_disk() free it. As\na result every card insert/remove cycle leaks the workqueue and its\nkworker, exhausting kernel memory over repeated cycles.\n\nDestroy the workqueue in msb_remove() after the disk has been removed and\nthe queue drained."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:58.990Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ff795163f37109a134b5a421558530f8d091544"
},
{
"url": "https://git.kernel.org/stable/c/19c3da6621a253f1f8b937ed91bc22330a930d9c"
},
{
"url": "https://git.kernel.org/stable/c/9a2e7cdc0880e735aff0968ee402f2c92a992b9b"
},
{
"url": "https://git.kernel.org/stable/c/6611f78ec3fd4b33a00bfda20725b254a22979f6"
},
{
"url": "https://git.kernel.org/stable/c/f222bb8c30cf5699c560b29179ff2bddcac1f950"
},
{
"url": "https://git.kernel.org/stable/c/90af7fde083e1b22c349c3a8b1626728e44e474c"
}
],
"title": "memstick: ms_block: destroy io_queue workqueue on removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98227",
"datePublished": "2026-10-06T08:45:02.265Z",
"dateReserved": "2026-09-25T10:25:14.328Z",
"dateUpdated": "2026-10-19T09:15:58.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98215 (GCVE-0-2026-98215)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
selinux: preserve user SID across nested backing files
SELinux saves the user file SID in a backing-file security blob so it
remains available after mmap() replaces vma->vm_file with a backing file.
For nested backing files (overlayfs over overlayfs, or FUSE passthrough
backed by overlayfs), user_file may itself be a backing file. Its
fsec->sid is the SID of the mounter that opened it, rather than the user
that opened the top-level file. mprotect() then checks fd { use } against
the mounter SID. This can incorrectly deny access without a domain
transition, or check the wrong target SID after one.
Copy the saved user SID when user_file is a backing file. Keep using the
regular file SID for the first backing layer.
With two nested overlayfs mounts and SELinux enforcing,
mprotect(PROT_READ) returns EACCES with an fd { use } denial against the
mounter SID. With this change, mprotect() succeeds.
Tested on arm64 QEMU with a small BusyBox initramfs and a purpose-built
SELinux policy. The original test was also repeated with Fedora Cloud
Base 44 userspace and gave the same result.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bc6c380c1159de52a252ed11f19a42c47f60a735 Version: 8bacd09f12c27710228562e4d13163e58c5f4a45 Version: d844702198395d3f80222777030f69db6be6b709 Version: 82544d36b1729153c8aeb179e84750f0c085d3b1 Version: 82544d36b1729153c8aeb179e84750f0c085d3b1 Version: cd0e707a927a70cdfd8bc5a512a9719a87f5ed51 Version: 6.6.144 ≤ Version: 6.12.95 ≤ Version: 6.18.38 ≤ Version: 7.0.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/selinux/hooks.c",
"security/selinux/include/objsec.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "caa1b913d90d5dc07073733326d2af0f0288f089",
"status": "affected",
"version": "bc6c380c1159de52a252ed11f19a42c47f60a735",
"versionType": "git"
},
{
"lessThan": "6aaeec59aadcd1eafc18b049f1b759fb6b9d9569",
"status": "affected",
"version": "8bacd09f12c27710228562e4d13163e58c5f4a45",
"versionType": "git"
},
{
"lessThan": "9d99b770e7b67b00bdef9005b928aad13e1d679b",
"status": "affected",
"version": "d844702198395d3f80222777030f69db6be6b709",
"versionType": "git"
},
{
"lessThan": "ff20d16b2e8230c034e21540043df47222dcc09b",
"status": "affected",
"version": "82544d36b1729153c8aeb179e84750f0c085d3b1",
"versionType": "git"
},
{
"lessThan": "8c0c602202b9a4909b00bc3354e3c0355bc69e65",
"status": "affected",
"version": "82544d36b1729153c8aeb179e84750f0c085d3b1",
"versionType": "git"
},
{
"status": "affected",
"version": "cd0e707a927a70cdfd8bc5a512a9719a87f5ed51",
"versionType": "git"
},
{
"lessThan": "6.6.158",
"status": "affected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThan": "6.18.54",
"status": "affected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThan": "7.1",
"status": "affected",
"version": "7.0.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/selinux/hooks.c",
"security/selinux/include/objsec.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.6.144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12.95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.18.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: preserve user SID across nested backing files\n\nSELinux saves the user file SID in a backing-file security blob so it\nremains available after mmap() replaces vma-\u003evm_file with a backing file.\n\nFor nested backing files (overlayfs over overlayfs, or FUSE passthrough\nbacked by overlayfs), user_file may itself be a backing file. Its\nfsec-\u003esid is the SID of the mounter that opened it, rather than the user\nthat opened the top-level file. mprotect() then checks fd { use } against\nthe mounter SID. This can incorrectly deny access without a domain\ntransition, or check the wrong target SID after one.\n\nCopy the saved user SID when user_file is a backing file. Keep using the\nregular file SID for the first backing layer.\n\nWith two nested overlayfs mounts and SELinux enforcing,\nmprotect(PROT_READ) returns EACCES with an fd { use } denial against the\nmounter SID. With this change, mprotect() succeeds.\n\nTested on arm64 QEMU with a small BusyBox initramfs and a purpose-built\nSELinux policy. The original test was also repeated with Fedora Cloud\nBase 44 userspace and gave the same result."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:46.038Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/caa1b913d90d5dc07073733326d2af0f0288f089"
},
{
"url": "https://git.kernel.org/stable/c/6aaeec59aadcd1eafc18b049f1b759fb6b9d9569"
},
{
"url": "https://git.kernel.org/stable/c/9d99b770e7b67b00bdef9005b928aad13e1d679b"
},
{
"url": "https://git.kernel.org/stable/c/ff20d16b2e8230c034e21540043df47222dcc09b"
},
{
"url": "https://git.kernel.org/stable/c/8c0c602202b9a4909b00bc3354e3c0355bc69e65"
}
],
"title": "selinux: preserve user SID across nested backing files",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98215",
"datePublished": "2026-10-06T08:44:51.412Z",
"dateReserved": "2026-09-25T10:25:14.326Z",
"dateUpdated": "2026-10-19T09:15:46.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98287 (GCVE-0-2026-98287)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pppoatm: ensure a writable skb header and linear data
In pppoatm_send(), LLC encapsulation checks whether there is sufficient
headroom for the 4-byte LLC header, but does not ensure that the skb header
is writable.
Normal transmit packets passing through ppp_start_xmit() have their header
unshared via skb_cow_head(). However, packets can also reach pppoatm_send()
via PPP channel bridging (PPPIOCBRIDGECHAN) without going through
ppp_start_xmit().
Use skb_cow_head() to ensure both sufficient headroom and a writable
header before pushing the LLC header.
While at it:
- Call pskb_may_pull(skb, 1) before inspecting skb->data[0] to prevent
out-of-bounds reads on zero-length or non-linear frames (e.g. from
bridging).
- Defer SC_COMP_PROT protocol compression until after pppoatm_may_send()
succeeds. This eliminates the temporary skb allocation on admission failure
and completely removes the fragile "undo" heuristic at the nospace label,
avoiding any risk of reading uninitialized headroom or performing an
unbalanced skb_push().
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4cf476ced45d7f12df30a68e833b263e7a2202d1 Version: 4cf476ced45d7f12df30a68e833b263e7a2202d1 Version: 4cf476ced45d7f12df30a68e833b263e7a2202d1 Version: 4cf476ced45d7f12df30a68e833b263e7a2202d1 Version: 4cf476ced45d7f12df30a68e833b263e7a2202d1 Version: 4cf476ced45d7f12df30a68e833b263e7a2202d1 Version: 4cf476ced45d7f12df30a68e833b263e7a2202d1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/atm/pppoatm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "208ccc4d08b1897451e9ba01c016bf93ff107966",
"status": "affected",
"version": "4cf476ced45d7f12df30a68e833b263e7a2202d1",
"versionType": "git"
},
{
"lessThan": "e6cd1bba7d113c15c00ac63671213a096fe4d686",
"status": "affected",
"version": "4cf476ced45d7f12df30a68e833b263e7a2202d1",
"versionType": "git"
},
{
"lessThan": "ffc448eb54f5ba80d4212c1e870cdb92b0f709fa",
"status": "affected",
"version": "4cf476ced45d7f12df30a68e833b263e7a2202d1",
"versionType": "git"
},
{
"lessThan": "8e66c5969acd859ba72fb0a7fa895623fc1b3769",
"status": "affected",
"version": "4cf476ced45d7f12df30a68e833b263e7a2202d1",
"versionType": "git"
},
{
"lessThan": "e2f5529b0016db7d34f411408607f5cf395a542e",
"status": "affected",
"version": "4cf476ced45d7f12df30a68e833b263e7a2202d1",
"versionType": "git"
},
{
"lessThan": "30992fe39e65589ed8e000425e088fa74994b811",
"status": "affected",
"version": "4cf476ced45d7f12df30a68e833b263e7a2202d1",
"versionType": "git"
},
{
"lessThan": "ecc7253683a3c55caa868ce0ee530fcb0044bd3c",
"status": "affected",
"version": "4cf476ced45d7f12df30a68e833b263e7a2202d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/atm/pppoatm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npppoatm: ensure a writable skb header and linear data\n\nIn pppoatm_send(), LLC encapsulation checks whether there is sufficient\nheadroom for the 4-byte LLC header, but does not ensure that the skb header\nis writable.\n\nNormal transmit packets passing through ppp_start_xmit() have their header\nunshared via skb_cow_head(). However, packets can also reach pppoatm_send()\nvia PPP channel bridging (PPPIOCBRIDGECHAN) without going through\nppp_start_xmit().\n\nUse skb_cow_head() to ensure both sufficient headroom and a writable\nheader before pushing the LLC header.\n\nWhile at it:\n- Call pskb_may_pull(skb, 1) before inspecting skb-\u003edata[0] to prevent\n out-of-bounds reads on zero-length or non-linear frames (e.g. from\n bridging).\n- Defer SC_COMP_PROT protocol compression until after pppoatm_may_send()\n succeeds. This eliminates the temporary skb allocation on admission failure\n and completely removes the fragile \"undo\" heuristic at the nospace label,\n avoiding any risk of reading uninitialized headroom or performing an\n unbalanced skb_push()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:58.585Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/208ccc4d08b1897451e9ba01c016bf93ff107966"
},
{
"url": "https://git.kernel.org/stable/c/e6cd1bba7d113c15c00ac63671213a096fe4d686"
},
{
"url": "https://git.kernel.org/stable/c/ffc448eb54f5ba80d4212c1e870cdb92b0f709fa"
},
{
"url": "https://git.kernel.org/stable/c/8e66c5969acd859ba72fb0a7fa895623fc1b3769"
},
{
"url": "https://git.kernel.org/stable/c/e2f5529b0016db7d34f411408607f5cf395a542e"
},
{
"url": "https://git.kernel.org/stable/c/30992fe39e65589ed8e000425e088fa74994b811"
},
{
"url": "https://git.kernel.org/stable/c/ecc7253683a3c55caa868ce0ee530fcb0044bd3c"
}
],
"title": "pppoatm: ensure a writable skb header and linear data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98287",
"datePublished": "2026-10-06T08:45:47.998Z",
"dateReserved": "2026-09-25T10:25:14.336Z",
"dateUpdated": "2026-10-19T09:16:58.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98308 (GCVE-0-2026-98308)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: trace PCM open only after assigning a stream
Stream assignment can fail when hardware streams are exhausted.
Move the tracepoint after the NULL check because its payload accesses
the assigned stream tag.
Detected by static analysis and reviewed with AI-assisted source auditing.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 184865085b88789fc8a355cc16ceff25f82f63ba Version: 184865085b88789fc8a355cc16ceff25f82f63ba Version: 184865085b88789fc8a355cc16ceff25f82f63ba Version: 184865085b88789fc8a355cc16ceff25f82f63ba Version: 184865085b88789fc8a355cc16ceff25f82f63ba Version: 184865085b88789fc8a355cc16ceff25f82f63ba Version: 184865085b88789fc8a355cc16ceff25f82f63ba Version: 184865085b88789fc8a355cc16ceff25f82f63ba |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/hda/common/controller.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5a4c974dee03cc46eac43c82f33e34ec94f0b348",
"status": "affected",
"version": "184865085b88789fc8a355cc16ceff25f82f63ba",
"versionType": "git"
},
{
"lessThan": "fba079ea22822248c82c3a999c88676d05b17bda",
"status": "affected",
"version": "184865085b88789fc8a355cc16ceff25f82f63ba",
"versionType": "git"
},
{
"lessThan": "3c6ca6d9342f4a0be7c1413180e11023d13b5cde",
"status": "affected",
"version": "184865085b88789fc8a355cc16ceff25f82f63ba",
"versionType": "git"
},
{
"lessThan": "0a52ba6d3b268bb82f0ec4cb861bc68d252369c0",
"status": "affected",
"version": "184865085b88789fc8a355cc16ceff25f82f63ba",
"versionType": "git"
},
{
"lessThan": "5c89e7965220e85d06ae4c58adb7d7bb6da2440c",
"status": "affected",
"version": "184865085b88789fc8a355cc16ceff25f82f63ba",
"versionType": "git"
},
{
"lessThan": "8477643cb91c9e09ac1b11890eef421ae63e53f7",
"status": "affected",
"version": "184865085b88789fc8a355cc16ceff25f82f63ba",
"versionType": "git"
},
{
"lessThan": "3db8afba2d210b7d80cd5cc6b76d7f46daa9b47a",
"status": "affected",
"version": "184865085b88789fc8a355cc16ceff25f82f63ba",
"versionType": "git"
},
{
"lessThan": "c9e6e5f38bf75276605f1952b22285f5f3abcaff",
"status": "affected",
"version": "184865085b88789fc8a355cc16ceff25f82f63ba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/hda/common/controller.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: trace PCM open only after assigning a stream\n\nStream assignment can fail when hardware streams are exhausted.\nMove the tracepoint after the NULL check because its payload accesses\nthe assigned stream tag.\n\nDetected by static analysis and reviewed with AI-assisted source auditing."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:18.952Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5a4c974dee03cc46eac43c82f33e34ec94f0b348"
},
{
"url": "https://git.kernel.org/stable/c/fba079ea22822248c82c3a999c88676d05b17bda"
},
{
"url": "https://git.kernel.org/stable/c/3c6ca6d9342f4a0be7c1413180e11023d13b5cde"
},
{
"url": "https://git.kernel.org/stable/c/0a52ba6d3b268bb82f0ec4cb861bc68d252369c0"
},
{
"url": "https://git.kernel.org/stable/c/5c89e7965220e85d06ae4c58adb7d7bb6da2440c"
},
{
"url": "https://git.kernel.org/stable/c/8477643cb91c9e09ac1b11890eef421ae63e53f7"
},
{
"url": "https://git.kernel.org/stable/c/3db8afba2d210b7d80cd5cc6b76d7f46daa9b47a"
},
{
"url": "https://git.kernel.org/stable/c/c9e6e5f38bf75276605f1952b22285f5f3abcaff"
}
],
"title": "ALSA: hda: trace PCM open only after assigning a stream",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98308",
"datePublished": "2026-10-06T08:46:05.128Z",
"dateReserved": "2026-09-25T10:25:14.338Z",
"dateUpdated": "2026-10-19T09:17:18.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98377 (GCVE-0-2026-98377)
Vulnerability from cvelistv5
Published
2026-10-09 07:34
Modified
2026-10-21 12:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vlan: require the MAC header to be present in __vlan_insert_inner_tag()
__vlan_insert_inner_tag() only guarantees head room via skb_cow_head(),
never that mac_len bytes of MAC header are present. Its ETH_HLEN
wrappers - __vlan_insert_tag() under skb_vlan_push(), and
vlan_insert_tag() under validate_xmit_vlan() on the generic transmit
path - therefore rewrite the first 16 bytes at skb->data: a 12-byte
memmove plus two 2-byte stores at +12 and +14. No caller supplies the
bound, while the pop helpers use skb_ensure_writable()/pskb_may_pull().
An IFF_TUN device has hard_header_len == 0, so packet_snd() accepts a
one-byte AF_PACKET/SOCK_RAW frame. The first vlan push only sets a
hwaccel tag; the next - clsact "action vlan push" or
bpf_skb_vlan_push() - enters the helper with skb->len still 1. The
head comes from skbuff_small_head without __GFP_ZERO, so each push
drags bytes from beyond skb->tail into the frame. After three the
one-byte send leaves as 13 bytes carrying 11 bytes of uninitialised
slab:
0000: 5a b3 62 12 80 88 ff ff 00 b3 62 12 81
`------------------------------'
only 0x5a was sent; the rest is slab, here the top 56 bits of a
linear-map address
Require the MAC header the helper rewrites to be present, so such a
frame is dropped rather than transmitted.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/if_vlan.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d531429524df2c7116579306640283fea68bcf0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "40a5cc4b7251c74f3341332a226d02200e96bccf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f42562dd027dc4ed103fae17b2206e73ea1963c4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "59af43ccece4d2d8b62e9e3ccc96b6e2e793bcdc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ab888242fce4f16f6c4d4c6ec53939ad36aa3b3a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/if_vlan.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: require the MAC header to be present in __vlan_insert_inner_tag()\n\n__vlan_insert_inner_tag() only guarantees head room via skb_cow_head(),\nnever that mac_len bytes of MAC header are present. Its ETH_HLEN\nwrappers - __vlan_insert_tag() under skb_vlan_push(), and\nvlan_insert_tag() under validate_xmit_vlan() on the generic transmit\npath - therefore rewrite the first 16 bytes at skb-\u003edata: a 12-byte\nmemmove plus two 2-byte stores at +12 and +14. No caller supplies the\nbound, while the pop helpers use skb_ensure_writable()/pskb_may_pull().\n\nAn IFF_TUN device has hard_header_len == 0, so packet_snd() accepts a\none-byte AF_PACKET/SOCK_RAW frame. The first vlan push only sets a\nhwaccel tag; the next - clsact \"action vlan push\" or\nbpf_skb_vlan_push() - enters the helper with skb-\u003elen still 1. The\nhead comes from skbuff_small_head without __GFP_ZERO, so each push\ndrags bytes from beyond skb-\u003etail into the frame. After three the\none-byte send leaves as 13 bytes carrying 11 bytes of uninitialised\nslab:\n\n 0000: 5a b3 62 12 80 88 ff ff 00 b3 62 12 81\n `------------------------------\u0027\n only 0x5a was sent; the rest is slab, here the top 56 bits of a\n linear-map address\n\nRequire the MAC header the helper rewrites to be present, so such a\nframe is dropped rather than transmitted."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:55:00.318Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d531429524df2c7116579306640283fea68bcf0"
},
{
"url": "https://git.kernel.org/stable/c/40a5cc4b7251c74f3341332a226d02200e96bccf"
},
{
"url": "https://git.kernel.org/stable/c/f42562dd027dc4ed103fae17b2206e73ea1963c4"
},
{
"url": "https://git.kernel.org/stable/c/59af43ccece4d2d8b62e9e3ccc96b6e2e793bcdc"
},
{
"url": "https://git.kernel.org/stable/c/ab888242fce4f16f6c4d4c6ec53939ad36aa3b3a"
}
],
"title": "vlan: require the MAC header to be present in __vlan_insert_inner_tag()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98377",
"datePublished": "2026-10-09T07:34:17.832Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-21T12:55:00.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98302 (GCVE-0-2026-98302)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: fddi: skfp: fix NULL deref when setting the MAC address while down
skfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without
checking netif_running(). ResetAdapter() first calls card_stop(), which
sets smc->hw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(),
which walks the two transmit queues:
for (i = QUEUE_S; i <= QUEUE_A0; i++) {
queue = smc->hw.fp.tx[i] ;
...
t = queue->tx_curr_get ;
smc->hw.fp.tx[] is only populated by init_tx(), which is reached from
skfp_open() through init_smt() -> init_fddi_driver() -> init_fplus() ->
init_mac() -> init_tx(). The private area is allocated and zeroed by
alloc_fddidev(), so on an interface that has never been brought up both
queue pointers are still NULL. The hw_state test at the top of
mac_drv_clear_tx_queue() does not catch this, because card_stop() has
just set STOPPED; the function proceeds into the loop and dereferences
NULL. ResetAdapter() does call init_smt() itself, but only after the
queues have been cleared.
Setting the MAC address on a down interface therefore oopses:
ip link set dev fddi0 address 02:00:00:00:00:01
BUG: KASAN: null-ptr-deref in mac_drv_clear_tx_queue+0x68/0x2c0 [skfp]
Read of size 8 at addr 0000000000000010 by task ip/302
Call Trace:
<TASK>
mac_drv_clear_tx_queue+0x68/0x2c0 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]
ResetAdapter+0x29/0x100 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]
skfp_ctl_set_mac_address+0x57/0x80 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]
netif_set_mac_address+0x1e4/0x2c0
do_setlink+0x684/0x2680
</TASK>
Address 0x10 is the offset of tx_curr_get, the third pointer in
struct s_smt_tx_queue, on 64-bit. mac_drv_clear_rx_queue(), which
ResetAdapter() calls immediately afterwards, dereferences
smc->hw.fp.rx[QUEUE_R1] in the same way behind the same ineffective
hw_state test; the transmit queue merely crashes first. Both are
covered by the guard below.
Skip the adapter reset when the interface is down. dev_addr_set() is
left unconditional, so the new address is still recorded in
dev->dev_addr. Nothing is lost by not resetting the adapter here:
skfp_open() deliberately re-reads the factory address on every open,
read_address(smc, NULL);
eth_hw_addr_set(dev, smc->hw.fddi_canon_addr.a);
and the comment above it states this is done to discard exactly such an
address override across a close/open cycle. An address set while the
interface is down could not have survived the following open even
before this change, so the guard removes no working behaviour. Guarding
the hardware side of ndo_set_mac_address() with netif_running() is
established practice; skge_set_mac_address() has done so since commit
2eb3e621c4e0 ("skge: set mac address bonding fix").
Guarding the reset as a whole, rather than NULL-checking the queues, is
also what the rest of the driver expects. After a previous open/close
the queue pointers are stale but non-NULL, so there is no crash, yet
ResetAdapter() goes on to call smt_online() and STI_FBI() ("Enable
Board Interrupts") while skfp_close() has already called free_irq() -
the adapter would be brought back online with no handler installed. The
only other ResetAdapter() caller is skfp_interrupt(), which by
construction runs only while the device is open.
Found by automated driver testing against an emulated SysKonnect FDDI
adapter under a KASAN-enabled 7.0.0 kernel. Triggering it requires
CAP_NET_ADMIN.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/fddi/skfp/skfddi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "835903bea770ad96ab4322e18d98e00f8e0b39c3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5fd0f401b3eee95c93daa35ef99cb03d676031f0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "731db6110b3148331ed8d5d11a564bfd520721d9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "822903ed991971780db1db1be31a4f00e2b13e30",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "616ba18b2cfb72b7bea214bdd72df2485b2e37dc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d6f63fdb298d546a47790cb373db65462c264d04",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "438131e7ae847e907d345bf504d7e25585561b5c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/fddi/skfp/skfddi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fddi: skfp: fix NULL deref when setting the MAC address while down\n\nskfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without\nchecking netif_running(). ResetAdapter() first calls card_stop(), which\nsets smc-\u003ehw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(),\nwhich walks the two transmit queues:\n\n\tfor (i = QUEUE_S; i \u003c= QUEUE_A0; i++) {\n\t\tqueue = smc-\u003ehw.fp.tx[i] ;\n\t\t...\n\t\tt = queue-\u003etx_curr_get ;\n\nsmc-\u003ehw.fp.tx[] is only populated by init_tx(), which is reached from\nskfp_open() through init_smt() -\u003e init_fddi_driver() -\u003e init_fplus() -\u003e\ninit_mac() -\u003e init_tx(). The private area is allocated and zeroed by\nalloc_fddidev(), so on an interface that has never been brought up both\nqueue pointers are still NULL. The hw_state test at the top of\nmac_drv_clear_tx_queue() does not catch this, because card_stop() has\njust set STOPPED; the function proceeds into the loop and dereferences\nNULL. ResetAdapter() does call init_smt() itself, but only after the\nqueues have been cleared.\n\nSetting the MAC address on a down interface therefore oopses:\n\n ip link set dev fddi0 address 02:00:00:00:00:01\n\n BUG: KASAN: null-ptr-deref in mac_drv_clear_tx_queue+0x68/0x2c0 [skfp]\n Read of size 8 at addr 0000000000000010 by task ip/302\n Call Trace:\n \u003cTASK\u003e\n mac_drv_clear_tx_queue+0x68/0x2c0 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n ResetAdapter+0x29/0x100 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n skfp_ctl_set_mac_address+0x57/0x80 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n netif_set_mac_address+0x1e4/0x2c0\n do_setlink+0x684/0x2680\n \u003c/TASK\u003e\n\nAddress 0x10 is the offset of tx_curr_get, the third pointer in\nstruct s_smt_tx_queue, on 64-bit. mac_drv_clear_rx_queue(), which\nResetAdapter() calls immediately afterwards, dereferences\nsmc-\u003ehw.fp.rx[QUEUE_R1] in the same way behind the same ineffective\nhw_state test; the transmit queue merely crashes first. Both are\ncovered by the guard below.\n\nSkip the adapter reset when the interface is down. dev_addr_set() is\nleft unconditional, so the new address is still recorded in\ndev-\u003edev_addr. Nothing is lost by not resetting the adapter here:\nskfp_open() deliberately re-reads the factory address on every open,\n\n\tread_address(smc, NULL);\n\teth_hw_addr_set(dev, smc-\u003ehw.fddi_canon_addr.a);\n\nand the comment above it states this is done to discard exactly such an\naddress override across a close/open cycle. An address set while the\ninterface is down could not have survived the following open even\nbefore this change, so the guard removes no working behaviour. Guarding\nthe hardware side of ndo_set_mac_address() with netif_running() is\nestablished practice; skge_set_mac_address() has done so since commit\n2eb3e621c4e0 (\"skge: set mac address bonding fix\").\n\nGuarding the reset as a whole, rather than NULL-checking the queues, is\nalso what the rest of the driver expects. After a previous open/close\nthe queue pointers are stale but non-NULL, so there is no crash, yet\nResetAdapter() goes on to call smt_online() and STI_FBI() (\"Enable\nBoard Interrupts\") while skfp_close() has already called free_irq() -\nthe adapter would be brought back online with no handler installed. The\nonly other ResetAdapter() caller is skfp_interrupt(), which by\nconstruction runs only while the device is open.\n\nFound by automated driver testing against an emulated SysKonnect FDDI\nadapter under a KASAN-enabled 7.0.0 kernel. Triggering it requires\nCAP_NET_ADMIN."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:13.166Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/835903bea770ad96ab4322e18d98e00f8e0b39c3"
},
{
"url": "https://git.kernel.org/stable/c/5fd0f401b3eee95c93daa35ef99cb03d676031f0"
},
{
"url": "https://git.kernel.org/stable/c/731db6110b3148331ed8d5d11a564bfd520721d9"
},
{
"url": "https://git.kernel.org/stable/c/822903ed991971780db1db1be31a4f00e2b13e30"
},
{
"url": "https://git.kernel.org/stable/c/616ba18b2cfb72b7bea214bdd72df2485b2e37dc"
},
{
"url": "https://git.kernel.org/stable/c/d6f63fdb298d546a47790cb373db65462c264d04"
},
{
"url": "https://git.kernel.org/stable/c/438131e7ae847e907d345bf504d7e25585561b5c"
},
{
"url": "https://git.kernel.org/stable/c/7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1"
}
],
"title": "net: fddi: skfp: fix NULL deref when setting the MAC address while down",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98302",
"datePublished": "2026-10-06T08:45:59.718Z",
"dateReserved": "2026-09-25T10:25:14.337Z",
"dateUpdated": "2026-10-19T09:17:13.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97939 (GCVE-0-2026-97939)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipmr: account multicast table and route memory
A netadmin in a user+net namespace can create many IPv4 and IPv6
multicast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen
id allocates an mr_table via the shared mr_table_alloc(), links it
into the per-net list, and leaves it until netns teardown. Those
objects were not charged to memcg, so the host unreclaimable slab
grows with the table count.
Account mr_table allocations with GFP_KERNEL_ACCOUNT and mark the
IPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established
handling of IP addresses, routes and alternate interface names.
Unresolved MFC entries are still allocated from softIRQ with
GFP_ATOMIC and are not charged. They expire after 10 seconds and are
bounded by the socket receive queue; see commit 0079ad8e8dc3
("ipmr: remove hard code cache_resolve_queue_len limit").
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/ipmr.c",
"net/ipv4/ipmr_base.c",
"net/ipv6/ip6mr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "21e0749e8ef272ac7e3eefe0fa488a5983f4b038",
"status": "affected",
"version": "f0ad0860d01e47a3ffd220564c5c653b3afbe962",
"versionType": "git"
},
{
"lessThan": "ec1c6140394ee87127479bc500a3158b125bf07a",
"status": "affected",
"version": "f0ad0860d01e47a3ffd220564c5c653b3afbe962",
"versionType": "git"
},
{
"lessThan": "0264b3ee09b118fec8a5471b4ca288f8ab84722f",
"status": "affected",
"version": "f0ad0860d01e47a3ffd220564c5c653b3afbe962",
"versionType": "git"
},
{
"lessThan": "d0a2e2a4ee6bfe51e398bfb6921a7d0f4c26bc1c",
"status": "affected",
"version": "f0ad0860d01e47a3ffd220564c5c653b3afbe962",
"versionType": "git"
},
{
"lessThan": "b7ee18725f2292ab554aa96a101ae42d45f008bd",
"status": "affected",
"version": "f0ad0860d01e47a3ffd220564c5c653b3afbe962",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/ipmr.c",
"net/ipv4/ipmr_base.c",
"net/ipv6/ip6mr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmr: account multicast table and route memory\n\nA netadmin in a user+net namespace can create many IPv4 and IPv6\nmulticast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen\nid allocates an mr_table via the shared mr_table_alloc(), links it\ninto the per-net list, and leaves it until netns teardown. Those\nobjects were not charged to memcg, so the host unreclaimable slab\ngrows with the table count.\n\nAccount mr_table allocations with GFP_KERNEL_ACCOUNT and mark the\nIPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established\nhandling of IP addresses, routes and alternate interface names.\n\nUnresolved MFC entries are still allocated from softIRQ with\nGFP_ATOMIC and are not charged. They expire after 10 seconds and are\nbounded by the socket receive queue; see commit 0079ad8e8dc3\n(\"ipmr: remove hard code cache_resolve_queue_len limit\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:46.494Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/21e0749e8ef272ac7e3eefe0fa488a5983f4b038"
},
{
"url": "https://git.kernel.org/stable/c/ec1c6140394ee87127479bc500a3158b125bf07a"
},
{
"url": "https://git.kernel.org/stable/c/0264b3ee09b118fec8a5471b4ca288f8ab84722f"
},
{
"url": "https://git.kernel.org/stable/c/d0a2e2a4ee6bfe51e398bfb6921a7d0f4c26bc1c"
},
{
"url": "https://git.kernel.org/stable/c/b7ee18725f2292ab554aa96a101ae42d45f008bd"
}
],
"title": "ipmr: account multicast table and route memory",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97939",
"datePublished": "2026-09-25T10:22:52.332Z",
"dateReserved": "2026-09-25T10:18:58.204Z",
"dateUpdated": "2026-10-21T12:53:46.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89638 (GCVE-0-2026-89638)
Vulnerability from cvelistv5
Published
2026-09-11 19:45
Modified
2026-10-21 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
When a file has the setuid or setgid bit set and is written to, the VFS
strips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID
together with an ATTR_MODE carrying the already-cleared mode.
Both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped
ATTR_MODE in that case:
/* skip mode change if it's just for clearing setuid/setgid */
if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID))
attrs->ia_valid &= ~ATTR_MODE;
This is fine for the default mount, where the mode is only emulated via
the DOS read-only attribute and cannot represent the setuid/setgid bits
anyway. However, with the "cifsacl" or "modefromsid" mount options the
mode is stored on the server through an ACL (id_mode_to_cifs_acl()), with
the SMB3.1.1 POSIX extensions the mode is sent to the server directly,
and with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent
via CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means
the cleared mode is never pushed to the server, so the setuid/setgid bit
survives the write.
This is a security issue: on local filesystems the setuid bit is stripped
when a file is written, but over these cifs.ko mounts the bit persists on
the server, potentially allowing an unexpected privilege escalation on
subsequent execution.
Fix this in two places:
1. cifs_setattr_nounix(): only take the "skip mode change" shortcut
when the mode is emulated via the DOS read-only attribute (i.e.
neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are
in effect), so that the cleared mode is propagated to the server
in the ACL / POSIX cases.
2. cifs_setattr_unix(): this function is only called when Unix
extensions are in effect, so the mode is always stored on the
server. Remove the shortcut entirely so that the cleared mode is
always pushed.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89638",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:24:50.502778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:45.797Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7ceb6f7cb8f8f2b094e0dcdaf75757775d231378",
"status": "affected",
"version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
"versionType": "git"
},
{
"lessThan": "58b23fc9fb580432470d6c5da3c1e5660dba9fbc",
"status": "affected",
"version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
"versionType": "git"
},
{
"lessThan": "b10015807e4c628095d1d1d1c9307efc8cdd9e1b",
"status": "affected",
"version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
"versionType": "git"
},
{
"lessThan": "69bfe810ecd1e0387d8975d711cd326341d13c6e",
"status": "affected",
"version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
"versionType": "git"
},
{
"lessThan": "b8e5dc4f95e5484159b343903f302eb6d783f2e6",
"status": "affected",
"version": "d32c4f2626acc385d5187bd5c0c24f442328dc60",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions\n\nWhen a file has the setuid or setgid bit set and is written to, the VFS\nstrips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID\ntogether with an ATTR_MODE carrying the already-cleared mode.\n\nBoth cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped\nATTR_MODE in that case:\n\n\t/* skip mode change if it\u0027s just for clearing setuid/setgid */\n\tif (attrs-\u003eia_valid \u0026 (ATTR_KILL_SUID|ATTR_KILL_SGID))\n\t\tattrs-\u003eia_valid \u0026= ~ATTR_MODE;\n\nThis is fine for the default mount, where the mode is only emulated via\nthe DOS read-only attribute and cannot represent the setuid/setgid bits\nanyway. However, with the \"cifsacl\" or \"modefromsid\" mount options the\nmode is stored on the server through an ACL (id_mode_to_cifs_acl()), with\nthe SMB3.1.1 POSIX extensions the mode is sent to the server directly,\nand with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent\nvia CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means\nthe cleared mode is never pushed to the server, so the setuid/setgid bit\nsurvives the write.\n\nThis is a security issue: on local filesystems the setuid bit is stripped\nwhen a file is written, but over these cifs.ko mounts the bit persists on\nthe server, potentially allowing an unexpected privilege escalation on\nsubsequent execution.\n\nFix this in two places:\n\n 1. cifs_setattr_nounix(): only take the \"skip mode change\" shortcut\n when the mode is emulated via the DOS read-only attribute (i.e.\n neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are\n in effect), so that the cleared mode is propagated to the server\n in the ACL / POSIX cases.\n\n 2. cifs_setattr_unix(): this function is only called when Unix\n extensions are in effect, so the mode is always stored on the\n server. Remove the shortcut entirely so that the cleared mode is\n always pushed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in the CIFS client setattr path, reached by local write(2)/truncate(2) on an SMB mount: cifs_file_write_iter -\u003e netfs_file_write_iter -\u003e file_remove_privs -\u003e notify_change -\u003e cifs_setattr_unix/nounix. This is not ksmbd; a remote SMB peer cannot invoke the ATTR_MODE skip.\nAC:L - Once the share stores POSIX mode (cifsacl, modefromsid, SMB3.1.1 POSIX, or SMB1 Unix extensions), a write to a setuid/setgid file deterministically drops ATTR_MODE so the cleared bits are never pushed. The attacker controls the write and later exec, with no race or uninfluenced memory layout.\nPR:L - An unprivileged local user with write access to the setuid/setgid file (group/world-writable helper, or noperm) triggers file_remove_privs; ATTR_FORCE skips ownership/CAP_FSETID checks in setattr_prepare, and no init-namespace capability is required.\nUI:N - The attacker opens, writes, and execve()s the still-setuid file on an already-mounted share; no other user must mount the filesystem, confirm a prompt, or run the binary.\nS:U - Remaining setuid/setgid execution escalates privileges inside the same kernel/OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After the attacker overwrites a privileged setuid/setgid helper, the uncleared bits allow execve of attacker-controlled contents as the file owner (including root on Samba POSIX/cifsacl deployments), disclosing all data that owner can read.\nI:H - The same still-setuid execution runs attacker-supplied file contents with the owner\u0027s privileges, enabling arbitrary writes and full integrity compromise, which is the POSIX reason those bits are stripped on write.\nA:H - Attacker-controlled code running as the privileged file owner can panic, halt, or disable the host, so successful exploitation yields complete availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:48:06.742Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7ceb6f7cb8f8f2b094e0dcdaf75757775d231378"
},
{
"url": "https://git.kernel.org/stable/c/58b23fc9fb580432470d6c5da3c1e5660dba9fbc"
},
{
"url": "https://git.kernel.org/stable/c/b10015807e4c628095d1d1d1c9307efc8cdd9e1b"
},
{
"url": "https://git.kernel.org/stable/c/69bfe810ecd1e0387d8975d711cd326341d13c6e"
},
{
"url": "https://git.kernel.org/stable/c/b8e5dc4f95e5484159b343903f302eb6d783f2e6"
}
],
"title": "smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89638",
"datePublished": "2026-09-11T19:45:31.791Z",
"dateReserved": "2026-09-11T19:38:34.740Z",
"dateUpdated": "2026-10-21T12:48:06.742Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98254 (GCVE-0-2026-98254)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
swiotlb: use the adjusted address for the highmem page lookup
swiotlb_bounce() reads the page frame number from the slot's recorded
orig_addr, then advances orig_addr by tlb_offset to reach the address
the caller asked about. The highmem branch mixes the two: the offset
within the page comes from the adjusted address, the page from the value
before it.
Once the adjustment crosses a page boundary the pair no longer describes
one location, and the whole copy lands one page below the intended one
for a positive tlb_offset, one above for a negative one. DMA_FROM_DEVICE
writes the device data over the wrong page and leaves the intended one
stale, DMA_TO_DEVICE feeds the device from a page the mapping may not
cover. Partial syncs through dma_sync_single_range_for_*() are what make
tlb_offset non-zero.
The branch test is picked the same way, so a slot recorded in lowmem can
be adjusted into highmem and the lowmem path then hands a highmem
address to phys_to_virt().
Take both from orig_addr once it is final and keep pfn in the branch
that uses it. PhysHighMem() asks the question straight from the address,
as dma-debug already does.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5f89468e2f060031cd89fd4287298e0eaf246bf6 Version: 5f89468e2f060031cd89fd4287298e0eaf246bf6 Version: 5f89468e2f060031cd89fd4287298e0eaf246bf6 Version: 5f89468e2f060031cd89fd4287298e0eaf246bf6 Version: e6108147dd91b94d1979b110f265710c254c99d5 Version: e77b796eb9b7ca3c1c0d574d0c155f55b59ca8d5 Version: 5.10.47 ≤ Version: 5.12.14 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/dma/swiotlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6e53b4d6afbde626255805d438cabb1cac482445",
"status": "affected",
"version": "5f89468e2f060031cd89fd4287298e0eaf246bf6",
"versionType": "git"
},
{
"lessThan": "aa4709813b29db89f2307f968db5d24925dcdeb1",
"status": "affected",
"version": "5f89468e2f060031cd89fd4287298e0eaf246bf6",
"versionType": "git"
},
{
"lessThan": "0219b72f5c209732b2f03a8cc0d7240b5e428a99",
"status": "affected",
"version": "5f89468e2f060031cd89fd4287298e0eaf246bf6",
"versionType": "git"
},
{
"lessThan": "b7d7914a9ae3097e63d113007e4fb44d33d515b1",
"status": "affected",
"version": "5f89468e2f060031cd89fd4287298e0eaf246bf6",
"versionType": "git"
},
{
"status": "affected",
"version": "e6108147dd91b94d1979b110f265710c254c99d5",
"versionType": "git"
},
{
"status": "affected",
"version": "e77b796eb9b7ca3c1c0d574d0c155f55b59ca8d5",
"versionType": "git"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.47",
"versionType": "semver"
},
{
"lessThan": "5.13",
"status": "affected",
"version": "5.12.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/dma/swiotlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nswiotlb: use the adjusted address for the highmem page lookup\n\nswiotlb_bounce() reads the page frame number from the slot\u0027s recorded\norig_addr, then advances orig_addr by tlb_offset to reach the address\nthe caller asked about. The highmem branch mixes the two: the offset\nwithin the page comes from the adjusted address, the page from the value\nbefore it.\n\nOnce the adjustment crosses a page boundary the pair no longer describes\none location, and the whole copy lands one page below the intended one\nfor a positive tlb_offset, one above for a negative one. DMA_FROM_DEVICE\nwrites the device data over the wrong page and leaves the intended one\nstale, DMA_TO_DEVICE feeds the device from a page the mapping may not\ncover. Partial syncs through dma_sync_single_range_for_*() are what make\ntlb_offset non-zero.\n\nThe branch test is picked the same way, so a slot recorded in lowmem can\nbe adjusted into highmem and the lowmem path then hands a highmem\naddress to phys_to_virt().\n\nTake both from orig_addr once it is final and keep pfn in the branch\nthat uses it. PhysHighMem() asks the question straight from the address,\nas dma-debug already does."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The defect is in swiotlb_bounce(), reached only via __swiotlb_sync_single_for_cpu/_for_device from a driver\u0027s dma_sync_single_range_for_*() on a bounced buffer. No protocol message carries malformed input, and a local user can only cause it by doing I/O on a highmem buffer through such a driver.\nAC:L - Not used; the AC line below is the real value.\nPR:L - The attacker needs an ordinary local account to issue I/O whose buffers (user or page-cache pages, which can be highmem) go through an affected device\u0027s streaming DMA mapping. No capability check on the swiotlb sync path stands in the way.\nUI:N - Once the attacker\u0027s own I/O drives the partial-sync pattern, no victim action is needed. The bounce runs inside the driver\u0027s sync call.\nS:U - The bad copy is done by the kernel\u0027s own swiotlb code into kernel-managed physical memory. No IOMMU, VM or other boundary is crossed beyond the kernel\u0027s own authority.\nC:H - On DMA_TO_DEVICE, memcpy_from_page() uses pfn_to_page(PFN_DOWN(old orig_addr)) and feeds the device a whole neighbouring physical page the mapping does not cover. This can expose unrelated kernel or user data to the device.\nI:H - On DMA_FROM_DEVICE, memcpy_to_page() writes device data over the page next to the intended one, corrupting arbitrary neighbouring memory. Separately, a lowmem slot shifted into highmem sends a highmem address to phys_to_virt() and memcpy() through a bogus pointer.\nA:H - Overwriting an unrelated physical page, or calling memcpy() on a bogus phys_to_virt() pointer for a highmem address, can corrupt kernel state or fault and oops the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:25.551Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6e53b4d6afbde626255805d438cabb1cac482445"
},
{
"url": "https://git.kernel.org/stable/c/aa4709813b29db89f2307f968db5d24925dcdeb1"
},
{
"url": "https://git.kernel.org/stable/c/0219b72f5c209732b2f03a8cc0d7240b5e428a99"
},
{
"url": "https://git.kernel.org/stable/c/b7d7914a9ae3097e63d113007e4fb44d33d515b1"
}
],
"title": "swiotlb: use the adjusted address for the highmem page lookup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98254",
"datePublished": "2026-10-06T08:45:20.736Z",
"dateReserved": "2026-09-25T10:25:14.331Z",
"dateUpdated": "2026-10-19T09:16:25.551Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98375 (GCVE-0-2026-98375)
Vulnerability from cvelistv5
Published
2026-10-09 07:10
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xen/netfront: drop RX packets with a short Ethernet header
handle_incoming_queue() pulls pull_to bytes into the head before
calling eth_type_trans(). pull_to is the length of the first RX slot,
capped at RX_COPY_THRESHOLD, and that length comes from the backend.
Nothing checks it against ETH_HLEN.
If the first slot is shorter than ETH_HLEN and more slots follow, the
head ends up shorter than an Ethernet header while skb->len is longer,
and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is
shorter than ETH_HLEN, eth_type_trans() reads the header past the end
of the data instead.
Pull at least ETH_HLEN, and drop the packet if that fails, which also
drops packets too short to hold an Ethernet header. This also checks
the return value of the pull, which was ignored.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-09T11:08:05.387Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-522.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/09/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/xen-netfront.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0542d213253eec18785a24b603b28bd385dfe4a5",
"status": "affected",
"version": "0d160211965b79de989cf2d170985abeb8da5ec6",
"versionType": "git"
},
{
"lessThan": "236a17caebcff31f75bec5ff4136bde2de944e40",
"status": "affected",
"version": "0d160211965b79de989cf2d170985abeb8da5ec6",
"versionType": "git"
},
{
"lessThan": "72d2f54367895d6e236b9857892e2e6b6036e067",
"status": "affected",
"version": "0d160211965b79de989cf2d170985abeb8da5ec6",
"versionType": "git"
},
{
"lessThan": "e2b721bc30f40ffa7ccc36a56d4e8990b8c0538e",
"status": "affected",
"version": "0d160211965b79de989cf2d170985abeb8da5ec6",
"versionType": "git"
},
{
"lessThan": "089e58805c452e52179482b1025a8e309a57f801",
"status": "affected",
"version": "0d160211965b79de989cf2d170985abeb8da5ec6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/xen-netfront.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/netfront: drop RX packets with a short Ethernet header\n\nhandle_incoming_queue() pulls pull_to bytes into the head before\ncalling eth_type_trans(). pull_to is the length of the first RX slot,\ncapped at RX_COPY_THRESHOLD, and that length comes from the backend.\nNothing checks it against ETH_HLEN.\n\nIf the first slot is shorter than ETH_HLEN and more slots follow, the\nhead ends up shorter than an Ethernet header while skb-\u003elen is longer,\nand eth_type_trans() BUG()s in __skb_pull(). If the whole packet is\nshorter than ETH_HLEN, eth_type_trans() reads the header past the end\nof the data instead.\n\nPull at least ETH_HLEN, and drop the packet if that fails, which also\ndrops packets too short to hold an Ethernet header. This also checks\nthe return value of the pull, which was ignored."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:59.248Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0542d213253eec18785a24b603b28bd385dfe4a5"
},
{
"url": "https://git.kernel.org/stable/c/236a17caebcff31f75bec5ff4136bde2de944e40"
},
{
"url": "https://git.kernel.org/stable/c/72d2f54367895d6e236b9857892e2e6b6036e067"
},
{
"url": "https://git.kernel.org/stable/c/e2b721bc30f40ffa7ccc36a56d4e8990b8c0538e"
},
{
"url": "https://git.kernel.org/stable/c/089e58805c452e52179482b1025a8e309a57f801"
}
],
"title": "xen/netfront: drop RX packets with a short Ethernet header",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98375",
"datePublished": "2026-10-09T07:10:45.930Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-21T12:54:59.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97620 (GCVE-0-2026-97620)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-19 09:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches
emit_render_cache_flush() sets PIPE_CONTROL0_HDC_PIPELINE_FLUSH to
flush the L2/HDC data cache before fence signalling, but it never
requests a flush of the LSC untyped L1 data cache via the 'Untyped
Data-Port Cache Flush Enable' bit in PIPE_CONTROL DWord0[11].
Per the Bspec, in 3D pipeline mode HDC Pipeline Flush is documented to
also flush/invalidate the untyped L1 cache, but only depending on how
HDC_CHICKEN0[13:11] is programmed. Starting with MTL, this coupling
between HDC Pipeline Flush and the untyped L1 cache flush no longer
holds in practice, regardless of how HDC_CHICKEN0 is programmed, so
relying on it is not safe on newer platforms such as BMG. Mesa's Vulkan
driver (anv) has been assuming the kernel flushes both caches between
submissions, and hit user-visible corruption in apps such as Llama.cpp
because of this gap; it now works around it by flushing both caches
again from userspace at the end of every command buffer.
Correctness between submissions on the same queue is userspace's
responsibility and belongs in Mesa, not the kernel. However, for
security we must ensure stale data can't leak through the untyped L1
dataport cache once memory is reclaimed or evicted, which requires the
KMD to flush it before releasing memory for reuse.
Prior to MTL, HDC_CHICKEN0 could be programmed (as already done for
DG2 via Wa_22010960976/Wa_14013347512) to reliably keep HDC Pipeline
Flush coupled to the untyped L1 cache flush, so those platforms are
unaffected. Mesa's own anv driver found that on MTL the HW
disconnected the two independently of how HDC_CHICKEN0 is programmed,
and could not bring the old behavior back even by writing the register
by hand; see Mesa commit 7c2ff46a4fc3 ("anv: don't prevent L1 untyped
cache flush in 3D mode"). The kernel can't reliably request the flush
from the CS on MTL either, so restrict the new PIPE_CONTROL bit to
GRAPHICS_VERx100 >= 2000 (Xe2 and later), where it can be relied on.
Explicitly set PIPE_CONTROL0_UNTYPED_DATAPORT_CACHE_FLUSH together
with PIPE_CONTROL0_HDC_PIPELINE_FLUSH in emit_render_cache_flush() on
Xe2 and later, so the L1 data cache is known clean before memory is
released for reuse, without depending on undocumented
platform-specific HDC_CHICKEN0 behavior.
Bspec: 56551
(cherry picked from commit 434514b6fe731e873808297c268fc52cdf4a1ce6)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/instructions/xe_gpu_commands.h",
"drivers/gpu/drm/xe/xe_ring_ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d73975c121f56fe3fcbbfcfe3ea8853b9f597ab3",
"status": "affected",
"version": "9f8f93bee3efdba3bf7853befe2219e3a300c305",
"versionType": "git"
},
{
"lessThan": "fab569a69c3ae9beced68307e36048efa2709bec",
"status": "affected",
"version": "9f8f93bee3efdba3bf7853befe2219e3a300c305",
"versionType": "git"
},
{
"lessThan": "92393fc5227b2b701f2b1530c9cd6dac6ee90b71",
"status": "affected",
"version": "9f8f93bee3efdba3bf7853befe2219e3a300c305",
"versionType": "git"
},
{
"lessThan": "f5fcf7e638b904397ec0f66d3ea6766ef0cfe25b",
"status": "affected",
"version": "9f8f93bee3efdba3bf7853befe2219e3a300c305",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/instructions/xe_gpu_commands.h",
"drivers/gpu/drm/xe/xe_ring_ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches\n\nemit_render_cache_flush() sets PIPE_CONTROL0_HDC_PIPELINE_FLUSH to\nflush the L2/HDC data cache before fence signalling, but it never\nrequests a flush of the LSC untyped L1 data cache via the \u0027Untyped\nData-Port Cache Flush Enable\u0027 bit in PIPE_CONTROL DWord0[11].\n\nPer the Bspec, in 3D pipeline mode HDC Pipeline Flush is documented to\nalso flush/invalidate the untyped L1 cache, but only depending on how\nHDC_CHICKEN0[13:11] is programmed. Starting with MTL, this coupling\nbetween HDC Pipeline Flush and the untyped L1 cache flush no longer\nholds in practice, regardless of how HDC_CHICKEN0 is programmed, so\nrelying on it is not safe on newer platforms such as BMG. Mesa\u0027s Vulkan\ndriver (anv) has been assuming the kernel flushes both caches between\nsubmissions, and hit user-visible corruption in apps such as Llama.cpp\nbecause of this gap; it now works around it by flushing both caches\nagain from userspace at the end of every command buffer.\n\nCorrectness between submissions on the same queue is userspace\u0027s\nresponsibility and belongs in Mesa, not the kernel. However, for\nsecurity we must ensure stale data can\u0027t leak through the untyped L1\ndataport cache once memory is reclaimed or evicted, which requires the\nKMD to flush it before releasing memory for reuse.\n\nPrior to MTL, HDC_CHICKEN0 could be programmed (as already done for\nDG2 via Wa_22010960976/Wa_14013347512) to reliably keep HDC Pipeline\nFlush coupled to the untyped L1 cache flush, so those platforms are\nunaffected. Mesa\u0027s own anv driver found that on MTL the HW\ndisconnected the two independently of how HDC_CHICKEN0 is programmed,\nand could not bring the old behavior back even by writing the register\nby hand; see Mesa commit 7c2ff46a4fc3 (\"anv: don\u0027t prevent L1 untyped\ncache flush in 3D mode\"). The kernel can\u0027t reliably request the flush\nfrom the CS on MTL either, so restrict the new PIPE_CONTROL bit to\nGRAPHICS_VERx100 \u003e= 2000 (Xe2 and later), where it can be relied on.\n\nExplicitly set PIPE_CONTROL0_UNTYPED_DATAPORT_CACHE_FLUSH together\nwith PIPE_CONTROL0_HDC_PIPELINE_FLUSH in emit_render_cache_flush() on\nXe2 and later, so the L1 data cache is known clean before memory is\nreleased for reuse, without depending on undocumented\nplatform-specific HDC_CHICKEN0 behavior.\n\nBspec: 56551\n(cherry picked from commit 434514b6fe731e873808297c268fc52cdf4a1ce6)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:10:23.752Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d73975c121f56fe3fcbbfcfe3ea8853b9f597ab3"
},
{
"url": "https://git.kernel.org/stable/c/fab569a69c3ae9beced68307e36048efa2709bec"
},
{
"url": "https://git.kernel.org/stable/c/92393fc5227b2b701f2b1530c9cd6dac6ee90b71"
},
{
"url": "https://git.kernel.org/stable/c/f5fcf7e638b904397ec0f66d3ea6766ef0cfe25b"
}
],
"title": "drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97620",
"datePublished": "2026-09-25T10:22:26.242Z",
"dateReserved": "2026-09-24T16:01:01.159Z",
"dateUpdated": "2026-10-19T09:10:23.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98298 (GCVE-0-2026-98298)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
In mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist
putting each entry into 'sg', but the entry length is read from 'sgl'
(the list head) instead of 'sg' (the current entry):
for_each_sg(sgl, sg, sg_len, i) {
addr = sg_dma_address(sg);
avail = sg_dma_len(sgl); /* should be 'sg' */
Consequently 'avail' is always the length of the first entry. For
multi-sg lists this causes out-of-bounds reads when a later entry is
shorter than the first, and silent data loss when it is longer.
Single-sg or uniformly-sized lists happen to mask the issue.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 Version: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 Version: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 Version: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 Version: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 Version: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 Version: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 Version: c8acd6aa6bed3c0fd7898202f4ebc534db9085f2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/mmp_pdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f448a5f5bd10d792440a1b08cf2e8f311767032d",
"status": "affected",
"version": "c8acd6aa6bed3c0fd7898202f4ebc534db9085f2",
"versionType": "git"
},
{
"lessThan": "2148db529f082d6e3ca95413bf943442f4ef30cc",
"status": "affected",
"version": "c8acd6aa6bed3c0fd7898202f4ebc534db9085f2",
"versionType": "git"
},
{
"lessThan": "d920c07aa6d89ec11afdb6976aafaee9563a5234",
"status": "affected",
"version": "c8acd6aa6bed3c0fd7898202f4ebc534db9085f2",
"versionType": "git"
},
{
"lessThan": "4a33886057e6d127555efb022879c583e966acc5",
"status": "affected",
"version": "c8acd6aa6bed3c0fd7898202f4ebc534db9085f2",
"versionType": "git"
},
{
"lessThan": "88a505330eb06128f7ce79a4c5e4832b7601b3d1",
"status": "affected",
"version": "c8acd6aa6bed3c0fd7898202f4ebc534db9085f2",
"versionType": "git"
},
{
"lessThan": "bae65e4925928f77824ca0103122e2ed20ef5802",
"status": "affected",
"version": "c8acd6aa6bed3c0fd7898202f4ebc534db9085f2",
"versionType": "git"
},
{
"lessThan": "54ccc01012a240476edf641bf1a2b8bff54fe6ae",
"status": "affected",
"version": "c8acd6aa6bed3c0fd7898202f4ebc534db9085f2",
"versionType": "git"
},
{
"lessThan": "075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47",
"status": "affected",
"version": "c8acd6aa6bed3c0fd7898202f4ebc534db9085f2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/mmp_pdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()\n\nIn mmp_pdma_prep_slave_sg(), for_each_sg() iterates the scatterlist\nputting each entry into \u0027sg\u0027, but the entry length is read from \u0027sgl\u0027\n(the list head) instead of \u0027sg\u0027 (the current entry):\n\n for_each_sg(sgl, sg, sg_len, i) {\n addr = sg_dma_address(sg);\n avail = sg_dma_len(sgl); /* should be \u0027sg\u0027 */\n\nConsequently \u0027avail\u0027 is always the length of the first entry. For\nmulti-sg lists this causes out-of-bounds reads when a later entry is\nshorter than the first, and silent data loss when it is longer.\nSingle-sg or uniformly-sized lists happen to mask the issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:09.166Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f448a5f5bd10d792440a1b08cf2e8f311767032d"
},
{
"url": "https://git.kernel.org/stable/c/2148db529f082d6e3ca95413bf943442f4ef30cc"
},
{
"url": "https://git.kernel.org/stable/c/d920c07aa6d89ec11afdb6976aafaee9563a5234"
},
{
"url": "https://git.kernel.org/stable/c/4a33886057e6d127555efb022879c583e966acc5"
},
{
"url": "https://git.kernel.org/stable/c/88a505330eb06128f7ce79a4c5e4832b7601b3d1"
},
{
"url": "https://git.kernel.org/stable/c/bae65e4925928f77824ca0103122e2ed20ef5802"
},
{
"url": "https://git.kernel.org/stable/c/54ccc01012a240476edf641bf1a2b8bff54fe6ae"
},
{
"url": "https://git.kernel.org/stable/c/075bc7b1d3dde5ed43fbaabbc1a69f09b7fc3a47"
}
],
"title": "dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98298",
"datePublished": "2026-10-06T08:45:56.417Z",
"dateReserved": "2026-09-25T10:25:14.337Z",
"dateUpdated": "2026-10-19T09:17:09.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98359 (GCVE-0-2026-98359)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
ib_device_get_netdev() intentionally returns a referenced net_device even
when it is unregistering, so matching and cleanup callers can still find
the association. The reference keeps struct net_device allocated, but does
not guarantee that the device remains operational.
ib_get_eth_speed() uses the returned device operationally by invoking its
ethtool callback. Although that call is made under RTNL, the function does
not verify the registration state first. An asynchronous RDMA port query
can therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit
have completed.
Check for NETREG_REGISTERED while holding RTNL and return -ENODEV for a
device which is being unregistered. Keeping RTNL across the check and the
ethtool operation prevents unregister from starting between them.
Keep the speed fallback and warning under RTNL as well, so the warning can
safely read netdev->name. Drop the netdev reference before releasing RTNL
once all accesses to the device are complete.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d41861942fc55c14b6280d9568a0d0112037f065 Version: d41861942fc55c14b6280d9568a0d0112037f065 Version: d41861942fc55c14b6280d9568a0d0112037f065 Version: d41861942fc55c14b6280d9568a0d0112037f065 Version: d41861942fc55c14b6280d9568a0d0112037f065 Version: d41861942fc55c14b6280d9568a0d0112037f065 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be4b44c8b47c67a04c08b1a0aba18006b749ae6a",
"status": "affected",
"version": "d41861942fc55c14b6280d9568a0d0112037f065",
"versionType": "git"
},
{
"lessThan": "45c60ffc79771bad154f224a05753191cf1b37bc",
"status": "affected",
"version": "d41861942fc55c14b6280d9568a0d0112037f065",
"versionType": "git"
},
{
"lessThan": "520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e",
"status": "affected",
"version": "d41861942fc55c14b6280d9568a0d0112037f065",
"versionType": "git"
},
{
"lessThan": "a219459fbd1b2598e63c81a52847eba6c28b72d2",
"status": "affected",
"version": "d41861942fc55c14b6280d9568a0d0112037f065",
"versionType": "git"
},
{
"lessThan": "5bd42f74ec3b4f4687fb600f367af0828d513b3c",
"status": "affected",
"version": "d41861942fc55c14b6280d9568a0d0112037f065",
"versionType": "git"
},
{
"lessThan": "ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5",
"status": "affected",
"version": "d41861942fc55c14b6280d9568a0d0112037f065",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Reject unregistering netdevs in ib_get_eth_speed\n\nib_device_get_netdev() intentionally returns a referenced net_device even\nwhen it is unregistering, so matching and cleanup callers can still find\nthe association. The reference keeps struct net_device allocated, but does\nnot guarantee that the device remains operational.\n\nib_get_eth_speed() uses the returned device operationally by invoking its\nethtool callback. Although that call is made under RTNL, the function does\nnot verify the registration state first. An asynchronous RDMA port query\ncan therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit\nhave completed.\n\nCheck for NETREG_REGISTERED while holding RTNL and return -ENODEV for a\ndevice which is being unregistered. Keeping RTNL across the check and the\nethtool operation prevents unregister from starting between them.\n\nKeep the speed fallback and warning under RTNL as well, so the warning can\nsafely read netdev-\u003ename. Drop the netdev reference before releasing RTNL\nonce all accesses to the device are complete."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - ib_get_eth_speed() is reached via ib_query_port() -\u003e driver query_port (rxe_query_port, siw_query_port, irdma, bnxt_re, hns, mana, erdma...) from local uverbs QUERY_PORT ioctls on /dev/infiniband/uverbs*, RDMA_NLDEV_CMD_PORT_GET netlink or the ib cache work; no remote peer supplies data to this path.\nAC:H - The faulty call needs the port\u0027s bound netdev to be between NETDEV_UNREGISTER/ndo_uninit and the queued ib_unregister_device_queued() teardown. The querying user can hammer query_port, but unregistering that netdev is an admin or driver action they cannot arrange on demand.\nPR:L - The query side needs no capability: RDMA_NLDEV_CMD_PORT_GET has no RDMA_NL_ADMIN_PERM flag, and uverbs query_port only needs an open uverbs device. Binding rxe/siw via RDMA_NLDEV_CMD_NEWLINK needs init-ns CAP_NET_ADMIN, so the attacker relies on an existing RoCE/iWARP port.\nUI:N - No victim action is needed. The attacker only issues port queries, and the unregister event is a system state change (counted under AC:H), not a user being tricked into doing something.\nS:U - The bug and its impact are both in the host kernel. No VM, IOMMU or sandbox boundary is crossed.\nC:H - __ethtool_get_link_ksettings() runs on a netdev whose ndo_uninit has already run. For example, ipvlan_ethtool_get_link_ksettings() dereferences ipvlan-\u003ephy_dev after ipvlan_port_put() dropped the port\u0027s phy_dev reference, which lets freed net_device memory be read.\nI:H - The stale or freed lower net_device is used to load and call ethtool_ops-\u003eget_link_ksettings through a function pointer. A use-after-free that reaches an indirect call can be groomed toward control-flow hijack.\nA:H - syzbot hit this as a kernel crash. Calling ethtool callbacks on a torn-down device (freed pcpu/port state in macvlan/ipvlan/team uninit) oopses the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:09.934Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be4b44c8b47c67a04c08b1a0aba18006b749ae6a"
},
{
"url": "https://git.kernel.org/stable/c/45c60ffc79771bad154f224a05753191cf1b37bc"
},
{
"url": "https://git.kernel.org/stable/c/520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e"
},
{
"url": "https://git.kernel.org/stable/c/a219459fbd1b2598e63c81a52847eba6c28b72d2"
},
{
"url": "https://git.kernel.org/stable/c/5bd42f74ec3b4f4687fb600f367af0828d513b3c"
},
{
"url": "https://git.kernel.org/stable/c/ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5"
}
],
"title": "RDMA/core: Reject unregistering netdevs in ib_get_eth_speed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98359",
"datePublished": "2026-10-06T08:46:45.938Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:09.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98229 (GCVE-0-2026-98229)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: save input state data before secpath resets
xfrm_input() stores the current xfrm_state in the skb secpath while it
continues receive-side processing. Some input paths can reset that secpath
before xfrm_input() has finished dereferencing the state.
Receive callback users such as VTI and XFRM interfaces can reset the
secpath. The VTI receive path does so before checking whether the packet
crosses network namespaces, while the XFRM interface path does so only for
cross-network-namespace packets. The XFRM_MAX_DEPTH error path can also
reset the secpath before the final drop callback reports the current
state's protocol.
If secpath_reset() drops the last state reference while the state is
concurrently deleted, xfrm_input() can still dereference the freed state
when selecting transport_finish() or reporting the drop callback protocol.
Save the state protocol on the stack while the state is still valid,
and use the already saved address family for transport_finish(). A larval
XFRM_STATE_ACQ state has no type, so retain nexthdr as its protocol. This
preserves the existing drop-path fallback while avoiding the post-reset
state dereferences without adding an extra state reference to every
received packet.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "35de97850987b3d022ed17df5b2577242e746daf",
"status": "affected",
"version": "df3893c176e9b0bb39b28ab5ec8113fa20ad1ee0",
"versionType": "git"
},
{
"lessThan": "148db154066b066616b82c12d373e786eba1f96a",
"status": "affected",
"version": "df3893c176e9b0bb39b28ab5ec8113fa20ad1ee0",
"versionType": "git"
},
{
"lessThan": "537a5ae18b2be70f8eb0aca843682e81a69aab91",
"status": "affected",
"version": "df3893c176e9b0bb39b28ab5ec8113fa20ad1ee0",
"versionType": "git"
},
{
"lessThan": "3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa",
"status": "affected",
"version": "df3893c176e9b0bb39b28ab5ec8113fa20ad1ee0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: save input state data before secpath resets\n\nxfrm_input() stores the current xfrm_state in the skb secpath while it\ncontinues receive-side processing. Some input paths can reset that secpath\nbefore xfrm_input() has finished dereferencing the state.\n\nReceive callback users such as VTI and XFRM interfaces can reset the\nsecpath. The VTI receive path does so before checking whether the packet\ncrosses network namespaces, while the XFRM interface path does so only for\ncross-network-namespace packets. The XFRM_MAX_DEPTH error path can also\nreset the secpath before the final drop callback reports the current\nstate\u0027s protocol.\n\nIf secpath_reset() drops the last state reference while the state is\nconcurrently deleted, xfrm_input() can still dereference the freed state\nwhen selecting transport_finish() or reporting the drop callback protocol.\n\nSave the state protocol on the stack while the state is still valid,\nand use the already saved address family for transport_finish(). A larval\nXFRM_STATE_ACQ state has no type, so retain nexthdr as its protocol. This\npreserves the existing drop-path fallback while avoiding the post-reset\nstate dereferences without adding an extra state reference to every\nreceived packet."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Freeing the state requires deleting the SA while xfrm_input() is still using it; the packet bytes themselves are not malformed. The attacker who can both inject ESP into a VTI/xfrmi device and send XFRM_MSG_DELSA is a local user acting through netlink in their own netns. A remote IPsec peer cannot delete the SA at will.\nAC:L - placeholder\nPR:L - placeholder\nUI:N - placeholder\nS:U - placeholder\nC:H - placeholder\nI:H - placeholder\nA:H - placeholder"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:01.147Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/35de97850987b3d022ed17df5b2577242e746daf"
},
{
"url": "https://git.kernel.org/stable/c/148db154066b066616b82c12d373e786eba1f96a"
},
{
"url": "https://git.kernel.org/stable/c/537a5ae18b2be70f8eb0aca843682e81a69aab91"
},
{
"url": "https://git.kernel.org/stable/c/3cf5cdecd99c9c186a5ea518d93bbf3045b6e3aa"
}
],
"title": "xfrm: save input state data before secpath resets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98229",
"datePublished": "2026-10-06T08:45:03.904Z",
"dateReserved": "2026-09-25T10:25:14.328Z",
"dateUpdated": "2026-10-19T09:16:01.147Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98412 (GCVE-0-2026-98412)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()
If memory allocation fails in pwrseq_unit_setup_deps(), pwrseq_unit_put()
is called to release the partially initialized unit. However, we've
never initialized unit->list and pwrseq_unit_release() will
unconditionally call list_del() on it. Initialize unit->list right after
allocating the unit struct.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/sequencing/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "29e03670cc384561a2037c69b0a1cc5232d3c6c3",
"status": "affected",
"version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
"versionType": "git"
},
{
"lessThan": "859880b07a75c7a29d141abfacbd750d25a8e920",
"status": "affected",
"version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
"versionType": "git"
},
{
"lessThan": "6e571aea60de7f4c62b77510495d1bcc7df406a1",
"status": "affected",
"version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
"versionType": "git"
},
{
"lessThan": "115b303e8e093d964089ec6f3c40d984d77b33d0",
"status": "affected",
"version": "249ebf3f65f8530beb2cbfb91bff1d83ba88d23c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/sequencing/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()\n\nIf memory allocation fails in pwrseq_unit_setup_deps(), pwrseq_unit_put()\nis called to release the partially initialized unit. However, we\u0027ve\nnever initialized unit-\u003elist and pwrseq_unit_release() will\nunconditionally call list_del() on it. Initialize unit-\u003elist right after\nallocating the unit struct."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:06.280Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/29e03670cc384561a2037c69b0a1cc5232d3c6c3"
},
{
"url": "https://git.kernel.org/stable/c/859880b07a75c7a29d141abfacbd750d25a8e920"
},
{
"url": "https://git.kernel.org/stable/c/6e571aea60de7f4c62b77510495d1bcc7df406a1"
},
{
"url": "https://git.kernel.org/stable/c/115b303e8e093d964089ec6f3c40d984d77b33d0"
}
],
"title": "power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98412",
"datePublished": "2026-10-14T13:27:44.772Z",
"dateReserved": "2026-09-25T10:25:14.347Z",
"dateUpdated": "2026-10-19T09:19:06.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98249 (GCVE-0-2026-98249)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
swsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub
vectors with an hvc, but never passes the arguments. x0 is not set to
HVC_SET_VECTORS and x1 is not set to the vector address, so the stub
dispatch falls through and returns without writing vbar_el2. EL2 is
left pointing at the trans_pgd copy of the vectors, a page that
swsusp_free() releases right after resume.
Set the arguments up the same way __hyp_set_vectors() does.
Without this fix, Vladimir was able to trigger a hang when resuming from
hibernation with CONFIG_PAGE_POISONING=y and page_poison=on.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 788bfdd97434982b6d575062581e8e72eea755af Version: 788bfdd97434982b6d575062581e8e72eea755af Version: 788bfdd97434982b6d575062581e8e72eea755af Version: 788bfdd97434982b6d575062581e8e72eea755af Version: 788bfdd97434982b6d575062581e8e72eea755af Version: 788bfdd97434982b6d575062581e8e72eea755af |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kernel/hibernate-asm.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6646418d1032cac25110526161f60d255ed08397",
"status": "affected",
"version": "788bfdd97434982b6d575062581e8e72eea755af",
"versionType": "git"
},
{
"lessThan": "909e92423db7299e0206232051aa21fe129f65d0",
"status": "affected",
"version": "788bfdd97434982b6d575062581e8e72eea755af",
"versionType": "git"
},
{
"lessThan": "60a3c319f1127c4d247d4ed235c5d65376d5e745",
"status": "affected",
"version": "788bfdd97434982b6d575062581e8e72eea755af",
"versionType": "git"
},
{
"lessThan": "e80ea8118a073a30ebe7a31bd78938c2b1751acc",
"status": "affected",
"version": "788bfdd97434982b6d575062581e8e72eea755af",
"versionType": "git"
},
{
"lessThan": "d3f8f773312af69eaf4dda106d76d6d42e4362e5",
"status": "affected",
"version": "788bfdd97434982b6d575062581e8e72eea755af",
"versionType": "git"
},
{
"lessThan": "955d86e5f3b95b731991fdb84966c50b16314629",
"status": "affected",
"version": "788bfdd97434982b6d575062581e8e72eea755af",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kernel/hibernate-asm.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc\n\nswsusp_arch_suspend_exit() reinstalls the restored kernel\u0027s hyp stub\nvectors with an hvc, but never passes the arguments. x0 is not set to\nHVC_SET_VECTORS and x1 is not set to the vector address, so the stub\ndispatch falls through and returns without writing vbar_el2. EL2 is\nleft pointing at the trans_pgd copy of the vectors, a page that\nswsusp_free() releases right after resume.\n\nSet the arguments up the same way __hyp_set_vectors() does.\n\nWithout this fix, Vladimir was able to trigger a hang when resuming from\nhibernation with CONFIG_PAGE_POISONING=y and page_poison=on."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:20.676Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6646418d1032cac25110526161f60d255ed08397"
},
{
"url": "https://git.kernel.org/stable/c/909e92423db7299e0206232051aa21fe129f65d0"
},
{
"url": "https://git.kernel.org/stable/c/60a3c319f1127c4d247d4ed235c5d65376d5e745"
},
{
"url": "https://git.kernel.org/stable/c/e80ea8118a073a30ebe7a31bd78938c2b1751acc"
},
{
"url": "https://git.kernel.org/stable/c/d3f8f773312af69eaf4dda106d76d6d42e4362e5"
},
{
"url": "https://git.kernel.org/stable/c/955d86e5f3b95b731991fdb84966c50b16314629"
}
],
"title": "arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98249",
"datePublished": "2026-10-06T08:45:17.414Z",
"dateReserved": "2026-09-25T10:25:14.331Z",
"dateUpdated": "2026-10-19T09:16:20.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98406 (GCVE-0-2026-98406)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
ieee80211_set_bitrate_mask() checks if the interface is running via
ieee80211_sdata_running(), but it does not check if the interface is
still present in the driver.
When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the
call reaches drv_set_bitrate_mask() in driver-ops.h which hits
wlan1: Failed check-sdata-in-driver check, flags: 0x0
WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask
Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows
wext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling
ioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate()
in wext-compat.c. That builds a bitrate mask and calls
rdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in
cfg.c. The interface is marked running via SDATA_STATE_RUNNING but
flags is 0, so check_sdata_in_driver() fails.
When the interface is being torn down, or when wext ioctl is issued
during interface bringup before drv_add_interface() sets IN_DRIVER, the
running check passes while IN_DRIVER is clear.
Check IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before
calling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in
driver-ops.h and matches other cfg.c operations that bail early when not
in driver.
This change should be safe because wiphy mutex is held in
cfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared
under RTNL and wiphy paths in drv_add_interface() and
drv_remove_interface() in driver-ops.c, so the check is race-free
against driver add/remove. Returning -ENETDOWN is the same error other
not-running paths use and does not introduce new locking.
[also add second syzbot report]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 554a43d5e77e8256aa9685ffd19ad555e6f77979 Version: 554a43d5e77e8256aa9685ffd19ad555e6f77979 Version: 554a43d5e77e8256aa9685ffd19ad555e6f77979 Version: 554a43d5e77e8256aa9685ffd19ad555e6f77979 Version: 554a43d5e77e8256aa9685ffd19ad555e6f77979 Version: 554a43d5e77e8256aa9685ffd19ad555e6f77979 Version: 554a43d5e77e8256aa9685ffd19ad555e6f77979 Version: 554a43d5e77e8256aa9685ffd19ad555e6f77979 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/cfg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4ba86c44b2fcb1c3175caa2456b6d58f483446ab",
"status": "affected",
"version": "554a43d5e77e8256aa9685ffd19ad555e6f77979",
"versionType": "git"
},
{
"lessThan": "4095b66acae9893dd13deb39a4331651cb2f822b",
"status": "affected",
"version": "554a43d5e77e8256aa9685ffd19ad555e6f77979",
"versionType": "git"
},
{
"lessThan": "c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306",
"status": "affected",
"version": "554a43d5e77e8256aa9685ffd19ad555e6f77979",
"versionType": "git"
},
{
"lessThan": "0d1700394e9f5d0bd9bebad8d5a50edf983f52fd",
"status": "affected",
"version": "554a43d5e77e8256aa9685ffd19ad555e6f77979",
"versionType": "git"
},
{
"lessThan": "7978dda63d2b109ea9c3f7a096cd1aac6542cd54",
"status": "affected",
"version": "554a43d5e77e8256aa9685ffd19ad555e6f77979",
"versionType": "git"
},
{
"lessThan": "432c8532d5ccc2af77da43ed6ef1c80495a4efe8",
"status": "affected",
"version": "554a43d5e77e8256aa9685ffd19ad555e6f77979",
"versionType": "git"
},
{
"lessThan": "c4ee5685af444024e6222ce29f6ed36adc44ffc3",
"status": "affected",
"version": "554a43d5e77e8256aa9685ffd19ad555e6f77979",
"versionType": "git"
},
{
"lessThan": "da2ca406f45a6e21760243152ed8d2e8e72915c2",
"status": "affected",
"version": "554a43d5e77e8256aa9685ffd19ad555e6f77979",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/cfg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver\n\nieee80211_set_bitrate_mask() checks if the interface is running via\nieee80211_sdata_running(), but it does not check if the interface is\nstill present in the driver.\n\nWhen sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the\ncall reaches drv_set_bitrate_mask() in driver-ops.h which hits\n\n wlan1: Failed check-sdata-in-driver check, flags: 0x0\n WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask\n\nSyzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows\nwext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling\nioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate()\nin wext-compat.c. That builds a bitrate mask and calls\nrdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in\ncfg.c. The interface is marked running via SDATA_STATE_RUNNING but\nflags is 0, so check_sdata_in_driver() fails.\n\nWhen the interface is being torn down, or when wext ioctl is issued\nduring interface bringup before drv_add_interface() sets IN_DRIVER, the\nrunning check passes while IN_DRIVER is clear.\n\nCheck IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before\ncalling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in\ndriver-ops.h and matches other cfg.c operations that bail early when not\nin driver.\n\nThis change should be safe because wiphy mutex is held in\ncfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared\nunder RTNL and wiphy paths in drv_add_interface() and\ndrv_remove_interface() in driver-ops.c, so the check is race-free\nagainst driver add/remove. Returning -ENETDOWN is the same error other\nnot-running paths use and does not introduce new locking.\n\n[also add second syzbot report]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:59.519Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4ba86c44b2fcb1c3175caa2456b6d58f483446ab"
},
{
"url": "https://git.kernel.org/stable/c/4095b66acae9893dd13deb39a4331651cb2f822b"
},
{
"url": "https://git.kernel.org/stable/c/c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306"
},
{
"url": "https://git.kernel.org/stable/c/0d1700394e9f5d0bd9bebad8d5a50edf983f52fd"
},
{
"url": "https://git.kernel.org/stable/c/7978dda63d2b109ea9c3f7a096cd1aac6542cd54"
},
{
"url": "https://git.kernel.org/stable/c/432c8532d5ccc2af77da43ed6ef1c80495a4efe8"
},
{
"url": "https://git.kernel.org/stable/c/c4ee5685af444024e6222ce29f6ed36adc44ffc3"
},
{
"url": "https://git.kernel.org/stable/c/da2ca406f45a6e21760243152ed8d2e8e72915c2"
}
],
"title": "wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98406",
"datePublished": "2026-10-14T13:27:41.192Z",
"dateReserved": "2026-09-25T10:25:14.347Z",
"dateUpdated": "2026-10-19T09:18:59.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93179 (GCVE-0-2026-93179)
Vulnerability from cvelistv5
Published
2026-09-17 16:12
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
Reject voltage objects whose usSize is smaller than the header or would
advance the cursor past the table end, preventing an infinite loop or
heap OOB read when the VBIOS supplies a malformed VoltageObjectInfo table.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c",
"drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomfwctrl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "574af7c61f2bed37baa3b60669e428d24d2c9ae8",
"status": "affected",
"version": "c82baa28184356a75c0157129f88af42b2e7b695",
"versionType": "git"
},
{
"lessThan": "203ffe648948ca3c2f55b21118945a7a6d0884aa",
"status": "affected",
"version": "c82baa28184356a75c0157129f88af42b2e7b695",
"versionType": "git"
},
{
"lessThan": "0a6c9b3801903b6db91f3cbf148646b501dbded3",
"status": "affected",
"version": "c82baa28184356a75c0157129f88af42b2e7b695",
"versionType": "git"
},
{
"lessThan": "83c680de6d41d627c077dedb24f89d9e5be0e2a2",
"status": "affected",
"version": "c82baa28184356a75c0157129f88af42b2e7b695",
"versionType": "git"
},
{
"lessThan": "5d3cc8e388464f485d0944b87b8f9426e637d082",
"status": "affected",
"version": "c82baa28184356a75c0157129f88af42b2e7b695",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c",
"drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomfwctrl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read\n\nReject voltage objects whose usSize is smaller than the header or would\nadvance the cursor past the table end, preventing an infinite loop or\nheap OOB read when the VBIOS supplies a malformed VoltageObjectInfo table."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:11.924Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/574af7c61f2bed37baa3b60669e428d24d2c9ae8"
},
{
"url": "https://git.kernel.org/stable/c/203ffe648948ca3c2f55b21118945a7a6d0884aa"
},
{
"url": "https://git.kernel.org/stable/c/0a6c9b3801903b6db91f3cbf148646b501dbded3"
},
{
"url": "https://git.kernel.org/stable/c/83c680de6d41d627c077dedb24f89d9e5be0e2a2"
},
{
"url": "https://git.kernel.org/stable/c/5d3cc8e388464f485d0944b87b8f9426e637d082"
}
],
"title": "drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93179",
"datePublished": "2026-09-17T16:12:07.307Z",
"dateReserved": "2026-09-17T16:02:15.091Z",
"dateUpdated": "2026-10-21T12:52:11.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97950 (GCVE-0-2026-97950)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
create_link() reads the target's configfs_dirent from
item->ci_dentry->d_fsdata, relying on the item reference taken by
get_target(). That reference pins the item, not its dentry: the dentry is
pinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via
simple_rmdir() while the item is still alive. A symlink racing with rmdir
of its target can therefore find ->ci_dentry freed and its dirent
released, triggering WARN_ON(!atomic_read(&sd->s_count)) in configfs_get().
Take the dirent in get_target() as well, under ->d_lock and atomically
with the item reference, and pass it down to create_link(). A hashed
dentry has not been killed yet, so its ->d_fsdata reference keeps the
dirent alive there.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/configfs/symlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a44744454eafbc158e8c8e3ef8d207076410b195",
"status": "affected",
"version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
"versionType": "git"
},
{
"lessThan": "846ff40fd57a47e59a41f4e331ec3b34efaddc23",
"status": "affected",
"version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
"versionType": "git"
},
{
"lessThan": "4f54beb2e7f6d399396466682fba3539bcdcb414",
"status": "affected",
"version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
"versionType": "git"
},
{
"lessThan": "d47c5de1cd6bfbe1067fc310bf90e4e00205e839",
"status": "affected",
"version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
"versionType": "git"
},
{
"lessThan": "a7c1290eef60711c10289c056ad32ed1f2b47b12",
"status": "affected",
"version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/configfs/symlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.16"
},
{
"lessThan": "2.6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: pin the symlink target\u0027s dirent instead of chasing -\u003eci_dentry\n\ncreate_link() reads the target\u0027s configfs_dirent from\nitem-\u003eci_dentry-\u003ed_fsdata, relying on the item reference taken by\nget_target(). That reference pins the item, not its dentry: the dentry is\npinned by DCACHE_PERSISTENT, which configfs_remove_dir() releases via\nsimple_rmdir() while the item is still alive. A symlink racing with rmdir\nof its target can therefore find -\u003eci_dentry freed and its dirent\nreleased, triggering WARN_ON(!atomic_read(\u0026sd-\u003es_count)) in configfs_get().\n\nTake the dirent in get_target() as well, under -\u003ed_lock and atomically\nwith the item reference, and pass it down to create_link(). A hashed\ndentry has not been killed yet, so its -\u003ed_fsdata reference keeps the\ndirent alive there."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:48.740Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a44744454eafbc158e8c8e3ef8d207076410b195"
},
{
"url": "https://git.kernel.org/stable/c/846ff40fd57a47e59a41f4e331ec3b34efaddc23"
},
{
"url": "https://git.kernel.org/stable/c/4f54beb2e7f6d399396466682fba3539bcdcb414"
},
{
"url": "https://git.kernel.org/stable/c/d47c5de1cd6bfbe1067fc310bf90e4e00205e839"
},
{
"url": "https://git.kernel.org/stable/c/a7c1290eef60711c10289c056ad32ed1f2b47b12"
}
],
"title": "configfs: pin the symlink target\u0027s dirent instead of chasing -\u003eci_dentry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97950",
"datePublished": "2026-09-25T10:22:58.970Z",
"dateReserved": "2026-09-25T10:18:58.205Z",
"dateUpdated": "2026-10-21T12:53:48.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98239 (GCVE-0-2026-98239)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: lan743x: fix RX checksum use-after-free
lan743x_rx_process_buffer() adds each non-first receive buffer to the
head skb's frag_list. On the last descriptor, lan743x_rx_trim_skb()
linearizes the head and frees the fragment skb metadata.
The checksum-success path then writes ip_summed through the local skb
pointer, which still points to the final fragment. This causes a
use-after-free write when a packet spans more than one receive buffer.
Set ip_summed on the surviving head skb instead. Multi-buffer receive
can occur after a live MTU increase because existing ring entries keep
their old buffer size until they are replenished.
A KUnit test invoking lan743x_rx_process_buffer() with a two-buffer
packet produced a one-byte KASAN use-after-free write before this change.
The same test passed after the change. The driver object also builds
with W=1. This was not tested on physical LAN743x hardware.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a Version: cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a Version: cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a Version: cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a Version: cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a Version: cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/microchip/lan743x_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0e52886c4324c9897c2c62f92be3dc8316cee67e",
"status": "affected",
"version": "cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a",
"versionType": "git"
},
{
"lessThan": "a58024835c704419bb46d2a34e5223f65605f958",
"status": "affected",
"version": "cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a",
"versionType": "git"
},
{
"lessThan": "6fe5c3a2503983abb431d93faeadfc7f5e6a7e33",
"status": "affected",
"version": "cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a",
"versionType": "git"
},
{
"lessThan": "5c216bfa9fb7b36804485e67975e9c98055b31ef",
"status": "affected",
"version": "cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a",
"versionType": "git"
},
{
"lessThan": "161a403c8625e152de03d1da22bbf9cda6dc9f9f",
"status": "affected",
"version": "cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a",
"versionType": "git"
},
{
"lessThan": "a9ce4053dc945c5372dedba5017ee675b30dc0c5",
"status": "affected",
"version": "cd6910501cfd9a3bdff2f5fc33c9f3cf165ca54a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/microchip/lan743x_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan743x: fix RX checksum use-after-free\n\nlan743x_rx_process_buffer() adds each non-first receive buffer to the\nhead skb\u0027s frag_list. On the last descriptor, lan743x_rx_trim_skb()\nlinearizes the head and frees the fragment skb metadata.\n\nThe checksum-success path then writes ip_summed through the local skb\npointer, which still points to the final fragment. This causes a\nuse-after-free write when a packet spans more than one receive buffer.\n\nSet ip_summed on the surviving head skb instead. Multi-buffer receive\ncan occur after a live MTU increase because existing ring entries keep\ntheir old buffer size until they are replenished.\n\nA KUnit test invoking lan743x_rx_process_buffer() with a two-buffer\npacket produced a one-byte KASAN use-after-free write before this change.\nThe same test passed after the change. The driver object also builds\nwith W=1. This was not tested on physical LAN743x hardware."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The UAF write runs in lan743x_rx_process_buffer() (NAPI RX) while it handles an ordinary received Ethernet/IP frame from a remote sender. The sender\u0027s frame must be larger than the pre-change buffer size so the chip spreads it across several ring descriptors, which a routed jumbo-MTU path can deliver.\nAC:H - Buffers are sized mtu+ETH_HLEN+FCS+2 and the MAC caps frames at mtu+18 (MAC_RX_FSE_), so multi-buffer frames only occur after an admin raises the MTU on a live interface, while stale ring entries remain, or through the chip\u0027s occasional extra-buffer quirk. The remote attacker cannot produce either condition.\nPR:N - The trigger is a received frame with a valid checksum handled in the NAPI poll path, lan743x_rx_napi_poll -\u003e lan743x_rx_process_buffer. The sender needs no authentication or credentials on the host.\nUI:N - Once the ring holds stale smaller buffers, no user on the victim needs to do anything; sending the oversized frame triggers the stale write. The admin\u0027s MTU change is already counted in AC:H.\nS:U - The freed sk_buff and the corrupted slab memory are inside the kernel itself; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After skb_linearize() in lan743x_rx_trim_skb() frees the frag_list skb, its skbuff_head_cache slot can be reused by another skb. The stale write then hits a live object the attacker can steer with packet timing, which counts as a use-after-free per the scoring guidance.\nI:H - skb-\u003eip_summed = CHECKSUM_UNNECESSARY is written into a freed sk_buff. If the slot has been reallocated, this corrupts another live skb and can make the stack accept forged or corrupted packets without checking their checksums. It is heap memory corruption.\nA:H - Writing into a freed and possibly reused sk_buff from the RX softirq can corrupt slab state and oops or panic the kernel; KASAN flagged the write in the author\u0027s KUnit reproducer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:10.911Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0e52886c4324c9897c2c62f92be3dc8316cee67e"
},
{
"url": "https://git.kernel.org/stable/c/a58024835c704419bb46d2a34e5223f65605f958"
},
{
"url": "https://git.kernel.org/stable/c/6fe5c3a2503983abb431d93faeadfc7f5e6a7e33"
},
{
"url": "https://git.kernel.org/stable/c/5c216bfa9fb7b36804485e67975e9c98055b31ef"
},
{
"url": "https://git.kernel.org/stable/c/161a403c8625e152de03d1da22bbf9cda6dc9f9f"
},
{
"url": "https://git.kernel.org/stable/c/a9ce4053dc945c5372dedba5017ee675b30dc0c5"
}
],
"title": "net: lan743x: fix RX checksum use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98239",
"datePublished": "2026-10-06T08:45:10.611Z",
"dateReserved": "2026-09-25T10:25:14.329Z",
"dateUpdated": "2026-10-19T09:16:10.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98423 (GCVE-0-2026-98423)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
The code checks ->started for frames coming from wmediumd, but the
radio can be stopped after the check and before frame delivery,
causing mac80211 to hit the WARN_ON(!local->started).
Expand the mutex for this case and synchronise against it when the
radio is stopped to avoid being able to hit the warning with hwsim.
Drop the error print that would've complicated the error path, it
only triggers for allocation failures (already noisy) and malformed
frames anyway.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7882513bacb176ab4aacceefdd035ca9479da4fb Version: 7882513bacb176ab4aacceefdd035ca9479da4fb Version: 7882513bacb176ab4aacceefdd035ca9479da4fb Version: 7882513bacb176ab4aacceefdd035ca9479da4fb Version: 7882513bacb176ab4aacceefdd035ca9479da4fb Version: 7882513bacb176ab4aacceefdd035ca9479da4fb |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/virtual/mac80211_hwsim_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5ce9b2bc9e73213e316a8c72400256a76bf41814",
"status": "affected",
"version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
"versionType": "git"
},
{
"lessThan": "c4e4fe330294e3936e0f4e15d6996468f8a45fb2",
"status": "affected",
"version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
"versionType": "git"
},
{
"lessThan": "2f59be7585dc81baa6f36b0035dd6848ea43d318",
"status": "affected",
"version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
"versionType": "git"
},
{
"lessThan": "5c79ef616aa16af582fb2cb93b0f750975a0004f",
"status": "affected",
"version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
"versionType": "git"
},
{
"lessThan": "d7fa45d8123a7f794b93fc22dbcf19f38dc4d8cb",
"status": "affected",
"version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
"versionType": "git"
},
{
"lessThan": "87840d4a3a21b1c19b867a80e16ba69dff284de2",
"status": "affected",
"version": "7882513bacb176ab4aacceefdd035ca9479da4fb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/virtual/mac80211_hwsim_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: don\u0027t hand frames to mac80211 while stopping\n\nThe code checks -\u003estarted for frames coming from wmediumd, but the\nradio can be stopped after the check and before frame delivery,\ncausing mac80211 to hit the WARN_ON(!local-\u003estarted).\n\nExpand the mutex for this case and synchronise against it when the\nradio is stopped to avoid being able to hit the warning with hwsim.\n\nDrop the error print that would\u0027ve complicated the error path, it\nonly triggers for allocation failures (already noisy) and malformed\nframes anyway."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:16.854Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5ce9b2bc9e73213e316a8c72400256a76bf41814"
},
{
"url": "https://git.kernel.org/stable/c/c4e4fe330294e3936e0f4e15d6996468f8a45fb2"
},
{
"url": "https://git.kernel.org/stable/c/2f59be7585dc81baa6f36b0035dd6848ea43d318"
},
{
"url": "https://git.kernel.org/stable/c/5c79ef616aa16af582fb2cb93b0f750975a0004f"
},
{
"url": "https://git.kernel.org/stable/c/d7fa45d8123a7f794b93fc22dbcf19f38dc4d8cb"
},
{
"url": "https://git.kernel.org/stable/c/87840d4a3a21b1c19b867a80e16ba69dff284de2"
}
],
"title": "wifi: mac80211_hwsim: don\u0027t hand frames to mac80211 while stopping",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98423",
"datePublished": "2026-10-14T13:27:51.391Z",
"dateReserved": "2026-09-25T10:25:14.348Z",
"dateUpdated": "2026-10-19T09:19:16.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98189 (GCVE-0-2026-98189)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
wilc_wlan_handle_isr_ext() takes the RX transfer size from the
device-reported interrupt status register (a 15-bit field shifted left by 2,
up to 131068 bytes) and reads that many bytes from the device into
rx_buffer, which is only WILC_RX_BUFF_SIZE (96K) large. The wrap
check only handles the current offset; the size itself is never
compared against the buffer, so a bogus SDIO device can make the driver
OOB-write rx_buffer by up to ~32K with data it controls.
The oversized transfer also leaves rx_buffer_offset past the end of
the buffer, after which the unsigned wrap check stops working and
the overflow can repeat.
Drop any transfer whose size exceeds the RX buffer, acknowledging
the data interrupt and re-arming the RX engine so the bogus frame is
discarded and reception can continue. This also restores the
rx_buffer_offset <= WILC_RX_BUFF_SIZE invariant the wrap check
relies on.
This is not expected to change driver behavior in most cases:
without this check, an oversized transfer would most likely
corrupt neighboring kernel memory instead of completing anyway, and
the drop path performs the same interrupt acknowledgment and RX
engine re-arming as the normal path, so subsequent transfers are
received unaffected.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/microchip/wilc1000/wlan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3ddb88e237bc1e59fd37b1cf369f3b6c2dedae26",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "9f6a276ade936a8803f9f3df217c2368944dc321",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "aeb44a456d126d89863230eef0187e77e6441995",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "612ed9224eae70c53c0c88cb0990e0f9b709280a",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "304a5d72a04a3979a6434088c8d9c5172c2a908e",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "4f86fb6f9dce04f697da85806ad96a932fc2f079",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "14dcf4c3d74c878175b19d3da5986f83f26b1dd5",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "c1ba7f7f18465e259cf1b4d9c73fc73853d7f790",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/microchip/wilc1000/wlan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()\n\nwilc_wlan_handle_isr_ext() takes the RX transfer size from the\ndevice-reported interrupt status register (a 15-bit field shifted left by 2,\nup to 131068 bytes) and reads that many bytes from the device into\nrx_buffer, which is only WILC_RX_BUFF_SIZE (96K) large. The wrap\ncheck only handles the current offset; the size itself is never\ncompared against the buffer, so a bogus SDIO device can make the driver\nOOB-write rx_buffer by up to ~32K with data it controls.\n\nThe oversized transfer also leaves rx_buffer_offset past the end of\nthe buffer, after which the unsigned wrap check stops working and\nthe overflow can repeat.\n\nDrop any transfer whose size exceeds the RX buffer, acknowledging\nthe data interrupt and re-arming the RX engine so the bogus frame is\ndiscarded and reception can continue. This also restores the\nrx_buffer_offset \u003c= WILC_RX_BUFF_SIZE invariant the wrap check\nrelies on.\n\nThis is not expected to change driver behavior in most cases:\nwithout this check, an oversized transfer would most likely\ncorrupt neighboring kernel memory instead of completing anyway, and\nthe drop path performs the same interrupt acknowledgment and RX\nengine re-arming as the normal path, so subsequent transfers are\nreceived unaffected.\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:20.667Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3ddb88e237bc1e59fd37b1cf369f3b6c2dedae26"
},
{
"url": "https://git.kernel.org/stable/c/9f6a276ade936a8803f9f3df217c2368944dc321"
},
{
"url": "https://git.kernel.org/stable/c/aeb44a456d126d89863230eef0187e77e6441995"
},
{
"url": "https://git.kernel.org/stable/c/612ed9224eae70c53c0c88cb0990e0f9b709280a"
},
{
"url": "https://git.kernel.org/stable/c/304a5d72a04a3979a6434088c8d9c5172c2a908e"
},
{
"url": "https://git.kernel.org/stable/c/4f86fb6f9dce04f697da85806ad96a932fc2f079"
},
{
"url": "https://git.kernel.org/stable/c/14dcf4c3d74c878175b19d3da5986f83f26b1dd5"
},
{
"url": "https://git.kernel.org/stable/c/c1ba7f7f18465e259cf1b4d9c73fc73853d7f790"
}
],
"title": "wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98189",
"datePublished": "2026-10-06T08:44:30.807Z",
"dateReserved": "2026-09-25T10:25:14.323Z",
"dateUpdated": "2026-10-19T09:15:20.667Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89795 (GCVE-0-2026-89795)
Vulnerability from cvelistv5
Published
2026-09-16 10:30
Modified
2026-10-21 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: Allow per function PCI slots to fix slot reset on s390
On s390 systems, which use a machine level hypervisor, PCI devices are
always accessed through a form of PCI pass-through which fundamentally
operates on a per PCI function granularity. This is also reflected in the
s390 PCI hotplug driver which creates hotplug slots for individual PCI
functions. Its reset_slot() function, which is a wrapper for
zpci_hot_reset_device(), thus also resets individual functions.
Currently, the pci_create_slot() assigns the same pci_slot object to
multifunction devices. This approach worked fine on s390 systems that only
exposed virtual functions as individual PCI domains to the operating
system. Since commit 44510d6fa0c0 ("s390/pci: Handling multifunctions")
s390 supports exposing the topology of multifunction PCI devices by
grouping them in a shared PCI domain. This creates a problem when resetting
a function through the hotplug driver's slot_reset() interface.
When attempting to reset a function through the hotplug driver, the shared
slot assignment causes the wrong function to be reset instead of the
intended one. It also leaks memory as we do create a pci_slot object for
the function, but don't correctly free it in pci_slot_release().
Add a flag for struct pci_slot to allow per function PCI slots for
functions managed through a hypervisor, which exposes individual PCI
functions while retaining the topology. Since we can use all 8 bits for
slot 'number' (for ARI devices), change slot 'number' u16 to account for
special values PCI_SLOT_PLACEHOLDER and PCI_SLOT_ALL_DEVICES.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/pci.c",
"drivers/pci/slot.c",
"include/linux/pci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b4a80e9e639cf09ef5c66b7f262c9cb5ab37bdde",
"status": "affected",
"version": "44510d6fa0c00aa90b80075caa6b313b25927475",
"versionType": "git"
},
{
"lessThan": "0d1a7d67f45645106578d65181e4e492dd20ed79",
"status": "affected",
"version": "44510d6fa0c00aa90b80075caa6b313b25927475",
"versionType": "git"
},
{
"lessThan": "2050d900f9adbd6d6f38d30e182bcd9ad3108467",
"status": "affected",
"version": "44510d6fa0c00aa90b80075caa6b313b25927475",
"versionType": "git"
},
{
"lessThan": "ecdcceed4d377b02d4ea036b65f83f962c38ede7",
"status": "affected",
"version": "44510d6fa0c00aa90b80075caa6b313b25927475",
"versionType": "git"
},
{
"lessThan": "dcc5bec09e23bbc4f9de055a11fce9937244f2c8",
"status": "affected",
"version": "44510d6fa0c00aa90b80075caa6b313b25927475",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/pci.c",
"drivers/pci/slot.c",
"include/linux/pci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Allow per function PCI slots to fix slot reset on s390\n\nOn s390 systems, which use a machine level hypervisor, PCI devices are\nalways accessed through a form of PCI pass-through which fundamentally\noperates on a per PCI function granularity. This is also reflected in the\ns390 PCI hotplug driver which creates hotplug slots for individual PCI\nfunctions. Its reset_slot() function, which is a wrapper for\nzpci_hot_reset_device(), thus also resets individual functions.\n\nCurrently, the pci_create_slot() assigns the same pci_slot object to\nmultifunction devices. This approach worked fine on s390 systems that only\nexposed virtual functions as individual PCI domains to the operating\nsystem. Since commit 44510d6fa0c0 (\"s390/pci: Handling multifunctions\")\ns390 supports exposing the topology of multifunction PCI devices by\ngrouping them in a shared PCI domain. This creates a problem when resetting\na function through the hotplug driver\u0027s slot_reset() interface.\n\nWhen attempting to reset a function through the hotplug driver, the shared\nslot assignment causes the wrong function to be reset instead of the\nintended one. It also leaks memory as we do create a pci_slot object for\nthe function, but don\u0027t correctly free it in pci_slot_release().\n\nAdd a flag for struct pci_slot to allow per function PCI slots for\nfunctions managed through a hypervisor, which exposes individual PCI\nfunctions while retaining the topology. Since we can use all 8 bits for\nslot \u0027number\u0027 (for ARI devices), change slot \u0027number\u0027 u16 to account for\nspecial values PCI_SLOT_PLACEHOLDER and PCI_SLOT_ALL_DEVICES."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached from local PCI reset paths (sysfs device reset, VFIO_DEVICE_RESET, and vfio_pci_core_enable()) that call pci_try_reset_function() -\u003e pci_dev_reset_slot_function() -\u003e s390 reset_slot()/zpci_hot_reset_device(); there is no network or adjacent-radio path.\nAC:L - On s390 multifunction domains pci_create_slot() matches PCI_SLOT(devfn) against a full 8-bit slot number, so siblings/VFs are assigned the wrong pci_slot and a reset deterministically invokes the other function\u0027s hotplug reset_slot() with no race or attacker-uncontrollable layout.\nPR:L - vfio_pci_core_enable() and VFIO_DEVICE_RESET call pci_try_reset_function() with no capable() check on the IOMMU path; IBM Z/LinuxONE SR-IOV VF passthrough routinely grants that VFIO fd to an unprivileged qemu/tenant user rather than init-namespace root.\nUI:N - The attacker opens the assigned VFIO device or issues VFIO_DEVICE_RESET themselves; prior admin binding of the zPCI function to vfio-pci is deployment configuration, not victim interaction.\nS:C - Function reset uses the wrongly shared pci_slot and issues zpci_hot_reset_device() on a sibling/PF outside the caller\u0027s VFIO device set, bypassing VFIO\u0027s slot-wide membership check and crossing zPCI per-function isolation into host or other-tenant devices.\nC:N - This is a wrong-function hardware reset plus a pci_slot lifetime leak; it does not perform an out-of-bounds read, use-after-free, or other disclosure of kernel or other users\u0027 memory.\nI:H - zpci_hot_reset_device() disable/re-enable of the unintended function wipes that function\u0027s hardware state behind its owner\u0027s driver, destroying in-flight I/O and device configuration on a host PF or another tenant\u0027s NIC/storage function.\nA:H - Surprise reset of an in-use PF or sibling denies that device and all VFs behind it, and can oops the bound host driver which continues MMIO against a freshly reset zPCI function, causing host kernel availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:48:43.613Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b4a80e9e639cf09ef5c66b7f262c9cb5ab37bdde"
},
{
"url": "https://git.kernel.org/stable/c/0d1a7d67f45645106578d65181e4e492dd20ed79"
},
{
"url": "https://git.kernel.org/stable/c/2050d900f9adbd6d6f38d30e182bcd9ad3108467"
},
{
"url": "https://git.kernel.org/stable/c/ecdcceed4d377b02d4ea036b65f83f962c38ede7"
},
{
"url": "https://git.kernel.org/stable/c/dcc5bec09e23bbc4f9de055a11fce9937244f2c8"
}
],
"title": "PCI: Allow per function PCI slots to fix slot reset on s390",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89795",
"datePublished": "2026-09-16T10:30:26.529Z",
"dateReserved": "2026-09-11T19:38:34.767Z",
"dateUpdated": "2026-10-21T12:48:43.613Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97933 (GCVE-0-2026-97933)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Take trace_array reference when opening a tracer options file
When a tracer option file is opened, it is passed a descriptor that points
to an element on the trace_array's topts array. This element has
information to find the trace array and other information. It uses this
element to take a reference of the trace_array so that the trace_array
does not get removed while this file is opened.
Unfortunately, there's a race condition where the element itself could be
freed by the removal of the instance the trace_array represents causing a
use-after-free as this element that is used to find the trace_array to
increment its reference counter is also freed when the instance is
removed.
To solve this, add a trace_array_tracer_options_get() helper function that
will take the address of the element that is passed to the open function
by the inode->i_private pointer and search all the trace_arrays under a
lock to find the one that the element's address is in the range of the
trace_arrays topts array elements. When a match happens, that trace_array's
reference would be increased.
Note, there's a race where if an admin was deleting and creating trace
instances at the same time and the memory of the old trace_array's array
matched the memory of the new trace_array that it could in theory open the
option from the wrong trace array. But we do not care because it would be
stupid to perform that kind of action. As long as the only thing that can
happen is that the option from the wrong trace array is used and doesn't
crash the kernel it will only make the user confused. But if they are
doing something stupid like this, they are already confused, so no harm
done.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838 Version: 7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838 Version: 7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838 Version: 7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838 Version: 7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838 Version: 952e477f908048145a5eb2ed3d431d9efc1e1073 Version: b3183f5f05cd867f5c17122773ca5aa8d07b51af Version: bf38c1d29f8bfe9631b62a67f8dd1b8f7efb7139 Version: 2617afde0c3db285778734b0ccad9a55b4f9cda2 Version: 586787a0331aa2d7d244e9c4400d2a73295b0cf0 Version: 5.4.257 ≤ Version: 5.10.197 ≤ Version: 5.15.133 ≤ Version: 6.1.55 ≤ Version: 6.5.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace.c",
"kernel/trace/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "61894ea0d2a1ae8ce903abf73bd56958c035f182",
"status": "affected",
"version": "7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838",
"versionType": "git"
},
{
"lessThan": "b2890064a12efbeb3b3c093e69e9010dd244c881",
"status": "affected",
"version": "7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838",
"versionType": "git"
},
{
"lessThan": "d9232a90c6f7de822177d35d73d9234cba523ef9",
"status": "affected",
"version": "7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838",
"versionType": "git"
},
{
"lessThan": "b2fb87d29ffb3a7a9ccc5acf12898ecb80587427",
"status": "affected",
"version": "7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838",
"versionType": "git"
},
{
"lessThan": "ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80",
"status": "affected",
"version": "7e2cfbd2d3c86afcd5c26b5c4b1dd251f63c5838",
"versionType": "git"
},
{
"status": "affected",
"version": "952e477f908048145a5eb2ed3d431d9efc1e1073",
"versionType": "git"
},
{
"status": "affected",
"version": "b3183f5f05cd867f5c17122773ca5aa8d07b51af",
"versionType": "git"
},
{
"status": "affected",
"version": "bf38c1d29f8bfe9631b62a67f8dd1b8f7efb7139",
"versionType": "git"
},
{
"status": "affected",
"version": "2617afde0c3db285778734b0ccad9a55b4f9cda2",
"versionType": "git"
},
{
"status": "affected",
"version": "586787a0331aa2d7d244e9c4400d2a73295b0cf0",
"versionType": "git"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.257",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.197",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.133",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.55",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace.c",
"kernel/trace/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.197",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.133",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Take trace_array reference when opening a tracer options file\n\nWhen a tracer option file is opened, it is passed a descriptor that points\nto an element on the trace_array\u0027s topts array. This element has\ninformation to find the trace array and other information. It uses this\nelement to take a reference of the trace_array so that the trace_array\ndoes not get removed while this file is opened.\n\nUnfortunately, there\u0027s a race condition where the element itself could be\nfreed by the removal of the instance the trace_array represents causing a\nuse-after-free as this element that is used to find the trace_array to\nincrement its reference counter is also freed when the instance is\nremoved.\n\nTo solve this, add a trace_array_tracer_options_get() helper function that\nwill take the address of the element that is passed to the open function\nby the inode-\u003ei_private pointer and search all the trace_arrays under a\nlock to find the one that the element\u0027s address is in the range of the\ntrace_arrays topts array elements. When a match happens, that trace_array\u0027s\nreference would be increased.\n\nNote, there\u0027s a race where if an admin was deleting and creating trace\ninstances at the same time and the memory of the old trace_array\u0027s array\nmatched the memory of the new trace_array that it could in theory open the\noption from the wrong trace array. But we do not care because it would be\nstupid to perform that kind of action. As long as the only thing that can\nhappen is that the option from the wrong trace array is used and doesn\u0027t\ncrash the kernel it will only make the user confused. But if they are\ndoing something stupid like this, they are already confused, so no harm\ndone."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:42.143Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/61894ea0d2a1ae8ce903abf73bd56958c035f182"
},
{
"url": "https://git.kernel.org/stable/c/b2890064a12efbeb3b3c093e69e9010dd244c881"
},
{
"url": "https://git.kernel.org/stable/c/d9232a90c6f7de822177d35d73d9234cba523ef9"
},
{
"url": "https://git.kernel.org/stable/c/b2fb87d29ffb3a7a9ccc5acf12898ecb80587427"
},
{
"url": "https://git.kernel.org/stable/c/ed0aff60f83a9bdc2f6556376ac79c96b3ce7e80"
}
],
"title": "tracing: Take trace_array reference when opening a tracer options file",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97933",
"datePublished": "2026-09-25T10:22:48.591Z",
"dateReserved": "2026-09-25T10:18:58.203Z",
"dateUpdated": "2026-10-21T12:53:42.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98348 (GCVE-0-2026-98348)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: libipw: reject too-short association responses
libipw_handle_assoc_resp() reads the capability, status and aid fields
of the 30-byte association response prefix and then computes the
information element length as
stats->len - sizeof(*frame)
stats->len is a u16 and sizeof() has type size_t, so the subtraction is
evaluated as size_t and wraps instead of going negative. Truncating
that to the u16 length parameter of libipw_parse_info_param() turns a
frame shorter than the fixed fields into a length near 64 KiB, and the
parser then reads past the receive buffer.
Both the ipw2100 and ipw2200 management receive paths reach this
function having established only that the frame carries the generic
24-byte three-address header.
Reject the frame before any fixed field is touched.
Found by an AI-assisted review of length arithmetic in management frame
parsers. Verified with a KUnit case under Generic KASAN on arm64 under
QEMU; I do not have the hardware, so it is not tested on a real device.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9e8571affd1c54b9638b4ff9844e47aae07310f6 Version: 9e8571affd1c54b9638b4ff9844e47aae07310f6 Version: 9e8571affd1c54b9638b4ff9844e47aae07310f6 Version: 9e8571affd1c54b9638b4ff9844e47aae07310f6 Version: 9e8571affd1c54b9638b4ff9844e47aae07310f6 Version: 9e8571affd1c54b9638b4ff9844e47aae07310f6 Version: 9e8571affd1c54b9638b4ff9844e47aae07310f6 Version: 9e8571affd1c54b9638b4ff9844e47aae07310f6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/ipw2x00/libipw_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "766268b429ae26d8ca599031fa962b0fe4673120",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "d70bdb84cf1782039384c1ffa7a18b0303c286a7",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "400b89217058fac672134a0d4092c8493dadb8ad",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "46aa75291056b6dc5faaf956dffdb3e9662477b0",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "e3025ecdb2057f866c09e059fc1466e81d6f243e",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "af1b69be19c34e28c0ae54bee954b58cd076969a",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "adb7118b7d2cfd7e8213c17d7d2829f353017754",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/ipw2x00/libipw_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.15"
},
{
"lessThan": "2.6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: reject too-short association responses\n\nlibipw_handle_assoc_resp() reads the capability, status and aid fields\nof the 30-byte association response prefix and then computes the\ninformation element length as\n\n\tstats-\u003elen - sizeof(*frame)\n\nstats-\u003elen is a u16 and sizeof() has type size_t, so the subtraction is\nevaluated as size_t and wraps instead of going negative. Truncating\nthat to the u16 length parameter of libipw_parse_info_param() turns a\nframe shorter than the fixed fields into a length near 64 KiB, and the\nparser then reads past the receive buffer.\n\nBoth the ipw2100 and ipw2200 management receive paths reach this\nfunction having established only that the frame carries the generic\n24-byte three-address header.\n\nReject the frame before any fixed field is touched.\n\nFound by an AI-assisted review of length arithmetic in management frame\nparsers. Verified with a KUnit case under Generic KASAN on arm64 under\nQEMU; I do not have the hardware, so it is not tested on a real device."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The malformed input is an 802.11 Association Response management frame received over the air. ipw2100 (isr_rx path) and ipw2200 (ipw_handle_mgmt_packet) send it through libipw_rx_mgt() into libipw_handle_assoc_resp(). The attacker must be within WiFi radio range.\nAC:L - The attacker only has to send an ASSOC_RESP frame of 24-29 bytes. The drivers check only for the 24-byte header, so stats-\u003elen - sizeof(*frame) (30) wraps to about 64K in the u16 length passed to libipw_parse_info_param(). No race or special state is involved.\nPR:N - libipw_rx_mgt() processes management frames before any 802.11 authentication or key exchange. An unauthenticated nearby transmitter can inject the frame.\nUI:N - The frame is processed in the receive path as soon as the interface is up. The victim does nothing.\nS:U - The out-of-bounds read stays inside the host kernel\u0027s own memory and crosses no virtualization or IOMMU boundary.\nC:L - libipw_parse_info_param() walks up to about 64KB of memory past the receive buffer. Those bytes only fill a local libipw_network on the stack, and through the QoS IE path the qos_data that goes to firmware. Nothing is returned to the attacker, so the disclosure is limited and indirect.\nI:N - The bug is read-only. Every copy from the parsed IEs is bounded (min() on ssid/rates, an exact-size check in libipw_read_qos_param_element) and lands in the fixed-size local network struct, so nothing is written out of bounds.\nA:H - Iterating about 64KB of information elements past a few-KB skb/DMA receive buffer can hit unmapped pages (or KASAN/KFENCE) and oops the kernel. Any station in range can resend the short frame repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:59.174Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/766268b429ae26d8ca599031fa962b0fe4673120"
},
{
"url": "https://git.kernel.org/stable/c/d70bdb84cf1782039384c1ffa7a18b0303c286a7"
},
{
"url": "https://git.kernel.org/stable/c/400b89217058fac672134a0d4092c8493dadb8ad"
},
{
"url": "https://git.kernel.org/stable/c/46aa75291056b6dc5faaf956dffdb3e9662477b0"
},
{
"url": "https://git.kernel.org/stable/c/e3025ecdb2057f866c09e059fc1466e81d6f243e"
},
{
"url": "https://git.kernel.org/stable/c/14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb"
},
{
"url": "https://git.kernel.org/stable/c/af1b69be19c34e28c0ae54bee954b58cd076969a"
},
{
"url": "https://git.kernel.org/stable/c/adb7118b7d2cfd7e8213c17d7d2829f353017754"
}
],
"title": "wifi: libipw: reject too-short association responses",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98348",
"datePublished": "2026-10-06T08:46:36.927Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-19T09:17:59.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97528 (GCVE-0-2026-97528)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
qla_nvme_xmt_ls_rsp() obtains uctx, which was linked into
fcport->unsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked
when the NVMe transport calls back to transmit the LS response. On the
error (out:) path the function frees uctx with kfree() but never removes
it from the list. This leaves a freed node in fcport->unsol_ctx_head: the
next list_add_tail() for that fcport writes through the freed node, and a
subsequent list_del() can corrupt the list or panic.
Unlink uctx with list_del() before kfree() on the error path, matching the
other free sites in qla_nvme_release_lsrsp_cmd_kref() and
qla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only
returns the SRB to its pool and does not invoke sp->put_fn, so the out:
path is the sole free and uctx is always still linked there.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_nvme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "925a9129a514b7c3bc0a8af01e51868adbb9a83e",
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"versionType": "git"
},
{
"lessThan": "cbbf1484496aac86038e67ac984949af58009d4b",
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"versionType": "git"
},
{
"lessThan": "a95fc5f1c12bba1dbff72bd2611e7fad0758831b",
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"versionType": "git"
},
{
"lessThan": "c55d649a6cc246c3ccd5d118faea230c46b60f35",
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"versionType": "git"
},
{
"lessThan": "e46160a5d4fa59bf4d5f3412b6b5cb79edb967dd",
"status": "affected",
"version": "875386b98857822b77ac7f95bdf367b70af5b78c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_nvme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error\n\nqla_nvme_xmt_ls_rsp() obtains uctx, which was linked into\nfcport-\u003eunsol_ctx_head by qla2xxx_process_purls_iocb() and is still linked\nwhen the NVMe transport calls back to transmit the LS response. On the\nerror (out:) path the function frees uctx with kfree() but never removes\nit from the list. This leaves a freed node in fcport-\u003eunsol_ctx_head: the\nnext list_add_tail() for that fcport writes through the freed node, and a\nsubsequent list_del() can corrupt the list or panic.\n\nUnlink uctx with list_del() before kfree() on the error path, matching the\nother free sites in qla_nvme_release_lsrsp_cmd_kref() and\nqla2xxx_process_purls_pkt(). qla2x00_rel_sp() in the failure path only\nreturns the SRB to its pool and does not invoke sp-\u003eput_fn, so the out:\npath is the sole free and uctx is always still linked there."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Unsolicited FC-NVMe LS frames are posted as PT_LS4_UNSOL; qla24xx_msix_rsp_q() (or qla2xxx_msix_rsp_q \u2192 qla_do_work) runs qla24xx_process_response_queue() \u2192 qla2xxx_process_purls_iocb(), then DPC qla2xxx_process_purls_pkt() \u2192 nvme_fc_rcv_ls_req() and nvme_fc_xmt_ls_rsp() call qla_nvme_xmt_ls_rsp(). FC/FCoE is a non-routable SAN fabric, so Adjacent is the highest defensible vector.\nAC:L - qla_nvme_xmt_ls_rsp() kfree()s uctx on out: when qla2x00_get_sp(GFP_ATOMIC) fails, qla2x00_start_sp() fails after five -EAGAIN retries, or fcport-\u003edeleted is set. A peer floods CREATE_ASSOCIATION LS onto base_qpair or sends LS then LOGO so deleted is set before nvme_fc_handle_ls_rqst_work() calls xmt_ls_rsp; both sides are attacker-driven.\nPR:N - qla2xxx_process_purls_iocb() looks up the sender with qla2x00_find_fcport_by_nportid(incl_deleted=0) and handles PT_LS4_UNSOL in the MSI-X/DPC path with no Linux credential or capability check. FC-SP/EDIF is opt-in; being a logged-in NVMe N_Port is fabric membership, not a privilege on the victim host.\nUI:N - qla24xx_queue_purex_item() sets PROCESS_PUREX_IOCB; qla2xxx_process_purls_pkt() and the nvme_fc rport lsrcv_work then call qla_nvme_xmt_ls_rsp() with no victim mount, open, or administrator action.\nS:U - kfree() of uctx while it remains on fcport-\u003eunsol_ctx_head corrupts that per-fcport list and the host kernel heap inside the qla2xxx driver. Impact stays in the same kernel security authority; it is not a VM escape or IOMMU/DMA bypass.\nC:H - After qla_nvme_xmt_ls_rsp() kfree()s uctx, the next qla2xxx_process_purls_iocb() list_add_tail() and a later list_del() in qla_nvme_release_lsrsp_cmd_kref() or qla2xxx_process_purls_pkt() operate on the freed qla_nvme_unsol_ctx. That use-after-free of a kmalloc object enables disclosure of reused kernel heap.\nI:H - list_add_tail(\u0026uctx-\u003eelem, \u0026fcport-\u003eunsol_ctx_head) writes next/prev through the already-freed node, and list_del() of a neighbor stores those pointers into adjacent heap objects. Combined with attacker-driven uctx allocations of known size, that is a kernel write primitive usable for control-flow hijack.\nA:H - list_add_tail()/list_del() on the dangling uctx-\u003eelem oopses on LIST_POISON or panics on a corrupted next/prev, and the remote peer can repeat PT_LS4_UNSOL to hit the out: path again, taking down the host and its FC-NVMe storage path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:03.891Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/925a9129a514b7c3bc0a8af01e51868adbb9a83e"
},
{
"url": "https://git.kernel.org/stable/c/cbbf1484496aac86038e67ac984949af58009d4b"
},
{
"url": "https://git.kernel.org/stable/c/a95fc5f1c12bba1dbff72bd2611e7fad0758831b"
},
{
"url": "https://git.kernel.org/stable/c/c55d649a6cc246c3ccd5d118faea230c46b60f35"
},
{
"url": "https://git.kernel.org/stable/c/e46160a5d4fa59bf4d5f3412b6b5cb79edb967dd"
}
],
"title": "scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97528",
"datePublished": "2026-09-25T10:21:30.130Z",
"dateReserved": "2026-09-24T16:01:01.153Z",
"dateUpdated": "2026-10-21T12:53:03.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98233 (GCVE-0-2026-98233)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/packet: clear RX owner on VNET header error
Commit 61fad6816fc1 ("net/packet: tpacket_rcv: avoid a producer race
condition") added rx_owner_map and made tpacket_rcv() claim a V1 or V2
ring slot before converting the virtio-net header. If the conversion
fails, the drop path leaves the slot claimed.
With a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves
the only slot unavailable, so the ring also drops the next valid packet.
Clear the ownership bit on this error path. TPACKET_V3 already clears
its block state here.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 Version: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 Version: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 Version: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 Version: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 Version: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 Version: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 Version: 61fad6816fc10fb8793a925d5c1256d1c3db0cd2 Version: 2975472e042e0bbfeeabddc5023cb8c011ec5a07 Version: 6fb0e4385928900ccb8697748555b3f54bba5193 Version: 86137342fd4cf52882842aa8d1318b2661f08e8a Version: b06e4d3ed4044c2facf10a511d809f9aa29d960e Version: 4.14.175 ≤ Version: 4.19.114 ≤ Version: 5.4.29 ≤ Version: 5.5.14 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb10a0084c03a94364aeec542beddc5d49b59f59",
"status": "affected",
"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
"versionType": "git"
},
{
"lessThan": "b8c0cb3069058c2d67b5c7c833b2833381ecffdc",
"status": "affected",
"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
"versionType": "git"
},
{
"lessThan": "2daa618e7ff19eefcbda281bc4c5998c4140f9cf",
"status": "affected",
"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
"versionType": "git"
},
{
"lessThan": "23cd30498891d29a69ec9b75bd92f8a0f21f1342",
"status": "affected",
"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
"versionType": "git"
},
{
"lessThan": "49a48a5aaf85fe69d2dc3fb334b4854fadf44e39",
"status": "affected",
"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
"versionType": "git"
},
{
"lessThan": "805edbdcb8681da5f7ee43b3c3c809f7a8c31208",
"status": "affected",
"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
"versionType": "git"
},
{
"lessThan": "693209a237fc548791cf402441db8b68d1da7d38",
"status": "affected",
"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
"versionType": "git"
},
{
"lessThan": "33ff111d7ba3beb86e28938d6382bb5beabd865a",
"status": "affected",
"version": "61fad6816fc10fb8793a925d5c1256d1c3db0cd2",
"versionType": "git"
},
{
"status": "affected",
"version": "2975472e042e0bbfeeabddc5023cb8c011ec5a07",
"versionType": "git"
},
{
"status": "affected",
"version": "6fb0e4385928900ccb8697748555b3f54bba5193",
"versionType": "git"
},
{
"status": "affected",
"version": "86137342fd4cf52882842aa8d1318b2661f08e8a",
"versionType": "git"
},
{
"status": "affected",
"version": "b06e4d3ed4044c2facf10a511d809f9aa29d960e",
"versionType": "git"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.175",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.114",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.29",
"versionType": "semver"
},
{
"lessThan": "5.6",
"status": "affected",
"version": "5.5.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/packet/af_packet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: clear RX owner on VNET header error\n\nCommit 61fad6816fc1 (\"net/packet: tpacket_rcv: avoid a producer race\ncondition\") added rx_owner_map and made tpacket_rcv() claim a V1 or V2\nring slot before converting the virtio-net header. If the conversion\nfails, the drop path leaves the slot claimed.\n\nWith a one-frame TPACKET_V2 ring, an unsupported UDP GSO packet leaves\nthe only slot unavailable, so the ring also drops the next valid packet.\n\nClear the ownership bit on this error path. TPACKET_V3 already clears\nits block state here."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:05.070Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb10a0084c03a94364aeec542beddc5d49b59f59"
},
{
"url": "https://git.kernel.org/stable/c/b8c0cb3069058c2d67b5c7c833b2833381ecffdc"
},
{
"url": "https://git.kernel.org/stable/c/2daa618e7ff19eefcbda281bc4c5998c4140f9cf"
},
{
"url": "https://git.kernel.org/stable/c/23cd30498891d29a69ec9b75bd92f8a0f21f1342"
},
{
"url": "https://git.kernel.org/stable/c/49a48a5aaf85fe69d2dc3fb334b4854fadf44e39"
},
{
"url": "https://git.kernel.org/stable/c/805edbdcb8681da5f7ee43b3c3c809f7a8c31208"
},
{
"url": "https://git.kernel.org/stable/c/693209a237fc548791cf402441db8b68d1da7d38"
},
{
"url": "https://git.kernel.org/stable/c/33ff111d7ba3beb86e28938d6382bb5beabd865a"
}
],
"title": "net/packet: clear RX owner on VNET header error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98233",
"datePublished": "2026-10-06T08:45:06.533Z",
"dateReserved": "2026-09-25T10:25:14.328Z",
"dateUpdated": "2026-10-19T09:16:05.070Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98246 (GCVE-0-2026-98246)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: Serialize local codec list cleanup
hci_dev_close_sync() clears hdev->local_codecs after releasing hdev->lock.
Codec list additions and both traversals in sco_sock_getsockopt() use that
lock, but the close path does not. A close and BT_CODEC query can therefore
interleave as follows:
hci_dev_close_sync() sco_sock_getsockopt()
hci_dev_lock()
fetch codec entry
hci_codec_list_clear()
kfree(entry)
read entry->id
The reader then accesses an entry which the close path has freed. KASAN
BUG: KASAN: slab-use-after-free in sco_sock_getsockopt+0xfa0/0xfe0
Read of size 1 at addr ffff8881001c3450
Call Trace:
sco_sock_getsockopt+0xfa0/0xfe0
do_sock_getsockopt+0x537/0x7b0
__sys_getsockopt+0xf2/0x170
Allocated by task 92:
hci_codec_list_add.isra.0+0x2c/0x440
hci_read_codec_capabilities+0x224/0x590
hci_read_supported_codecs+0x2c2/0x640
Freed by task 92:
kfree+0x131/0x3c0
hci_codec_list_clear+0xd8/0x160
hci_dev_close_sync+0x92a/0xfa0
Take hdev->lock around the clear operation at its existing point in the
close path. This makes the clear wait for active readers and prevents a new
traversal until the list is empty without changing teardown ordering.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 626535077ba9dc110787540d1fe24881094c15a1 Version: b938790e70540bf4f2e653dcd74b232494d06c8f Version: b938790e70540bf4f2e653dcd74b232494d06c8f Version: b938790e70540bf4f2e653dcd74b232494d06c8f Version: b938790e70540bf4f2e653dcd74b232494d06c8f Version: b938790e70540bf4f2e653dcd74b232494d06c8f Version: eea5a8f0c3b7c884d2351e75fbdd0a3d7def5ae1 Version: 6.1.57 ≤ Version: 6.5.7 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9f407d52c0d881430d689836d3e7d32aa36f98b5",
"status": "affected",
"version": "626535077ba9dc110787540d1fe24881094c15a1",
"versionType": "git"
},
{
"lessThan": "560ed4373c06a58123ecdf9ad5ecaddc87a73382",
"status": "affected",
"version": "b938790e70540bf4f2e653dcd74b232494d06c8f",
"versionType": "git"
},
{
"lessThan": "1ee0c5429dc4a92879bda2554b1bfd4abc6c587c",
"status": "affected",
"version": "b938790e70540bf4f2e653dcd74b232494d06c8f",
"versionType": "git"
},
{
"lessThan": "4dc1ae5ff75b17e17ec4b74b11cc4b0099e71e00",
"status": "affected",
"version": "b938790e70540bf4f2e653dcd74b232494d06c8f",
"versionType": "git"
},
{
"lessThan": "1276c2fafd18499769a28f96f45c5a76d6fc990e",
"status": "affected",
"version": "b938790e70540bf4f2e653dcd74b232494d06c8f",
"versionType": "git"
},
{
"lessThan": "9a10987a2f160a44a638c9a35994ca6e3089696e",
"status": "affected",
"version": "b938790e70540bf4f2e653dcd74b232494d06c8f",
"versionType": "git"
},
{
"status": "affected",
"version": "eea5a8f0c3b7c884d2351e75fbdd0a3d7def5ae1",
"versionType": "git"
},
{
"lessThan": "6.1.189",
"status": "affected",
"version": "6.1.57",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "6.1.57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: Serialize local codec list cleanup\n\nhci_dev_close_sync() clears hdev-\u003elocal_codecs after releasing hdev-\u003elock.\nCodec list additions and both traversals in sco_sock_getsockopt() use that\nlock, but the close path does not. A close and BT_CODEC query can therefore\ninterleave as follows:\n\n hci_dev_close_sync() sco_sock_getsockopt()\n hci_dev_lock()\n fetch codec entry\n hci_codec_list_clear()\n kfree(entry)\n read entry-\u003eid\n\nThe reader then accesses an entry which the close path has freed. KASAN\n\n BUG: KASAN: slab-use-after-free in sco_sock_getsockopt+0xfa0/0xfe0\n Read of size 1 at addr ffff8881001c3450\n Call Trace:\n sco_sock_getsockopt+0xfa0/0xfe0\n do_sock_getsockopt+0x537/0x7b0\n __sys_getsockopt+0xf2/0x170\n Allocated by task 92:\n hci_codec_list_add.isra.0+0x2c/0x440\n hci_read_codec_capabilities+0x224/0x590\n hci_read_supported_codecs+0x2c2/0x640\n Freed by task 92:\n kfree+0x131/0x3c0\n hci_codec_list_clear+0xd8/0x160\n hci_dev_close_sync+0x92a/0xfa0\n\nTake hdev-\u003elock around the clear operation at its existing point in the\nclose path. This makes the clear wait for active readers and prevents a new\ntraversal until the list is empty without changing teardown ordering."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:17.812Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9f407d52c0d881430d689836d3e7d32aa36f98b5"
},
{
"url": "https://git.kernel.org/stable/c/560ed4373c06a58123ecdf9ad5ecaddc87a73382"
},
{
"url": "https://git.kernel.org/stable/c/1ee0c5429dc4a92879bda2554b1bfd4abc6c587c"
},
{
"url": "https://git.kernel.org/stable/c/4dc1ae5ff75b17e17ec4b74b11cc4b0099e71e00"
},
{
"url": "https://git.kernel.org/stable/c/1276c2fafd18499769a28f96f45c5a76d6fc990e"
},
{
"url": "https://git.kernel.org/stable/c/9a10987a2f160a44a638c9a35994ca6e3089696e"
}
],
"title": "Bluetooth: hci_sync: Serialize local codec list cleanup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98246",
"datePublished": "2026-10-06T08:45:15.411Z",
"dateReserved": "2026-09-25T10:25:14.330Z",
"dateUpdated": "2026-10-19T09:16:17.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98426 (GCVE-0-2026-98426)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
mwifiex_pcie_request_irq() registers each MSI-X vector with a per-index
dev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop
"for (j = 0; j < i; j++)" frees msix_entries[j].vector but passes the
failed index's &card->msix_ctx[i] as the dev_id. free_irq() matches on
(irq, dev_id), so it fails to find the action registered with
&card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and
free_irq() warns about freeing a non-existent IRQ. Use &card->msix_ctx[j].
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 99074fc1e67b374b5c72406a23ac01fed806d634 Version: 99074fc1e67b374b5c72406a23ac01fed806d634 Version: 99074fc1e67b374b5c72406a23ac01fed806d634 Version: 99074fc1e67b374b5c72406a23ac01fed806d634 Version: 99074fc1e67b374b5c72406a23ac01fed806d634 Version: 99074fc1e67b374b5c72406a23ac01fed806d634 Version: 99074fc1e67b374b5c72406a23ac01fed806d634 Version: 99074fc1e67b374b5c72406a23ac01fed806d634 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/pcie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "11bc2cbb14f450eaa47cce9eb086f948ef8f4bcd",
"status": "affected",
"version": "99074fc1e67b374b5c72406a23ac01fed806d634",
"versionType": "git"
},
{
"lessThan": "1a60cb2292194cc9eafae7ca8a8a72d37ae78d97",
"status": "affected",
"version": "99074fc1e67b374b5c72406a23ac01fed806d634",
"versionType": "git"
},
{
"lessThan": "fcac5813f324cd07dfd36b4adf624fc70f7587d6",
"status": "affected",
"version": "99074fc1e67b374b5c72406a23ac01fed806d634",
"versionType": "git"
},
{
"lessThan": "2761b21cb896b1da8dd46cee5084c9032b2d7098",
"status": "affected",
"version": "99074fc1e67b374b5c72406a23ac01fed806d634",
"versionType": "git"
},
{
"lessThan": "5fd4cc87e6cc0839aac89c24ebe39ce262fe088f",
"status": "affected",
"version": "99074fc1e67b374b5c72406a23ac01fed806d634",
"versionType": "git"
},
{
"lessThan": "0969c9688389f2e0f65b1a924b0dd6625a3bb776",
"status": "affected",
"version": "99074fc1e67b374b5c72406a23ac01fed806d634",
"versionType": "git"
},
{
"lessThan": "03d5e4776e8b71c2468c5c3c48b39202c87a8796",
"status": "affected",
"version": "99074fc1e67b374b5c72406a23ac01fed806d634",
"versionType": "git"
},
{
"lessThan": "a3d722190cdef18da4878b5efc27c3c386dda248",
"status": "affected",
"version": "99074fc1e67b374b5c72406a23ac01fed806d634",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/pcie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path\n\nmwifiex_pcie_request_irq() registers each MSI-X vector with a per-index\ndev_id (\u0026card-\u003emsix_ctx[i]). On a request_irq() failure the cleanup loop\n\"for (j = 0; j \u003c i; j++)\" frees msix_entries[j].vector but passes the\nfailed index\u0027s \u0026card-\u003emsix_ctx[i] as the dev_id. free_irq() matches on\n(irq, dev_id), so it fails to find the action registered with\n\u0026card-\u003emsix_ctx[j]: the already-requested IRQ j is not freed (leaked) and\nfree_irq() warns about freeing a non-existent IRQ. Use \u0026card-\u003emsix_ctx[j]."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:20.215Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/11bc2cbb14f450eaa47cce9eb086f948ef8f4bcd"
},
{
"url": "https://git.kernel.org/stable/c/1a60cb2292194cc9eafae7ca8a8a72d37ae78d97"
},
{
"url": "https://git.kernel.org/stable/c/fcac5813f324cd07dfd36b4adf624fc70f7587d6"
},
{
"url": "https://git.kernel.org/stable/c/2761b21cb896b1da8dd46cee5084c9032b2d7098"
},
{
"url": "https://git.kernel.org/stable/c/5fd4cc87e6cc0839aac89c24ebe39ce262fe088f"
},
{
"url": "https://git.kernel.org/stable/c/0969c9688389f2e0f65b1a924b0dd6625a3bb776"
},
{
"url": "https://git.kernel.org/stable/c/03d5e4776e8b71c2468c5c3c48b39202c87a8796"
},
{
"url": "https://git.kernel.org/stable/c/a3d722190cdef18da4878b5efc27c3c386dda248"
}
],
"title": "wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98426",
"datePublished": "2026-10-14T13:27:53.177Z",
"dateReserved": "2026-09-25T10:25:14.348Z",
"dateUpdated": "2026-10-19T09:19:20.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98182 (GCVE-0-2026-98182)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: refuse to make a monitor active when it has no queue
A monitor interface only gets a TXQ if it's created active, and one can't
be added later. Setting the flag on a down interface is still allowed, so
the driver is handed a monitor with no queue. ath9k dereferences it:
BUG: kernel NULL pointer dereference, address: 0000000000000066
RIP: 0010:ath_tx_node_init+0x49/0x170 [ath9k]
ath9k_add_interface+0x10c/0x140 [ath9k]
drv_add_interface+0x54/0x250 [mac80211]
ieee80211_do_open+0x32f/0x800 [mac80211]
Reached with CAP_NET_ADMIN by "iw dev X set monitor active" followed by
"ip link set X up". RTNL is held, so netlink operations block behind it.
Refuse the flag when there is no queue to give.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/cfg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7b7d46ec4fa127767931938b282c361c0519af6",
"status": "affected",
"version": "79af1f866193de29e65a4dba7d0dab14b0c0ff93",
"versionType": "git"
},
{
"lessThan": "abe15e643e576459469867758ae9c586a7bab95d",
"status": "affected",
"version": "79af1f866193de29e65a4dba7d0dab14b0c0ff93",
"versionType": "git"
},
{
"lessThan": "46c223468537a05a404699771cd3e68532dab5e6",
"status": "affected",
"version": "79af1f866193de29e65a4dba7d0dab14b0c0ff93",
"versionType": "git"
},
{
"lessThan": "2b04d6556964ae9f89819b86a0a7801e39c3aae5",
"status": "affected",
"version": "79af1f866193de29e65a4dba7d0dab14b0c0ff93",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/cfg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: refuse to make a monitor active when it has no queue\n\nA monitor interface only gets a TXQ if it\u0027s created active, and one can\u0027t\nbe added later. Setting the flag on a down interface is still allowed, so\nthe driver is handed a monitor with no queue. ath9k dereferences it:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000066\n RIP: 0010:ath_tx_node_init+0x49/0x170 [ath9k]\n ath9k_add_interface+0x10c/0x140 [ath9k]\n drv_add_interface+0x54/0x250 [mac80211]\n ieee80211_do_open+0x32f/0x800 [mac80211]\n\nReached with CAP_NET_ADMIN by \"iw dev X set monitor active\" followed by\n\"ip link set X up\". RTNL is held, so netlink operations block behind it.\n\nRefuse the flag when there is no queue to give."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:13.449Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7b7d46ec4fa127767931938b282c361c0519af6"
},
{
"url": "https://git.kernel.org/stable/c/abe15e643e576459469867758ae9c586a7bab95d"
},
{
"url": "https://git.kernel.org/stable/c/46c223468537a05a404699771cd3e68532dab5e6"
},
{
"url": "https://git.kernel.org/stable/c/2b04d6556964ae9f89819b86a0a7801e39c3aae5"
}
],
"title": "wifi: mac80211: refuse to make a monitor active when it has no queue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98182",
"datePublished": "2026-10-06T08:44:25.219Z",
"dateReserved": "2026-09-25T10:25:14.323Z",
"dateUpdated": "2026-10-19T09:15:13.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97566 (GCVE-0-2026-97566)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0
The in-kernel MPTCP path manager can leave a stale ADD_ADDR announcement
entry alive when removing the id 0 endpoint. This happens because the id 0
removal path does not tear down pending announcements, unlike the non-zero
id path.
When the PM later reselects id 0 after adding another signal endpoint, it
finds the stale anno_list entry and hits WARN_ON_ONCE(mptcp_pm_is_kernel())
in mptcp_pm_announced_alloc().
Root cause: asymmetry between removal paths.
- Non-zero id path: mptcp_nl_remove_subflow_and_signal_addr() calls
mptcp_pm_remove_announced() to clean up.
- Id 0 path: mptcp_nl_remove_id_zero_address() skips cleanup entirely.
Fix by making the id 0 path symmetric: call mptcp_pm_announced_remove()
and decrement add_addr_signaled before queuing the RM_ADDR.
Subtle detail: signal endpoints are stored in anno_list with port 0, but
msk_local carries the connection's local port. In other words, entries
linked to ID0 paths should have port == 0. A follow-up patch will ensure
that. mptcp_pm_announced_remove() uses use_port=true for comparison. So
clear the port before the lookup.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mptcp/pm_kernel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "189d60057e5f3d6a62e3d71a3cc428c9150bc14f",
"status": "affected",
"version": "740d798e8767d8a449902b1a1bbc70facfce19b5",
"versionType": "git"
},
{
"lessThan": "bacf23e7c9876c9f4170166b3597cb22ea3ed39b",
"status": "affected",
"version": "740d798e8767d8a449902b1a1bbc70facfce19b5",
"versionType": "git"
},
{
"lessThan": "d4a67a880654e1bfe318a31bea0bdbb026a09ade",
"status": "affected",
"version": "740d798e8767d8a449902b1a1bbc70facfce19b5",
"versionType": "git"
},
{
"lessThan": "545616b4e7325be3c61fc082538cb06d14f7b1db",
"status": "affected",
"version": "740d798e8767d8a449902b1a1bbc70facfce19b5",
"versionType": "git"
},
{
"lessThan": "2ac7d6e620764f1fc79eb4edd3610a7a661981ca",
"status": "affected",
"version": "740d798e8767d8a449902b1a1bbc70facfce19b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mptcp/pm_kernel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: pm: kernel: drop pending ADD_ADDR when removing ID0\n\nThe in-kernel MPTCP path manager can leave a stale ADD_ADDR announcement\nentry alive when removing the id 0 endpoint. This happens because the id 0\nremoval path does not tear down pending announcements, unlike the non-zero\nid path.\n\nWhen the PM later reselects id 0 after adding another signal endpoint, it\nfinds the stale anno_list entry and hits WARN_ON_ONCE(mptcp_pm_is_kernel())\nin mptcp_pm_announced_alloc().\n\nRoot cause: asymmetry between removal paths.\n- Non-zero id path: mptcp_nl_remove_subflow_and_signal_addr() calls\n mptcp_pm_remove_announced() to clean up.\n- Id 0 path: mptcp_nl_remove_id_zero_address() skips cleanup entirely.\n\nFix by making the id 0 path symmetric: call mptcp_pm_announced_remove()\nand decrement add_addr_signaled before queuing the RM_ADDR.\n\nSubtle detail: signal endpoints are stored in anno_list with port 0, but\nmsk_local carries the connection\u0027s local port. In other words, entries\nlinked to ID0 paths should have port == 0. A follow-up patch will ensure\nthat. mptcp_pm_announced_remove() uses use_port=true for comparison. So\nclear the port before the lookup."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:19.223Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/189d60057e5f3d6a62e3d71a3cc428c9150bc14f"
},
{
"url": "https://git.kernel.org/stable/c/bacf23e7c9876c9f4170166b3597cb22ea3ed39b"
},
{
"url": "https://git.kernel.org/stable/c/d4a67a880654e1bfe318a31bea0bdbb026a09ade"
},
{
"url": "https://git.kernel.org/stable/c/545616b4e7325be3c61fc082538cb06d14f7b1db"
},
{
"url": "https://git.kernel.org/stable/c/2ac7d6e620764f1fc79eb4edd3610a7a661981ca"
}
],
"title": "mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97566",
"datePublished": "2026-09-25T10:21:53.068Z",
"dateReserved": "2026-09-24T16:01:01.155Z",
"dateUpdated": "2026-10-21T12:53:19.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89766 (GCVE-0-2026-89766)
Vulnerability from cvelistv5
Published
2026-09-11 19:47
Modified
2026-10-19 08:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pidfd: hold exec_update_lock around namespace ioctl
The PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl() perform a filesystem
credentials ptrace access check before handing out a namespace file
descriptor. The accompanying comment states that the code "mirrors nsfs
behavior", but, unlike the corresponding procfs paths, it does so without
holding the target task's exec_update_lock.
proc_ns_get_link() and proc_ns_readlink() both take exec_update_lock for
reading around the ptrace check and the namespace lookup, so that the
credentials used for the access decision match those of the task when its
namespace is read. Without it, a caller can pass the check against the
target's old credentials and then read the namespace after the target has
execve()'d a setuid binary and committed new credentials -- accessing
namespace information it should have been denied.
Hold exec_update_lock for reading around the ptrace check and the
namespace lookup so that pidfd truly mirrors nsfs behavior, as the comment
already claims. open_namespace() itself runs outside the lock: once a
namespace reference is obtained it carries its own refcount and is opened
with the caller's own credentials, so a concurrent execve() on the target
can no longer affect the outcome.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/pidfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bac2f1913a216677c2c220d7bb352dd0330065ca",
"status": "affected",
"version": "5b08bd408534bfb3a7cf5778da5b27d4e4fffe12",
"versionType": "git"
},
{
"lessThan": "cf24ce48d60225fdbee68ed2058763a1fd172ff3",
"status": "affected",
"version": "5b08bd408534bfb3a7cf5778da5b27d4e4fffe12",
"versionType": "git"
},
{
"lessThan": "e89318aa8629969e86548b05e7c19283af3f0efb",
"status": "affected",
"version": "5b08bd408534bfb3a7cf5778da5b27d4e4fffe12",
"versionType": "git"
},
{
"lessThan": "9688a46802939da28f00cb40e8129615d5d4af39",
"status": "affected",
"version": "5b08bd408534bfb3a7cf5778da5b27d4e4fffe12",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/pidfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npidfd: hold exec_update_lock around namespace ioctl\n\nThe PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl() perform a filesystem\ncredentials ptrace access check before handing out a namespace file\ndescriptor. The accompanying comment states that the code \"mirrors nsfs\nbehavior\", but, unlike the corresponding procfs paths, it does so without\nholding the target task\u0027s exec_update_lock.\n\nproc_ns_get_link() and proc_ns_readlink() both take exec_update_lock for\nreading around the ptrace check and the namespace lookup, so that the\ncredentials used for the access decision match those of the task when its\nnamespace is read. Without it, a caller can pass the check against the\ntarget\u0027s old credentials and then read the namespace after the target has\nexecve()\u0027d a setuid binary and committed new credentials -- accessing\nnamespace information it should have been denied.\n\nHold exec_update_lock for reading around the ptrace check and the\nnamespace lookup so that pidfd truly mirrors nsfs behavior, as the comment\nalready claims. open_namespace() itself runs outside the lock: once a\nnamespace reference is obtained it carries its own refcount and is opened\nwith the caller\u0027s own credentials, so a concurrent execve() on the target\ncan no longer affect the outcome."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:52:19.816Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bac2f1913a216677c2c220d7bb352dd0330065ca"
},
{
"url": "https://git.kernel.org/stable/c/cf24ce48d60225fdbee68ed2058763a1fd172ff3"
},
{
"url": "https://git.kernel.org/stable/c/e89318aa8629969e86548b05e7c19283af3f0efb"
},
{
"url": "https://git.kernel.org/stable/c/9688a46802939da28f00cb40e8129615d5d4af39"
}
],
"title": "pidfd: hold exec_update_lock around namespace ioctl",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89766",
"datePublished": "2026-09-11T19:47:06.597Z",
"dateReserved": "2026-09-11T19:38:34.764Z",
"dateUpdated": "2026-10-19T08:52:19.816Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98419 (GCVE-0-2026-98419)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-24 14:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
In reset_per_cpu_data(), al is computed as:
al = sizeof(struct net_dm_alert_msg);
al += dm_hit_limit * sizeof(struct net_dm_drop_point);
al += sizeof(struct nlattr);
skb = genlmsg_new(al, GFP_KERNEL);
...
nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));
...
msg = nla_data(nla);
memset(msg, 0, al);
Because al includes sizeof(struct nlattr) (the 4-byte attribute header),
genlmsg_new() allocates al bytes of tailroom starting at nla.
However, msg points to nla_data(nla), which is located
sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)
therefore writes al bytes starting from msg, exceeding the allocated
buffer by sizeof(struct nlattr) (4 bytes) and corrupting
skb_shared_info.
Fix this by letting al represent only the payload length, allocating
the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing
al bytes from msg.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 683703a26e4677db437a1480682851e27c7a154f Version: 683703a26e4677db437a1480682851e27c7a154f Version: 683703a26e4677db437a1480682851e27c7a154f Version: 683703a26e4677db437a1480682851e27c7a154f Version: 683703a26e4677db437a1480682851e27c7a154f Version: 683703a26e4677db437a1480682851e27c7a154f Version: 683703a26e4677db437a1480682851e27c7a154f Version: 683703a26e4677db437a1480682851e27c7a154f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/drop_monitor.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "caf09c09e0f323015ab6777ed1bad5aa10688631",
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"versionType": "git"
},
{
"lessThan": "56b12f0cd476e4d90a0e2663a80102b388ebf78c",
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"versionType": "git"
},
{
"lessThan": "88d640efd655b10f9fa4e381caf777da1f17c2a6",
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"versionType": "git"
},
{
"lessThan": "d54a044136b129822715e8798899af540ec7a9e9",
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"versionType": "git"
},
{
"lessThan": "8a04047c6dbff2f49a561b1ff53b043f4807e855",
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"versionType": "git"
},
{
"lessThan": "530ae0a1458078c7a81fbffd9ff17d42129364d9",
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"versionType": "git"
},
{
"lessThan": "03b672eba4937ff18337049824a114012d57f202",
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"versionType": "git"
},
{
"lessThan": "439f392084f8f7f59ab9d47a9579185accefe1d8",
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/drop_monitor.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n al = sizeof(struct net_dm_alert_msg);\n al += dm_hit_limit * sizeof(struct net_dm_drop_point);\n al += sizeof(struct nlattr);\n\n skb = genlmsg_new(al, GFP_KERNEL);\n ...\n nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n ...\n msg = nla_data(nla);\n memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - On affected 2.6.32-era 4-byte-cache builds, local NETLINK_GENERIC NET_DM_CMD_START enters net_dm_cmd_trace(); locally generated drops then run trace_drop_common()-\u003esched_send_work()-\u003esend_dm_alert()-\u003ereset_per_cpu_data(). No routable protocol message supplies al.\nAC:H - The harmful layout requires non-default CONFIG_NET_DROP_MONITOR on H8/300 or early MicroBlaze, where SMP_CACHE_BYTES is 4 and skb_shared_info begins with dataref; that rare target condition is outside attacker control. The attacker can otherwise fill the alert and control both multicast listeners without racing.\nPR:L - In those affected kernels NET_DM_CMD_START has no GENL_ADMIN_PERM, while NETLINK_GENERIC enables NL_NONROOT_RECV, so an ordinary local user can start tracing and join the alert group without a user namespace or initial-namespace capability.\nUI:N - The local attacker sends START, creates the listener sockets, generates dropped skbs, and receives the alerts; no separate victim action is required.\nS:U - The corrupted skb_shared_info and subsequent use-after-free remain within the host kernel; this is ordinary kernel compromise rather than a VM, IOMMU, or sandbox boundary crossing.\nC:H - reset_per_cpu_data() zeroes dataref from 1 to 0. After a full alert makes netlink_trim() retain the head, a second listener causes skb_clone() to count two heads as one reference; receiving the first frees the head and the second can read attacker-groomed reclaimed heap.\nI:H - The queued clone survives after its head is freed; reclaiming and forging that allocation lets its later skb_release_data() decrement and process attacker-shaped skb_shared_info metadata, providing exploitable use-after-free memory corruption.\nA:H - The prematurely freed head remains referenced by the second queued clone, so skb_copy_datagram_iovec() or its later skb_release_data() can access reclaimed memory and crash the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:08:45.212Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631"
},
{
"url": "https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c"
},
{
"url": "https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6"
},
{
"url": "https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9"
},
{
"url": "https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855"
},
{
"url": "https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9"
},
{
"url": "https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202"
},
{
"url": "https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8"
}
],
"title": "drop_monitor: fix out-of-bounds write in reset_per_cpu_data()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98419",
"datePublished": "2026-10-14T13:27:49.005Z",
"dateReserved": "2026-09-25T10:25:14.348Z",
"dateUpdated": "2026-10-24T14:08:45.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89500 (GCVE-0-2026-89500)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-19 08:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page
Discarding a cached reader page after a concurrent ring buffer resize
uses the new global subbuf_order for the free_pages() call. This
mismatched order may crashes the kernel or leaks memory because the cached
page was allocated under the old size.
Save the actual free_page order alongside the page address to ensure we
always refer to the correct value and do not rely on the potentially
stalled cpu_buffer->subbuf_order value. The simplest is to make
free_page a buffer_data_read_page which already covers exactly what we
need: a page address and a page order.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d8f52dc3c3f1f987d8cf920ccd8d66590870bf3f",
"status": "affected",
"version": "8e7b58c27b3c567316a51079b375b846f9223bba",
"versionType": "git"
},
{
"lessThan": "a1dabe68fb53730bc0be60c5dbfd3f4c560084e7",
"status": "affected",
"version": "8e7b58c27b3c567316a51079b375b846f9223bba",
"versionType": "git"
},
{
"lessThan": "d787d509bdf6c88c85e095247daf7456cb7fb772",
"status": "affected",
"version": "8e7b58c27b3c567316a51079b375b846f9223bba",
"versionType": "git"
},
{
"lessThan": "7a1fb95de5404134f8758c1295ce88986bdf117c",
"status": "affected",
"version": "8e7b58c27b3c567316a51079b375b846f9223bba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Make cpu_buffer::free_page a buffer_data_read_page\n\nDiscarding a cached reader page after a concurrent ring buffer resize\nuses the new global subbuf_order for the free_pages() call. This\nmismatched order may crashes the kernel or leaks memory because the cached\npage was allocated under the old size.\n\nSave the actual free_page order alongside the page address to ensure we\nalways refer to the correct value and do not rely on the potentially\nstalled cpu_buffer-\u003esubbuf_order value. The simplest is to make\nfree_page a buffer_data_read_page which already covers exactly what we\nneed: a page address and a page order."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local tracefs: write() to buffer_subbuf_size_kb (buffer_subbuf_size_write -\u003e ring_buffer_subbuf_order_set) racing read/splice/close of per_cpu/cpuN/trace_pipe_raw (ring_buffer_alloc_read_page / ring_buffer_free_read_page) or instance rmdir (rb_free_cpu_buffer). No network, adjacent-radio, or physical path exists.\nAC:L - The attacker owns both sides of the race: one thread toggles buffer_subbuf_size_kb while another caches or discards a reader page via trace_pipe_raw. The window includes synchronize_rcu() and GFP_KERNEL allocation of every new sub-buffer, so the mismatch is reliably retryable with no condition outside attacker control.\nPR:L - tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC, with no capable() check. buffer_subbuf_size_kb is 0640 and trace_pipe_raw is 0440; Android/Perfetto, ChromeOS, and distro tracing groups routinely delegate these to unprivileged accounts, matching CVE-2024-50207, CVE-2025-38101, and CVE-2026-74634.\nUI:N - Exploitation uses the attacker\u0027s own file descriptors and threads (write buffer_subbuf_size_kb, read/close trace_pipe_raw, optional instance rmdir). No separate victim mount, click, or configuration action is required.\nS:U - Wrong-order free_pages() and reuse of a cached reader page corrupt kernel ring-buffer and buddy-allocator pages within the same OS security authority. This enables local privilege escalation but does not cross VM, IOMMU, container, or hardware trust boundaries.\nC:H - cpu_buffer-\u003efree_page stored no allocation order, so a cached page allocated under the old subbuf size can be discarded or reused with the new order. Over-free and undersized-page swap are page UAF/OOB reads; recycled buddy pages and ring-buffer contents can be disclosed through subsequent trace_pipe_raw reads.\nI:H - free_pages() with a larger-than-allocated order returns neighboring in-use pages to the buddy allocator (page UAF/write). ring_buffer_read_page() can also swap that undersized cached page into the live writer path, producing out-of-bounds kernel stores exploitable for control-flow hijack.\nA:H - Mismatched-order free_pages() corrupts the buddy allocator and the commit states this may crash the kernel; UAF/OOB on ring-buffer pages also oops/panic. The attacker chooses the order delta via buffer_subbuf_size_kb and can retrigger the race at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:47:51.845Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d8f52dc3c3f1f987d8cf920ccd8d66590870bf3f"
},
{
"url": "https://git.kernel.org/stable/c/a1dabe68fb53730bc0be60c5dbfd3f4c560084e7"
},
{
"url": "https://git.kernel.org/stable/c/d787d509bdf6c88c85e095247daf7456cb7fb772"
},
{
"url": "https://git.kernel.org/stable/c/7a1fb95de5404134f8758c1295ce88986bdf117c"
}
],
"title": "ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89500",
"datePublished": "2026-09-11T19:43:49.392Z",
"dateReserved": "2026-09-11T19:38:34.715Z",
"dateUpdated": "2026-10-19T08:47:51.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89827 (GCVE-0-2026-89827)
Vulnerability from cvelistv5
Published
2026-09-16 10:30
Modified
2026-10-21 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: avoid force-completing uninitialized UVD rings
uvd_v7_0_sw_init() does not initialize the UVD decode ring for an
SR-IOV VF. However, amdgpu_uvd_resume() unconditionally force-completes
the decode ring when restoring its fence sequence.
Skip fence completion when the fence driver is not initialized.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "668cfb8ab3e22c10fe74307aac86b3cf456d6923",
"status": "affected",
"version": "0a33b11d26c6b7e975b54d469a739ffac29f67ab",
"versionType": "git"
},
{
"lessThan": "863f08c485fbb51b6443681893e4044c7cb6cd51",
"status": "affected",
"version": "0a33b11d26c6b7e975b54d469a739ffac29f67ab",
"versionType": "git"
},
{
"lessThan": "dc136795f9997adc8d3219f40e8e3afa7df7183f",
"status": "affected",
"version": "0a33b11d26c6b7e975b54d469a739ffac29f67ab",
"versionType": "git"
},
{
"lessThan": "967a179463d3227dfaf9200fd654c1f5a26a11e8",
"status": "affected",
"version": "0a33b11d26c6b7e975b54d469a739ffac29f67ab",
"versionType": "git"
},
{
"lessThan": "6760f5cb12d2366ddd58a2d8637f7583d73f596b",
"status": "affected",
"version": "0a33b11d26c6b7e975b54d469a739ffac29f67ab",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: avoid force-completing uninitialized UVD rings\n\nuvd_v7_0_sw_init() does not initialize the UVD decode ring for an\nSR-IOV VF. However, amdgpu_uvd_resume() unconditionally force-completes\nthe decode ring when restoring its fence sequence.\n\nSkip fence completion when the fence driver is not initialized."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:48:54.673Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/668cfb8ab3e22c10fe74307aac86b3cf456d6923"
},
{
"url": "https://git.kernel.org/stable/c/863f08c485fbb51b6443681893e4044c7cb6cd51"
},
{
"url": "https://git.kernel.org/stable/c/dc136795f9997adc8d3219f40e8e3afa7df7183f"
},
{
"url": "https://git.kernel.org/stable/c/967a179463d3227dfaf9200fd654c1f5a26a11e8"
},
{
"url": "https://git.kernel.org/stable/c/6760f5cb12d2366ddd58a2d8637f7583d73f596b"
}
],
"title": "drm/amdgpu: avoid force-completing uninitialized UVD rings",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89827",
"datePublished": "2026-09-16T10:30:59.419Z",
"dateReserved": "2026-09-11T19:38:34.769Z",
"dateUpdated": "2026-10-21T12:48:54.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98342 (GCVE-0-2026-98342)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: wait for RCU readers before releasing dma_device
dma_issue_pending_all() walks the dma_device_list with
list_for_each_entry_rcu() under rcu_read_lock(). dma_device_release()
unlinks the device with list_del_rcu() and then calls
device->device_release() (which in many drivers, such as plx_dma.c,
directly calls kfree()).
Because there is no grace period between unlinking the device and
freeing it, concurrent RCU readers in dma_issue_pending_all() can
access the device after it has been freed.
The lockless walk originally relied on clients holding a dmaengine
reference to pin the provider module, and therefore the device, for as
long as they might traverse the list. Commit 8ad342a86359 ("dmaengine:
Add reference counting to dma_device struct") decoupled the dma_device
lifetime from the module reference, so the device can now be released
while a reader is still walking the list.
Add synchronize_rcu() before the device is freed, so RCU readers are
guaranteed to have finished. Keep it unconditional: providers that do
not implement device_release() free the device themselves once
dma_async_device_unregister() returns. This call will delay for a grace
period with dma_list_mutex held, which is safe and only teardown path is
delayed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 Version: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 Version: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 Version: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 Version: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 Version: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 Version: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 Version: 2ba05622b8b143b0c95968ba59bddfbd6d2f2559 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/dmaengine.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ac8ce9f89638d6d79875cca7d8ae42566a9bde15",
"status": "affected",
"version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
"versionType": "git"
},
{
"lessThan": "14578c78405d51fa92e4ada4502a45f537c0fcb8",
"status": "affected",
"version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
"versionType": "git"
},
{
"lessThan": "cbb3310a5167e868a5e763e32b9a23b4d50669ee",
"status": "affected",
"version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
"versionType": "git"
},
{
"lessThan": "8577a5ec4f7e00443015ef99f646def093121a1b",
"status": "affected",
"version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
"versionType": "git"
},
{
"lessThan": "4448a539a0c39141cccc67be6cacde0f35024313",
"status": "affected",
"version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
"versionType": "git"
},
{
"lessThan": "fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77",
"status": "affected",
"version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
"versionType": "git"
},
{
"lessThan": "4aed7e47a10b94ea3c5171e8d1382081accd2e03",
"status": "affected",
"version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
"versionType": "git"
},
{
"lessThan": "dc750422170a563c7a81f6e49d36bb02c62ae37f",
"status": "affected",
"version": "2ba05622b8b143b0c95968ba59bddfbd6d2f2559",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/dmaengine.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: wait for RCU readers before releasing dma_device\n\ndma_issue_pending_all() walks the dma_device_list with\nlist_for_each_entry_rcu() under rcu_read_lock(). dma_device_release()\nunlinks the device with list_del_rcu() and then calls\ndevice-\u003edevice_release() (which in many drivers, such as plx_dma.c,\ndirectly calls kfree()).\n\nBecause there is no grace period between unlinking the device and\nfreeing it, concurrent RCU readers in dma_issue_pending_all() can\naccess the device after it has been freed.\n\nThe lockless walk originally relied on clients holding a dmaengine\nreference to pin the provider module, and therefore the device, for as\nlong as they might traverse the list. Commit 8ad342a86359 (\"dmaengine:\nAdd reference counting to dma_device struct\") decoupled the dma_device\nlifetime from the module reference, so the device can now be released\nwhile a reader is still walking the list.\n\nAdd synchronize_rcu() before the device is freed, so RCU readers are\nguaranteed to have finished. Keep it unconditional: providers that do\nnot implement device_release() free the device themselves once\ndma_async_device_unregister() returns. This call will delay for a grace\nperiod with dma_list_mutex held, which is safe and only teardown path is\ndelayed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:53.321Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ac8ce9f89638d6d79875cca7d8ae42566a9bde15"
},
{
"url": "https://git.kernel.org/stable/c/14578c78405d51fa92e4ada4502a45f537c0fcb8"
},
{
"url": "https://git.kernel.org/stable/c/cbb3310a5167e868a5e763e32b9a23b4d50669ee"
},
{
"url": "https://git.kernel.org/stable/c/8577a5ec4f7e00443015ef99f646def093121a1b"
},
{
"url": "https://git.kernel.org/stable/c/4448a539a0c39141cccc67be6cacde0f35024313"
},
{
"url": "https://git.kernel.org/stable/c/fc1f4884f1d46fc7a8cee6e2997ecc9e8d1c7f77"
},
{
"url": "https://git.kernel.org/stable/c/4aed7e47a10b94ea3c5171e8d1382081accd2e03"
},
{
"url": "https://git.kernel.org/stable/c/dc750422170a563c7a81f6e49d36bb02c62ae37f"
}
],
"title": "dmaengine: wait for RCU readers before releasing dma_device",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98342",
"datePublished": "2026-10-06T08:46:32.366Z",
"dateReserved": "2026-09-25T10:25:14.342Z",
"dateUpdated": "2026-10-19T09:17:53.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98410 (GCVE-0-2026-98410)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
da9063_wdt_suspend() and da9063_wdt_resume() only check watchdog_active(),
when the watchdog is left running by the driver sets
WDOG_HW_RUNNING in da9063_wdt_probe() but userspace never opens the
device, so WDOG_ACTIVE remains cleared, the wdt_disable() will not be
executed in da9063_wdt_suspend. In this case, the suspend callback is
a no-op and the watchdog keeps counting during system suspend,
leading to an unexpected system reset.
Check WDOG_HW_RUNNING and wdd，can fix this issue.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a7ceca4398bc835c6ad29d10e1106de4cf0332e1 Version: a7ceca4398bc835c6ad29d10e1106de4cf0332e1 Version: a7ceca4398bc835c6ad29d10e1106de4cf0332e1 Version: a7ceca4398bc835c6ad29d10e1106de4cf0332e1 Version: a7ceca4398bc835c6ad29d10e1106de4cf0332e1 Version: a7ceca4398bc835c6ad29d10e1106de4cf0332e1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/watchdog/da9063_wdt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "95adc37f47cdf5a5285f7163b24243680af510be",
"status": "affected",
"version": "a7ceca4398bc835c6ad29d10e1106de4cf0332e1",
"versionType": "git"
},
{
"lessThan": "c30b419c7e6fbe31c48a44c828174168b732dc5b",
"status": "affected",
"version": "a7ceca4398bc835c6ad29d10e1106de4cf0332e1",
"versionType": "git"
},
{
"lessThan": "1c42e39b0990371b9d76ae22c3f33eb6df341251",
"status": "affected",
"version": "a7ceca4398bc835c6ad29d10e1106de4cf0332e1",
"versionType": "git"
},
{
"lessThan": "960d1c85381bcaae866dd799b1c905ec5d39ebce",
"status": "affected",
"version": "a7ceca4398bc835c6ad29d10e1106de4cf0332e1",
"versionType": "git"
},
{
"lessThan": "1db134d0d2a51a136296584854570e5e04adedb0",
"status": "affected",
"version": "a7ceca4398bc835c6ad29d10e1106de4cf0332e1",
"versionType": "git"
},
{
"lessThan": "7cb575b71ab98194d2e040bded3a7281e089c5ed",
"status": "affected",
"version": "a7ceca4398bc835c6ad29d10e1106de4cf0332e1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/watchdog/da9063_wdt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog\n\nda9063_wdt_suspend() and da9063_wdt_resume() only check watchdog_active(),\nwhen the watchdog is left running by the driver sets\nWDOG_HW_RUNNING in da9063_wdt_probe() but userspace never opens the\ndevice, so WDOG_ACTIVE remains cleared, the wdt_disable() will not be\nexecuted in da9063_wdt_suspend. In this case, the suspend callback is\na no-op and the watchdog keeps counting during system suspend,\nleading to an unexpected system reset.\nCheck WDOG_HW_RUNNING and wdd\uff0ccan fix this issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:04.415Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/95adc37f47cdf5a5285f7163b24243680af510be"
},
{
"url": "https://git.kernel.org/stable/c/c30b419c7e6fbe31c48a44c828174168b732dc5b"
},
{
"url": "https://git.kernel.org/stable/c/1c42e39b0990371b9d76ae22c3f33eb6df341251"
},
{
"url": "https://git.kernel.org/stable/c/960d1c85381bcaae866dd799b1c905ec5d39ebce"
},
{
"url": "https://git.kernel.org/stable/c/1db134d0d2a51a136296584854570e5e04adedb0"
},
{
"url": "https://git.kernel.org/stable/c/7cb575b71ab98194d2e040bded3a7281e089c5ed"
}
],
"title": "watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98410",
"datePublished": "2026-10-14T13:27:43.581Z",
"dateReserved": "2026-09-25T10:25:14.347Z",
"dateUpdated": "2026-10-19T09:19:04.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98344 (GCVE-0-2026-98344)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: Fix device kref underflow in dma_chan_put()
dma_chan_get() takes chan->device->ref only on the slow path:
/* no kref on fast path */
if (chan->client_count) {
__module_get(owner);
chan->client_count++;
return 0;
}
if (!try_module_get(owner))
return -ENODEV;
if (!dma_device_get(chan->device)) { // calls kref_get_unless_zero()
dma_chan_put() drops the ref unconditionally, so every fast-path
get/put pair drops one extra device reference.
The bug fires when two conditions hold together: a non-private
provider has a persistent client holding chan->client_count > 0
and another client cycles dmaengine_get()/dmaengine_put().
When the kref hits zero, the subsequent dma_find_channel() returns
NULL even though the provider module is still loaded.
Fix this by dropping device->ref only on the last put, matching the
single slow-path get.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/dmaengine.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "036b527f92570206da4b8c40b38f8d689e29d0f3",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "5fb1797a8c9485e40e5492fa0338ab5c7d1f3fef",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "57f7f1c6827be7d8f80feca48d2125fb91c6f6ed",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "7c3f4ce651d43705f9ec7f778f642a90d5ff4fba",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "de2677e57d3161390d8a508f08cddec6ef7e4b23",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "1a0d9b406febf23054ad595fd47b29325e70fb2d",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "77906ac448d2fa81fa710ae26c0e591ebdc81154",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "44dab659064eb5c10adb0306510eebe848ed592d",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/dmaengine.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: Fix device kref underflow in dma_chan_put()\n\ndma_chan_get() takes chan-\u003edevice-\u003eref only on the slow path:\n\n\t/* no kref on fast path */\n\tif (chan-\u003eclient_count) {\n\t\t__module_get(owner);\n\t\tchan-\u003eclient_count++;\n\t\treturn 0;\n\t}\n\tif (!try_module_get(owner))\n\t\treturn -ENODEV;\n\tif (!dma_device_get(chan-\u003edevice)) { // calls kref_get_unless_zero()\n\ndma_chan_put() drops the ref unconditionally, so every fast-path\nget/put pair drops one extra device reference.\n\nThe bug fires when two conditions hold together: a non-private\nprovider has a persistent client holding chan-\u003eclient_count \u003e 0\nand another client cycles dmaengine_get()/dmaengine_put().\nWhen the kref hits zero, the subsequent dma_find_channel() returns\nNULL even though the provider module is still loaded.\n\nFix this by dropping device-\u003eref only on the last put, matching the\nsingle slow-path get."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:55.263Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/036b527f92570206da4b8c40b38f8d689e29d0f3"
},
{
"url": "https://git.kernel.org/stable/c/5fb1797a8c9485e40e5492fa0338ab5c7d1f3fef"
},
{
"url": "https://git.kernel.org/stable/c/57f7f1c6827be7d8f80feca48d2125fb91c6f6ed"
},
{
"url": "https://git.kernel.org/stable/c/7c3f4ce651d43705f9ec7f778f642a90d5ff4fba"
},
{
"url": "https://git.kernel.org/stable/c/de2677e57d3161390d8a508f08cddec6ef7e4b23"
},
{
"url": "https://git.kernel.org/stable/c/1a0d9b406febf23054ad595fd47b29325e70fb2d"
},
{
"url": "https://git.kernel.org/stable/c/77906ac448d2fa81fa710ae26c0e591ebdc81154"
},
{
"url": "https://git.kernel.org/stable/c/44dab659064eb5c10adb0306510eebe848ed592d"
}
],
"title": "dmaengine: Fix device kref underflow in dma_chan_put()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98344",
"datePublished": "2026-10-06T08:46:33.997Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-19T09:17:55.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98429 (GCVE-0-2026-98429)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/efa: Keep EQ resources alive while IRQ is registered
The completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was
registered before that state was initialized, while teardown released the
buffer before free_irq() synchronized the handler.
Initialize the EQ without arming it, register the IRQ, and then arm it.
Reverse the resource order during teardown by freeing the IRQ before
destroying the EQ.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2a152512a155aaf27c3e67834ffafaed9525a7b5 Version: 2a152512a155aaf27c3e67834ffafaed9525a7b5 Version: 2a152512a155aaf27c3e67834ffafaed9525a7b5 Version: 2a152512a155aaf27c3e67834ffafaed9525a7b5 Version: 2a152512a155aaf27c3e67834ffafaed9525a7b5 Version: 2a152512a155aaf27c3e67834ffafaed9525a7b5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/efa/efa_com.c",
"drivers/infiniband/hw/efa/efa_com.h",
"drivers/infiniband/hw/efa/efa_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3cd652dfcd822af26ba75d6d2d245ea7f73b499e",
"status": "affected",
"version": "2a152512a155aaf27c3e67834ffafaed9525a7b5",
"versionType": "git"
},
{
"lessThan": "c767e2812cac83fef70fb8932c3f0fe97dff9388",
"status": "affected",
"version": "2a152512a155aaf27c3e67834ffafaed9525a7b5",
"versionType": "git"
},
{
"lessThan": "795eb34bfd8b1ab347adc41a11e4bb97c3ac0ce6",
"status": "affected",
"version": "2a152512a155aaf27c3e67834ffafaed9525a7b5",
"versionType": "git"
},
{
"lessThan": "38871ff47e2a02f8d9a333a65f358d987247b5b0",
"status": "affected",
"version": "2a152512a155aaf27c3e67834ffafaed9525a7b5",
"versionType": "git"
},
{
"lessThan": "9ecd3dcbdf1f315aadc049b291f59c79dc478062",
"status": "affected",
"version": "2a152512a155aaf27c3e67834ffafaed9525a7b5",
"versionType": "git"
},
{
"lessThan": "e22a3627b7151754f07f90ea3d1ab6e85f5d93f4",
"status": "affected",
"version": "2a152512a155aaf27c3e67834ffafaed9525a7b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/efa/efa_com.c",
"drivers/infiniband/hw/efa/efa_com.h",
"drivers/infiniband/hw/efa/efa_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Keep EQ resources alive while IRQ is registered\n\nThe completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was\nregistered before that state was initialized, while teardown released the\nbuffer before free_irq() synchronized the handler.\n\nInitialize the EQ without arming it, register the IRQ, and then arm it.\nReverse the resource order during teardown by freeing the IRQ before\ndestroying the EQ."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:24.137Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3cd652dfcd822af26ba75d6d2d245ea7f73b499e"
},
{
"url": "https://git.kernel.org/stable/c/c767e2812cac83fef70fb8932c3f0fe97dff9388"
},
{
"url": "https://git.kernel.org/stable/c/795eb34bfd8b1ab347adc41a11e4bb97c3ac0ce6"
},
{
"url": "https://git.kernel.org/stable/c/38871ff47e2a02f8d9a333a65f358d987247b5b0"
},
{
"url": "https://git.kernel.org/stable/c/9ecd3dcbdf1f315aadc049b291f59c79dc478062"
},
{
"url": "https://git.kernel.org/stable/c/e22a3627b7151754f07f90ea3d1ab6e85f5d93f4"
}
],
"title": "RDMA/efa: Keep EQ resources alive while IRQ is registered",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98429",
"datePublished": "2026-10-14T13:27:54.960Z",
"dateReserved": "2026-09-25T10:25:14.348Z",
"dateUpdated": "2026-10-19T09:19:24.137Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98409 (GCVE-0-2026-98409)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
watchdog: rtd119x: Avoid division by zero
clk_get_rate() could return 0. Avoid a division by zero panic.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/watchdog/rtd119x_wdt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "757c721545b9ffac5c3042a0cd3685ea28af7e81",
"status": "affected",
"version": "2bdf6acbfead7e9aa69f36ee5682d1e5c8f70367",
"versionType": "git"
},
{
"lessThan": "1f22001b34984350844d629862f70934770cb796",
"status": "affected",
"version": "2bdf6acbfead7e9aa69f36ee5682d1e5c8f70367",
"versionType": "git"
},
{
"lessThan": "b4ede87765a2e58ca4f18f5f8037c4826b9cc93f",
"status": "affected",
"version": "2bdf6acbfead7e9aa69f36ee5682d1e5c8f70367",
"versionType": "git"
},
{
"lessThan": "8a12e049d517d7dee78500633f8f0e47262a67e0",
"status": "affected",
"version": "2bdf6acbfead7e9aa69f36ee5682d1e5c8f70367",
"versionType": "git"
},
{
"lessThan": "5af7d2cbd20f893def03c8310a460ade66a5d822",
"status": "affected",
"version": "2bdf6acbfead7e9aa69f36ee5682d1e5c8f70367",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/watchdog/rtd119x_wdt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: rtd119x: Avoid division by zero\n\nclk_get_rate() could return 0. Avoid a division by zero panic."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:03.465Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/757c721545b9ffac5c3042a0cd3685ea28af7e81"
},
{
"url": "https://git.kernel.org/stable/c/1f22001b34984350844d629862f70934770cb796"
},
{
"url": "https://git.kernel.org/stable/c/b4ede87765a2e58ca4f18f5f8037c4826b9cc93f"
},
{
"url": "https://git.kernel.org/stable/c/8a12e049d517d7dee78500633f8f0e47262a67e0"
},
{
"url": "https://git.kernel.org/stable/c/5af7d2cbd20f893def03c8310a460ade66a5d822"
}
],
"title": "watchdog: rtd119x: Avoid division by zero",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98409",
"datePublished": "2026-10-14T13:27:42.984Z",
"dateReserved": "2026-09-25T10:25:14.347Z",
"dateUpdated": "2026-10-19T09:19:03.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98264 (GCVE-0-2026-98264)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: virtio: reset device before deleting virtqueues
virtsnd_remove() and virtsnd_freeze() delete the virtqueues before
resetting the device. del_vqs() frees the vring backing, but does not
provide a generic device quiesce operation. In particular, modern
virtio-pci keeps enabled queues active until the device is reset.
Reset the device before deleting the virtqueues so it can no longer
access the vring memory when that memory is released. This also covers
probe failures after DRIVER_OK, which unwind through virtsnd_remove().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: de3a9980d8c34b2479173e809afa820473db676a Version: de3a9980d8c34b2479173e809afa820473db676a Version: de3a9980d8c34b2479173e809afa820473db676a Version: de3a9980d8c34b2479173e809afa820473db676a Version: de3a9980d8c34b2479173e809afa820473db676a Version: de3a9980d8c34b2479173e809afa820473db676a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/virtio/virtio_card.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8edc3669e3e22f0123a1114c3a03df9abc4cd465",
"status": "affected",
"version": "de3a9980d8c34b2479173e809afa820473db676a",
"versionType": "git"
},
{
"lessThan": "830012feadc228a938514a6487862dcf56af7e66",
"status": "affected",
"version": "de3a9980d8c34b2479173e809afa820473db676a",
"versionType": "git"
},
{
"lessThan": "500a8401415ab085555785c3c339747e378abd36",
"status": "affected",
"version": "de3a9980d8c34b2479173e809afa820473db676a",
"versionType": "git"
},
{
"lessThan": "3e24b4a6acfd3bedb2200334595facd767c9a897",
"status": "affected",
"version": "de3a9980d8c34b2479173e809afa820473db676a",
"versionType": "git"
},
{
"lessThan": "f070cce7cb361d5389b18f3ff6bd3d25a7596369",
"status": "affected",
"version": "de3a9980d8c34b2479173e809afa820473db676a",
"versionType": "git"
},
{
"lessThan": "6c05d00af307560e6a9f1631d6270d3df5aa2272",
"status": "affected",
"version": "de3a9980d8c34b2479173e809afa820473db676a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/virtio/virtio_card.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: virtio: reset device before deleting virtqueues\n\nvirtsnd_remove() and virtsnd_freeze() delete the virtqueues before\nresetting the device. del_vqs() frees the vring backing, but does not\nprovide a generic device quiesce operation. In particular, modern\nvirtio-pci keeps enabled queues active until the device is reset.\n\nReset the device before deleting the virtqueues so it can no longer\naccess the vring memory when that memory is released. This also covers\nprobe failures after DRIVER_OK, which unwind through virtsnd_remove()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:35.228Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8edc3669e3e22f0123a1114c3a03df9abc4cd465"
},
{
"url": "https://git.kernel.org/stable/c/830012feadc228a938514a6487862dcf56af7e66"
},
{
"url": "https://git.kernel.org/stable/c/500a8401415ab085555785c3c339747e378abd36"
},
{
"url": "https://git.kernel.org/stable/c/3e24b4a6acfd3bedb2200334595facd767c9a897"
},
{
"url": "https://git.kernel.org/stable/c/f070cce7cb361d5389b18f3ff6bd3d25a7596369"
},
{
"url": "https://git.kernel.org/stable/c/6c05d00af307560e6a9f1631d6270d3df5aa2272"
}
],
"title": "ALSA: virtio: reset device before deleting virtqueues",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98264",
"datePublished": "2026-10-06T08:45:27.657Z",
"dateReserved": "2026-09-25T10:25:14.332Z",
"dateUpdated": "2026-10-19T09:16:35.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98329 (GCVE-0-2026-98329)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't allow injecting frames wider than the chanctx
Frames injected on a monitor interface can carry a radiotap
field requesting a bandwidth, which mac80211 passes down to
the driver regardless of the the actual operational bandwidth.
If the bandwidth requested is too wide, that triggers a warning
in hwsim:
WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw))
Drop such frames entirely instead since they cannot be sent.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/mac80211.h",
"net/mac80211/iface.c",
"net/mac80211/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a5c715eda066cba5ce3372759188ba8636dca629",
"status": "affected",
"version": "646e76bb5daf4ca38438c69ffb72cccb605f3466",
"versionType": "git"
},
{
"lessThan": "73f48f7e16cadfc74f444ccd10c1d3ae253e2e27",
"status": "affected",
"version": "646e76bb5daf4ca38438c69ffb72cccb605f3466",
"versionType": "git"
},
{
"lessThan": "c69718519a81e87284494d0c6e6eb7bdd834707a",
"status": "affected",
"version": "646e76bb5daf4ca38438c69ffb72cccb605f3466",
"versionType": "git"
},
{
"lessThan": "e14bf37bb2b3853012ff160131d1c6233f7a9cc9",
"status": "affected",
"version": "646e76bb5daf4ca38438c69ffb72cccb605f3466",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/mac80211.h",
"net/mac80211/iface.c",
"net/mac80211/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0027t allow injecting frames wider than the chanctx\n\nFrames injected on a monitor interface can carry a radiotap\nfield requesting a bandwidth, which mac80211 passes down to\nthe driver regardless of the the actual operational bandwidth.\n\nIf the bandwidth requested is too wide, that triggers a warning\nin hwsim:\n\n WARN_ON(hwsim_get_chanwidth(bw) \u003e hwsim_get_chanwidth(confbw))\n\nDrop such frames entirely instead since they cannot be sent."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:39.579Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a5c715eda066cba5ce3372759188ba8636dca629"
},
{
"url": "https://git.kernel.org/stable/c/73f48f7e16cadfc74f444ccd10c1d3ae253e2e27"
},
{
"url": "https://git.kernel.org/stable/c/c69718519a81e87284494d0c6e6eb7bdd834707a"
},
{
"url": "https://git.kernel.org/stable/c/e14bf37bb2b3853012ff160131d1c6233f7a9cc9"
}
],
"title": "wifi: mac80211: don\u0027t allow injecting frames wider than the chanctx",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98329",
"datePublished": "2026-10-06T08:46:21.887Z",
"dateReserved": "2026-09-25T10:25:14.341Z",
"dateUpdated": "2026-10-19T09:17:39.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98303 (GCVE-0-2026-98303)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
When the forward output route cannot be used in icmp_route_lookup(),
it enters the "reverse path" and calls ip_route_input() on fl4_dec.daddr,
the original packet's source address.
ip_route_input() only returns an error for truly invalid packets. For
unreachable addresses it will succeed and return an input route whose
dst.output is set to ip_rt_bug(). The existing check only rejects
RTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned
and later used for output, syzkaller triggering a WARN_ON_ONCE()
in ip_rt_bug() as bellow:
------------[ cut here ]------------
WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20
RIP: 0010:ip_rt_bug+0x14/0x20
Call Trace:
ip_push_pending_frames+0xfa/0x100
__icmp_send+0x905/0xf10
ip_options_compile+0xc0/0xd0
ip_rcv_finish_core+0x321/0xae0
ip_rcv+0x1de/0x260
__netif_receive_skb_one_core+0x11a/0x130
netif_receive_skb+0x7b/0x260
tun_get_user+0x11bf/0x1c10
------------[ cut here ]------------
Reject input route that is RTN_UNREACHABLE to fix it. The net warning
is only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of
a race condition.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 Version: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 Version: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 Version: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 Version: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 Version: 8b7817f3a959ed99d7443afc12f78a7e1fcc2063 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/icmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06083cea4a3b95f5ebc85312f97d7086e6c9e782",
"status": "affected",
"version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063",
"versionType": "git"
},
{
"lessThan": "83aa83f81a8fec30ff5372dee60b2f0561bcb2ca",
"status": "affected",
"version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063",
"versionType": "git"
},
{
"lessThan": "cac69c50716c712ef0114837c9427da66066124c",
"status": "affected",
"version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063",
"versionType": "git"
},
{
"lessThan": "1af2d87964d87ba7626d96928d68c09158b5a223",
"status": "affected",
"version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063",
"versionType": "git"
},
{
"lessThan": "fda3000147dc96c75ba162f680bec0a9fecf3037",
"status": "affected",
"version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063",
"versionType": "git"
},
{
"lessThan": "2998147b59c9df0a51477c7a6b3d1f0ba3127dd4",
"status": "affected",
"version": "8b7817f3a959ed99d7443afc12f78a7e1fcc2063",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/icmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup\n\nWhen the forward output route cannot be used in icmp_route_lookup(),\nit enters the \"reverse path\" and calls ip_route_input() on fl4_dec.daddr,\nthe original packet\u0027s source address.\n\nip_route_input() only returns an error for truly invalid packets. For\nunreachable addresses it will succeed and return an input route whose\ndst.output is set to ip_rt_bug(). The existing check only rejects\nRTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned\nand later used for output, syzkaller triggering a WARN_ON_ONCE()\nin ip_rt_bug() as bellow:\n\n ------------[ cut here ]------------\n WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20\n RIP: 0010:ip_rt_bug+0x14/0x20\n Call Trace:\n ip_push_pending_frames+0xfa/0x100\n __icmp_send+0x905/0xf10\n ip_options_compile+0xc0/0xd0\n ip_rcv_finish_core+0x321/0xae0\n ip_rcv+0x1de/0x260\n __netif_receive_skb_one_core+0x11a/0x130\n netif_receive_skb+0x7b/0x260\n tun_get_user+0x11bf/0x1c10\n ------------[ cut here ]------------\n\nReject input route that is RTN_UNREACHABLE to fix it. The net warning\nis only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of\na race condition."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:14.136Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06083cea4a3b95f5ebc85312f97d7086e6c9e782"
},
{
"url": "https://git.kernel.org/stable/c/83aa83f81a8fec30ff5372dee60b2f0561bcb2ca"
},
{
"url": "https://git.kernel.org/stable/c/cac69c50716c712ef0114837c9427da66066124c"
},
{
"url": "https://git.kernel.org/stable/c/1af2d87964d87ba7626d96928d68c09158b5a223"
},
{
"url": "https://git.kernel.org/stable/c/fda3000147dc96c75ba162f680bec0a9fecf3037"
},
{
"url": "https://git.kernel.org/stable/c/2998147b59c9df0a51477c7a6b3d1f0ba3127dd4"
}
],
"title": "ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98303",
"datePublished": "2026-10-06T08:46:00.524Z",
"dateReserved": "2026-09-25T10:25:14.338Z",
"dateUpdated": "2026-10-19T09:17:14.136Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98179 (GCVE-0-2026-98179)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix rmmio iounmap skipped on device removal
amdgpu_pci_remove() calls drm_dev_unplug() before fini_sw(), so
drm_dev_enter() is already false there and the iounmap() guarded by it
is skipped. This .remove path runs on both hot-unplug and plain rmmod,
so the register BAR ioremap mapping leaks one instance per unload.
Unmap rmmio unconditionally (guard only on non-NULL) and drop the now
unused idx.
(cherry picked from commit dd6f86a97260e5207d3329ad03aa89fdad61b1e6)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e81502d6791df9ecd003bfb2ca44f0d1f1b38439",
"status": "affected",
"version": "62d5f9f7110ad374db67ab4820f4ff2d916c3cdb",
"versionType": "git"
},
{
"lessThan": "cd55dde2b63789a3dafe982c89844f537501d096",
"status": "affected",
"version": "62d5f9f7110ad374db67ab4820f4ff2d916c3cdb",
"versionType": "git"
},
{
"lessThan": "a645584c3ccc493ee835f77155829442bd7578c3",
"status": "affected",
"version": "62d5f9f7110ad374db67ab4820f4ff2d916c3cdb",
"versionType": "git"
},
{
"lessThan": "5155002b03b24ba3ef91c5c313b8cf0171b24904",
"status": "affected",
"version": "62d5f9f7110ad374db67ab4820f4ff2d916c3cdb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix rmmio iounmap skipped on device removal\n\namdgpu_pci_remove() calls drm_dev_unplug() before fini_sw(), so\ndrm_dev_enter() is already false there and the iounmap() guarded by it\nis skipped. This .remove path runs on both hot-unplug and plain rmmod,\nso the register BAR ioremap mapping leaks one instance per unload.\n\nUnmap rmmio unconditionally (guard only on non-NULL) and drop the now\nunused idx.\n\n(cherry picked from commit dd6f86a97260e5207d3329ad03aa89fdad61b1e6)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:10.578Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e81502d6791df9ecd003bfb2ca44f0d1f1b38439"
},
{
"url": "https://git.kernel.org/stable/c/cd55dde2b63789a3dafe982c89844f537501d096"
},
{
"url": "https://git.kernel.org/stable/c/a645584c3ccc493ee835f77155829442bd7578c3"
},
{
"url": "https://git.kernel.org/stable/c/5155002b03b24ba3ef91c5c313b8cf0171b24904"
}
],
"title": "drm/amdgpu: fix rmmio iounmap skipped on device removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98179",
"datePublished": "2026-10-06T08:44:22.410Z",
"dateReserved": "2026-09-25T10:25:14.322Z",
"dateUpdated": "2026-10-19T09:15:10.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98199 (GCVE-0-2026-98199)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/core) increase number of phases and add new mask
Increase the number of phases to 16 as a new upcoming device supports
such a number.
While at it, add a new mask for controlling the source of the output
voltage.
Note (groeck):
This patch was meant to prepare for support of MAX20826 and compatible
devices, which support more than 10 phases per page. However, Sashiko
reports that the mp2975 driver already supports up to 14 phases, and the
mp2856 driver supports up to 12 phases. This already has the potential for
out-of-bounds writes when probing the affected chips, making this patch a
bug fix.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2c6fcbb211494f1ff6ef384776944b9e04f4c14c Version: 2c6fcbb211494f1ff6ef384776944b9e04f4c14c Version: 2c6fcbb211494f1ff6ef384776944b9e04f4c14c Version: 2c6fcbb211494f1ff6ef384776944b9e04f4c14c Version: 2c6fcbb211494f1ff6ef384776944b9e04f4c14c Version: 2c6fcbb211494f1ff6ef384776944b9e04f4c14c Version: 2c6fcbb211494f1ff6ef384776944b9e04f4c14c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/pmbus.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "272006a52cbd9c8342cead4d3eb9221ebbe8b985",
"status": "affected",
"version": "2c6fcbb211494f1ff6ef384776944b9e04f4c14c",
"versionType": "git"
},
{
"lessThan": "b32607710a20ad983f9fe4a3051892584c0641a4",
"status": "affected",
"version": "2c6fcbb211494f1ff6ef384776944b9e04f4c14c",
"versionType": "git"
},
{
"lessThan": "66368f682a53f3a3842e20eebb571a59809c52c0",
"status": "affected",
"version": "2c6fcbb211494f1ff6ef384776944b9e04f4c14c",
"versionType": "git"
},
{
"lessThan": "1ec644c94466834f8cb6b7ba12636fd047bdfdda",
"status": "affected",
"version": "2c6fcbb211494f1ff6ef384776944b9e04f4c14c",
"versionType": "git"
},
{
"lessThan": "9558fc1e042ac6b12dd63c37d2c51be4ec86d402",
"status": "affected",
"version": "2c6fcbb211494f1ff6ef384776944b9e04f4c14c",
"versionType": "git"
},
{
"lessThan": "b49f100a15b8876deccf8c59f41af92b8e25fd74",
"status": "affected",
"version": "2c6fcbb211494f1ff6ef384776944b9e04f4c14c",
"versionType": "git"
},
{
"lessThan": "06bd6794b5fd2163880ac3bfe973d4cc61f359f3",
"status": "affected",
"version": "2c6fcbb211494f1ff6ef384776944b9e04f4c14c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/pmbus.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/core) increase number of phases and add new mask\n\nIncrease the number of phases to 16 as a new upcoming device supports\nsuch a number.\n\nWhile at it, add a new mask for controlling the source of the output\nvoltage.\n\nNote (groeck):\n\nThis patch was meant to prepare for support of MAX20826 and compatible\ndevices, which support more than 10 phases per page. However, Sashiko\nreports that the mp2975 driver already supports up to 14 phases, and the\nmp2856 driver supports up to 12 phases. This already has the potential for\nout-of-bounds writes when probing the affected chips, making this patch a\nbug fix."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:30.300Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/272006a52cbd9c8342cead4d3eb9221ebbe8b985"
},
{
"url": "https://git.kernel.org/stable/c/b32607710a20ad983f9fe4a3051892584c0641a4"
},
{
"url": "https://git.kernel.org/stable/c/66368f682a53f3a3842e20eebb571a59809c52c0"
},
{
"url": "https://git.kernel.org/stable/c/1ec644c94466834f8cb6b7ba12636fd047bdfdda"
},
{
"url": "https://git.kernel.org/stable/c/9558fc1e042ac6b12dd63c37d2c51be4ec86d402"
},
{
"url": "https://git.kernel.org/stable/c/b49f100a15b8876deccf8c59f41af92b8e25fd74"
},
{
"url": "https://git.kernel.org/stable/c/06bd6794b5fd2163880ac3bfe973d4cc61f359f3"
}
],
"title": "hwmon: (pmbus/core) increase number of phases and add new mask",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98199",
"datePublished": "2026-10-06T08:44:37.623Z",
"dateReserved": "2026-09-25T10:25:14.324Z",
"dateUpdated": "2026-10-19T09:15:30.300Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98354 (GCVE-0-2026-98354)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mad: Fix receive buffer leak when PKey enforcement fails
ib_mad_complete_recv() initializes mad_recv_wc->rmpp_list and then runs
ib_mad_enforce_security() before linking recv_buf onto that list. On
failure it calls ib_free_recv_mad(), which only walks rmpp_list and frees
the ib_mad_private of every buffer found there. As the list is still
empty at that point, nothing is freed at all.
The caller cannot clean up either: ib_mad_recv_done() sets recv to NULL
right after ib_mad_complete_recv() returns, assuming the MAD layer took
ownership of the buffer. Every MAD that fails the PKey check therefore
leaks one ib_mad_private (about 300 bytes per IB port MAD, ~2K for OPA),
and a remote node can trigger this repeatedly by sending MADs with a
wrong PKey.
Link recv_buf onto rmpp_list right after the list is initialized, so the
error path has something to free.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 47a2b338fe63200d716d2e24131cdb49f17c77da Version: 47a2b338fe63200d716d2e24131cdb49f17c77da Version: 47a2b338fe63200d716d2e24131cdb49f17c77da Version: 47a2b338fe63200d716d2e24131cdb49f17c77da Version: 47a2b338fe63200d716d2e24131cdb49f17c77da Version: 47a2b338fe63200d716d2e24131cdb49f17c77da Version: 47a2b338fe63200d716d2e24131cdb49f17c77da Version: 47a2b338fe63200d716d2e24131cdb49f17c77da |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/mad.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4617c9a856188674dddb0ca66979746d07688579",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "8e2036fb47a5b152d53eadbd35abf311bd34cc7f",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "bad289e42f512646a988f278f536d21547df73f1",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "752b30e9d339008e5ce7eed412e9446078916129",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "39c4ea72a40503e102ae07e6776005f96ca078a6",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "5091e25ec503f7fc02723ca435226467b68caac7",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "c0d8df85db146d6275e226cb950023be69dd6c77",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "3476c28c9addfa253f505e6bd87f1f5598b961d0",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/mad.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mad: Fix receive buffer leak when PKey enforcement fails\n\nib_mad_complete_recv() initializes mad_recv_wc-\u003ermpp_list and then runs\nib_mad_enforce_security() before linking recv_buf onto that list. On\nfailure it calls ib_free_recv_mad(), which only walks rmpp_list and frees\nthe ib_mad_private of every buffer found there. As the list is still\nempty at that point, nothing is freed at all.\n\nThe caller cannot clean up either: ib_mad_recv_done() sets recv to NULL\nright after ib_mad_complete_recv() returns, assuming the MAD layer took\nownership of the buffer. Every MAD that fails the PKey check therefore\nleaks one ib_mad_private (about 300 bytes per IB port MAD, ~2K for OPA),\nand a remote node can trigger this repeatedly by sending MADs with a\nwrong PKey.\n\nLink recv_buf onto rmpp_list right after the list is initialized, so the\nerror path has something to free."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:04.973Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4617c9a856188674dddb0ca66979746d07688579"
},
{
"url": "https://git.kernel.org/stable/c/8e2036fb47a5b152d53eadbd35abf311bd34cc7f"
},
{
"url": "https://git.kernel.org/stable/c/bad289e42f512646a988f278f536d21547df73f1"
},
{
"url": "https://git.kernel.org/stable/c/752b30e9d339008e5ce7eed412e9446078916129"
},
{
"url": "https://git.kernel.org/stable/c/39c4ea72a40503e102ae07e6776005f96ca078a6"
},
{
"url": "https://git.kernel.org/stable/c/5091e25ec503f7fc02723ca435226467b68caac7"
},
{
"url": "https://git.kernel.org/stable/c/c0d8df85db146d6275e226cb950023be69dd6c77"
},
{
"url": "https://git.kernel.org/stable/c/3476c28c9addfa253f505e6bd87f1f5598b961d0"
}
],
"title": "RDMA/mad: Fix receive buffer leak when PKey enforcement fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98354",
"datePublished": "2026-10-06T08:46:41.768Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-19T09:18:04.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98386 (GCVE-0-2026-98386)
Vulnerability from cvelistv5
Published
2026-10-14 13:25
Modified
2026-10-21 12:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
For QLAFX00 the request ring is ioremapped device I/O memory
(ha->iobase + req_que_off), not DMA-coherent RAM, which is why the rest
of the FX00 path accesses it through memcpy_toio() and the wrt_reg_*
helpers. __qla2x00_alloc_iocbs() however zeroed the producer slot with a
plain memset(). On architectures such as ARM64 a regular memset() may
emit unaligned or block-zeroing instructions (e.g. DC ZVA) that are
invalid on Device memory, leading to a synchronous external abort.
Use memset_io() to clear the slot for QLAFX00, matching the I/O
accessors used elsewhere on this ring. Other adapters keep the plain
memset() on their DMA-coherent rings. The zero-fill is retained for FX00
because its IOCB builders (e.g. qlafx00_fxdisc_iocb()) copy only part of
the entry and rely on the unused tail being pre-zeroed.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_iocb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2df8c8630904794100189fa3d70598642e1877ce",
"status": "affected",
"version": "8ae6d9c7eb1004bc134813287010d57a863ba13b",
"versionType": "git"
},
{
"lessThan": "53eb96c244d150dfb8cc4b5b0492ab53755f3701",
"status": "affected",
"version": "8ae6d9c7eb1004bc134813287010d57a863ba13b",
"versionType": "git"
},
{
"lessThan": "6ee6dfd922fafd508f6bde16de30dd2db796b7a7",
"status": "affected",
"version": "8ae6d9c7eb1004bc134813287010d57a863ba13b",
"versionType": "git"
},
{
"lessThan": "e41d28d9a242c4005b7d01a7ee7769405a6a2c2e",
"status": "affected",
"version": "8ae6d9c7eb1004bc134813287010d57a863ba13b",
"versionType": "git"
},
{
"lessThan": "626e44f3d8a924a97a3848a9fd45833947e081e9",
"status": "affected",
"version": "8ae6d9c7eb1004bc134813287010d57a863ba13b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_iocb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot\n\nFor QLAFX00 the request ring is ioremapped device I/O memory\n(ha-\u003eiobase + req_que_off), not DMA-coherent RAM, which is why the rest\nof the FX00 path accesses it through memcpy_toio() and the wrt_reg_*\nhelpers. __qla2x00_alloc_iocbs() however zeroed the producer slot with a\nplain memset(). On architectures such as ARM64 a regular memset() may\nemit unaligned or block-zeroing instructions (e.g. DC ZVA) that are\ninvalid on Device memory, leading to a synchronous external abort.\n\nUse memset_io() to clear the slot for QLAFX00, matching the I/O\naccessors used elsewhere on this ring. Other adapters keep the plain\nmemset() on their DMA-coherent rings. The zero-fill is retained for FX00\nbecause its IOCB builders (e.g. qlafx00_fxdisc_iocb()) copy only part of\nthe entry and rely on the unused tail being pre-zeroed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:55:01.405Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2df8c8630904794100189fa3d70598642e1877ce"
},
{
"url": "https://git.kernel.org/stable/c/53eb96c244d150dfb8cc4b5b0492ab53755f3701"
},
{
"url": "https://git.kernel.org/stable/c/6ee6dfd922fafd508f6bde16de30dd2db796b7a7"
},
{
"url": "https://git.kernel.org/stable/c/e41d28d9a242c4005b7d01a7ee7769405a6a2c2e"
},
{
"url": "https://git.kernel.org/stable/c/626e44f3d8a924a97a3848a9fd45833947e081e9"
}
],
"title": "scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98386",
"datePublished": "2026-10-14T13:25:50.908Z",
"dateReserved": "2026-09-25T10:25:14.346Z",
"dateUpdated": "2026-10-21T12:55:01.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98416 (GCVE-0-2026-98416)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
If devm_kcalloc() for rx_chn->flows fails in a channel request function,
the error path calls k3_udma_glue_release_rx_chn(), which dereferences
the NULL rx_chn->flows pointer in k3_udma_glue_release_rx_flow().
Skip the flow release loop in k3_udma_glue_release_rx_chn() when
rx_chn->flows is not allocated.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d702419134133db1eab2067dc6ea5723467fd917 Version: d702419134133db1eab2067dc6ea5723467fd917 Version: d702419134133db1eab2067dc6ea5723467fd917 Version: d702419134133db1eab2067dc6ea5723467fd917 Version: d702419134133db1eab2067dc6ea5723467fd917 Version: d702419134133db1eab2067dc6ea5723467fd917 Version: d702419134133db1eab2067dc6ea5723467fd917 Version: d702419134133db1eab2067dc6ea5723467fd917 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/ti/k3-udma-glue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b51ed7885ab0e8ecad765adc13b465cb1498cdc9",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
},
{
"lessThan": "b2985956e06632939bee47cee13bccd78ad7c3a1",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
},
{
"lessThan": "967612574c542dec71f820a6eb16dea80dd187a1",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
},
{
"lessThan": "89f5414660724bb562db4ac74665da16d4a57d99",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
},
{
"lessThan": "5a6cb4d387eebf7d32a6ed3fcd39f94bf38bd134",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
},
{
"lessThan": "b14e6c52872556de2d6c137531e0ce85085c10ed",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
},
{
"lessThan": "5b2d92b7b177226e1dca2e80dc8369131276c2a4",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
},
{
"lessThan": "0294b6dd515256c03ea2dbf508ddd3826d788579",
"status": "affected",
"version": "d702419134133db1eab2067dc6ea5723467fd917",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/ti/k3-udma-glue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()\n\nIf devm_kcalloc() for rx_chn-\u003eflows fails in a channel request function,\nthe error path calls k3_udma_glue_release_rx_chn(), which dereferences\nthe NULL rx_chn-\u003eflows pointer in k3_udma_glue_release_rx_flow().\n\nSkip the flow release loop in k3_udma_glue_release_rx_chn() when\nrx_chn-\u003eflows is not allocated.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:10.061Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b51ed7885ab0e8ecad765adc13b465cb1498cdc9"
},
{
"url": "https://git.kernel.org/stable/c/b2985956e06632939bee47cee13bccd78ad7c3a1"
},
{
"url": "https://git.kernel.org/stable/c/967612574c542dec71f820a6eb16dea80dd187a1"
},
{
"url": "https://git.kernel.org/stable/c/89f5414660724bb562db4ac74665da16d4a57d99"
},
{
"url": "https://git.kernel.org/stable/c/5a6cb4d387eebf7d32a6ed3fcd39f94bf38bd134"
},
{
"url": "https://git.kernel.org/stable/c/b14e6c52872556de2d6c137531e0ce85085c10ed"
},
{
"url": "https://git.kernel.org/stable/c/5b2d92b7b177226e1dca2e80dc8369131276c2a4"
},
{
"url": "https://git.kernel.org/stable/c/0294b6dd515256c03ea2dbf508ddd3826d788579"
}
],
"title": "dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98416",
"datePublished": "2026-10-14T13:27:47.215Z",
"dateReserved": "2026-09-25T10:25:14.347Z",
"dateUpdated": "2026-10-19T09:19:10.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98347 (GCVE-0-2026-98347)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/IPoIB: Avoid restoring OPER_UP after multicast flush
ipoib_ib_dev_flush_light() temporarily clears IPOIB_FLAG_OPER_UP to
prevent multicast joins while ipoib_mcast_dev_flush() is running, and
restores the flag afterwards if it was previously set.
This restore races with ipoib_ib_dev_down(). If the interface is brought
down while the flush is in progress, ipoib_ib_dev_down() clears
IPOIB_FLAG_OPER_UP, but the flush path may set it again after the device
has already gone down.
Since commit 894021a75291 ("IB/ipoib: Make the carrier_on_task race
aware"), ipoib_mcast_carrier_on_task() relies on IPOIB_FLAG_OPER_UP
being cleared to terminate its rtnl_trylock() retry loop. If the flag is
left set after shutdown, the workqueue retries forever, causing teardown
to deadlock when ipoib_ndo_uninit() waits in destroy_workqueue() while
holding RTNL.
Instead of overloading IPOIB_FLAG_OPER_UP to block multicast joins
during a light flush, introduce a dedicated IPOIB_FLAG_MCAST_FLUSH flag.
Use it together with IPOIB_FLAG_OPER_UP to determine whether multicast
joins are allowed, avoiding the race with device shutdown.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 344bacca8cd811809fc33a249f2738ab757d327f Version: 344bacca8cd811809fc33a249f2738ab757d327f Version: 344bacca8cd811809fc33a249f2738ab757d327f Version: 344bacca8cd811809fc33a249f2738ab757d327f Version: 344bacca8cd811809fc33a249f2738ab757d327f Version: 344bacca8cd811809fc33a249f2738ab757d327f Version: 344bacca8cd811809fc33a249f2738ab757d327f Version: 344bacca8cd811809fc33a249f2738ab757d327f Version: a289c65ca49d2680a3d797e633e57a45573d1df2 Version: b81459c78935e4579a577b2366c5f8878d3c7fee Version: 8a9d8dc9ce83a90bfbbe69181acc4cf1beff46f5 Version: dfe809702a11bd7fb91c882fb55620e39ce22109 Version: 87160fb51bc343793cc8f5f031a87f1a35aecb82 Version: 749fd55dd210f9676f0d445a6efaaa3bec65174a Version: 3.2.84 ≤ Version: 3.10.105 ≤ Version: 3.12.65 ≤ Version: 3.16.39 ≤ Version: 4.4.24 ≤ Version: 4.7.7 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/ipoib/ipoib.h",
"drivers/infiniband/ulp/ipoib/ipoib_ib.c",
"drivers/infiniband/ulp/ipoib/ipoib_multicast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f973769fb7cb33ba0d4a64b7dcfee0cabaead938",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "b72f38929f4b5aa83161fd3b22a7327207e51ec5",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "1b11e4b55b41d9e69a8e8d07622614202e2eaca9",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "326f7d34bd7e64de535566b65c0533b640df5a81",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "5ad925d45f28464a5e043c9620880bb6a030da89",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "188b334a6db36a8e0bfaaf59bc4020639a0f3aad",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "1ff3add37c329704ec46181b4ae4f00f9f16ce6f",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "9a141d3dc869d18b2eab35e999f4790a9b84e40f",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"status": "affected",
"version": "a289c65ca49d2680a3d797e633e57a45573d1df2",
"versionType": "git"
},
{
"status": "affected",
"version": "b81459c78935e4579a577b2366c5f8878d3c7fee",
"versionType": "git"
},
{
"status": "affected",
"version": "8a9d8dc9ce83a90bfbbe69181acc4cf1beff46f5",
"versionType": "git"
},
{
"status": "affected",
"version": "dfe809702a11bd7fb91c882fb55620e39ce22109",
"versionType": "git"
},
{
"status": "affected",
"version": "87160fb51bc343793cc8f5f031a87f1a35aecb82",
"versionType": "git"
},
{
"status": "affected",
"version": "749fd55dd210f9676f0d445a6efaaa3bec65174a",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.84",
"versionType": "semver"
},
{
"lessThan": "3.11",
"status": "affected",
"version": "3.10.105",
"versionType": "semver"
},
{
"lessThan": "3.13",
"status": "affected",
"version": "3.12.65",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.39",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.24",
"versionType": "semver"
},
{
"lessThan": "4.8",
"status": "affected",
"version": "4.7.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/ipoib/ipoib.h",
"drivers/infiniband/ulp/ipoib/ipoib_ib.c",
"drivers/infiniband/ulp/ipoib/ipoib_multicast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.105",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.12.65",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.7.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/IPoIB: Avoid restoring OPER_UP after multicast flush\n\nipoib_ib_dev_flush_light() temporarily clears IPOIB_FLAG_OPER_UP to\nprevent multicast joins while ipoib_mcast_dev_flush() is running, and\nrestores the flag afterwards if it was previously set.\n\nThis restore races with ipoib_ib_dev_down(). If the interface is brought\ndown while the flush is in progress, ipoib_ib_dev_down() clears\nIPOIB_FLAG_OPER_UP, but the flush path may set it again after the device\nhas already gone down.\n\nSince commit 894021a75291 (\"IB/ipoib: Make the carrier_on_task race\naware\"), ipoib_mcast_carrier_on_task() relies on IPOIB_FLAG_OPER_UP\nbeing cleared to terminate its rtnl_trylock() retry loop. If the flag is\nleft set after shutdown, the workqueue retries forever, causing teardown\nto deadlock when ipoib_ndo_uninit() waits in destroy_workqueue() while\nholding RTNL.\n\nInstead of overloading IPOIB_FLAG_OPER_UP to block multicast joins\nduring a light flush, introduce a dedicated IPOIB_FLAG_MCAST_FLUSH flag.\nUse it together with IPOIB_FLAG_OPER_UP to determine whether multicast\njoins are allowed, avoiding the race with device shutdown."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:58.195Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f973769fb7cb33ba0d4a64b7dcfee0cabaead938"
},
{
"url": "https://git.kernel.org/stable/c/b72f38929f4b5aa83161fd3b22a7327207e51ec5"
},
{
"url": "https://git.kernel.org/stable/c/1b11e4b55b41d9e69a8e8d07622614202e2eaca9"
},
{
"url": "https://git.kernel.org/stable/c/326f7d34bd7e64de535566b65c0533b640df5a81"
},
{
"url": "https://git.kernel.org/stable/c/5ad925d45f28464a5e043c9620880bb6a030da89"
},
{
"url": "https://git.kernel.org/stable/c/188b334a6db36a8e0bfaaf59bc4020639a0f3aad"
},
{
"url": "https://git.kernel.org/stable/c/1ff3add37c329704ec46181b4ae4f00f9f16ce6f"
},
{
"url": "https://git.kernel.org/stable/c/9a141d3dc869d18b2eab35e999f4790a9b84e40f"
}
],
"title": "IB/IPoIB: Avoid restoring OPER_UP after multicast flush",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98347",
"datePublished": "2026-10-06T08:46:36.136Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-19T09:17:58.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98383 (GCVE-0-2026-98383)
Vulnerability from cvelistv5
Published
2026-10-09 07:34
Modified
2026-10-24 14:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
An LWT_SEG6LOCAL program can invalidate its cached SRH with
bpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter
may reallocate skb->head, leaving the per-CPU SRH pointer dangling.
Post-program SRH validation then writes through that pointer.
Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier
rejects this unsafe helper combination. Other LWT program types continue
to expose the helper through lwt_out_func_proto().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 Version: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 Version: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 Version: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 Version: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 Version: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 Version: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 Version: 004d4b274e2a1a895a0e5dc66158b90a7d463d44 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f38472a2aa8704a6b514c0dfa9c32f3672b8f32",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "cae8674489f26edf7553fdd660599466cbb4c32f",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "9f9e57b5a3a033f95f49ef9d541340cdbcb80abb",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "df0072be6fc373cb22f9ea854d458b04e32a03cf",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "b9bb0e735460751b620156f800a4279a28573392",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "37b18688cd18fd86d2f35c212df1611862a26cd5",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "fca71ead7a20290af1e2046983eeafae43d21af1",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
},
{
"lessThan": "e4a62833adff6ef0fe7c0b90393204fe3c26b5c5",
"status": "affected",
"version": "004d4b274e2a1a895a0e5dc66158b90a7d463d44",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL\n\nAn LWT_SEG6LOCAL program can invalidate its cached SRH with\nbpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter\nmay reallocate skb-\u003ehead, leaving the per-CPU SRH pointer dangling.\nPost-program SRH validation then writes through that pointer.\n\nDisallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier\nrejects this unsafe helper combination. Other LWT program types continue\nto expose the helper through lwt_out_func_proto()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The local bpf(BPF_PROG_LOAD) path reaches check_helper_call() and the patched lwt_seg6local_func_proto(), where attacker-authored bytecode requests bpf_lwt_seg6_adjust_srh() and bpf_skb_pull_data(); an RTM_NEWROUTE then attaches it. A received SRH packet merely executes that installed program and cannot create the unsafe helper sequence.\nAC:L - The attacker controls the helper order, SRH offset and length, and can inject a large non-linear SRv6 frame so bpf_skb_pull_data() deterministically reaches __pskb_pull_tail() and pskb_expand_head(). No race is required, and repeated packets reproduce the stale-pointer write.\nPR:L - bpf_prog_load() requires CAP_BPF and CAP_NET_ADMIN for BPF_PROG_TYPE_LWT_SEG6LOCAL, but BPF_F_TOKEN_FD and bpf_token_capable() support delegating both into a user namespace; rtnetlink_rcv_msg() separately accepts CAP_NET_ADMIN in the route\u0027s network namespace. Thus a host-unprivileged token holder can perform the complete setup.\nUI:N - The attacker loads the program, installs the End.BPF route, and injects the triggering SRv6 frame without any victim action.\nS:U - The stale srh pointer and resulting corruption occur in the same host kernel that processes the attacker\u0027s BPF program and packet; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - After skb-\u003ehead is freed, seg6_bpf_has_valid_srh() passes the dangling srh pointer to seg6_validate_srh(), which reads header fields and variable-length TLVs from reusable slab memory; its drop-versus-forward result also provides an observable contents oracle.\nI:H - seg6_bpf_has_valid_srh() executes srh-\u003ehdrlen = srh_state-\u003ehdrlen \u003e\u003e 3 through the dangling pointer, producing an attacker-valued one-byte write into freed slab memory that can corrupt a reclaimed object or allocator state and support control-flow compromise.\nA:H - The stale write in seg6_bpf_has_valid_srh() is a confirmed slab use-after-free and can trigger a KASAN panic or later kernel oops through corrupted freed-object state; the attacker can repeat it with additional packets."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:08:40.964Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f38472a2aa8704a6b514c0dfa9c32f3672b8f32"
},
{
"url": "https://git.kernel.org/stable/c/cae8674489f26edf7553fdd660599466cbb4c32f"
},
{
"url": "https://git.kernel.org/stable/c/9f9e57b5a3a033f95f49ef9d541340cdbcb80abb"
},
{
"url": "https://git.kernel.org/stable/c/df0072be6fc373cb22f9ea854d458b04e32a03cf"
},
{
"url": "https://git.kernel.org/stable/c/b9bb0e735460751b620156f800a4279a28573392"
},
{
"url": "https://git.kernel.org/stable/c/37b18688cd18fd86d2f35c212df1611862a26cd5"
},
{
"url": "https://git.kernel.org/stable/c/fca71ead7a20290af1e2046983eeafae43d21af1"
},
{
"url": "https://git.kernel.org/stable/c/e4a62833adff6ef0fe7c0b90393204fe3c26b5c5"
}
],
"title": "bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98383",
"datePublished": "2026-10-09T07:34:22.408Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-24T14:08:40.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98432 (GCVE-0-2026-98432)
Vulnerability from cvelistv5
Published
2026-10-15 12:08
Modified
2026-10-24 14:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: free inet_opt and ireq_opt after an RCU grace period
tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the
child socket (newinet->inet_opt) without copying it.
Another cpu can concurrently process a retransmitted SYN for the same
request socket, and send a SYNACK from tcp_check_req().
tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt
under rcu_read_lock() only, and ip_build_and_send_pkt() and
ip_options_build() then read opt->optlen twice.
Note that the SYNACK timer itself is not an issue: it holds a
reference on its request socket, and inet_csk_reqsk_queue_drop()
calls timer_delete_sync() before the child can be freed.
Since commit 079096f103fa ("tcp/dccp: install syn_recv requests
into ehash table"), request sockets are processed without holding
the listener lock, so nothing prevents the child socket from being
freed while the SYNACK is still being built. TCP child sockets do
not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt
with a plain kfree(), leading to a use-after-free in
ip_options_build().
A similar issue exists with request socket migration
(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
program). reqsk_timer_handler() clones the request socket with
inet_reqsk_clone(), so that the old request socket and its clone
share the same ireq_opt, then reqsk_migrate_reset() clears the
pointer in the old one. Another cpu holding a reference on the old
request socket can still be using these options (sending a SYNACK,
or creating a child in tcp_v4_syn_recv_sock()) when the clone is
freed, and tcp_v4_reqsk_destructor() also uses a plain kfree().
Readers already use RCU, and other paths replacing inet_opt
(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use
kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and
tcp_v4_reqsk_destructor() as well.
IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()
duplicates the options. tcp_v6_reqsk_destructor() has the same
migration issue with ipv6_opt, which is only set by CALIPSO. This
will be addressed in a separate patch.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 Version: 079096f103faca2dd87342cca6f23d4b34da8871 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/af_inet.c",
"net/ipv4/tcp_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b3b027ef0cd322bfa839b9aaf5b27551eea54cf6",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "95a8c8fa9f27dce64c40c41c062de7728bf34ab5",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "89b5b1eb7d633c33832b7ff2c02e19a144705036",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "742f73df544e03744f2981c467d6542fe8172a2a",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "11a03ce3c4a62d84c10ccdfe47f8075006498568",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "a47406c769f72c070386985488f1c4d057df86b2",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "26d4c36d318cffbbd160884a0e4cec0da4da4936",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
},
{
"lessThan": "e3f33b0a1d89d738e2b913dab519226eaf76e15b",
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/af_inet.c",
"net/ipv4/tcp_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.272",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.223",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.190",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.159",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.272",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.223",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.190",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.159",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.56",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq-\u003eireq_opt to the\nchild socket (newinet-\u003einet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq-\u003eireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt-\u003eoptlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An unauthenticated peer supplies IPv4 Record Route or Timestamp bytes in a TCP SYN; ip_rcv_options() and tcp_v4_save_options() store them in ireq_opt. Its retransmitted SYN follows tcp_v4_rcv()-\u003etcp_check_req()-\u003etcp_rtx_synack()-\u003etcp_v4_send_synack(), racing frees in patched inet_sock_destruct() or tcp_v4_reqsk_destructor().\nAC:L - On an accepting server, the peer can repeatedly create an option-bearing request and race a retransmitted SYN against completing and tearing down that same TCP connection. Both racing sides are attacker-induced; multicore scheduling and heap grooming do not constitute conditions outside the attacker\u0027s influence.\nPR:N - tcp_v4_rcv() reaches tcp_check_req() and tcp_v4_send_synack() during the TCP handshake, before application authentication. The target performs no capability or credential check on the peer\u0027s valid IPv4 Record Route or Timestamp option.\nUI:N - The peer sends the option-bearing SYN, retransmitted SYN, and handshake or teardown packets to an already listening service; no victim user must mount, open, or approve anything.\nS:U - The stale ip_options_rcu object is consumed and corrupts memory within the same host kernel in ip_build_and_send_pkt() and ip_options_build(); no separate security authority is crossed.\nC:H - After inet_sock_destruct() frees inet_opt, ip_options_build() copies opt-\u003e__data for the stale opt-\u003eoptlen into the network-bound SYNACK. Reclaiming the object can therefore disclose adjacent kernel heap contents directly to the peer.\nI:H - Reclaiming the freed ip_options_rcu lets stale optlen and srr, rr, or ts offsets steer ip_options_build() memcpy and address or timestamp writes, permitting out-of-bounds kernel writes and potential control-flow corruption.\nA:H - A reclaimed optlen can make ip_build_and_send_pkt() call skb_push() beyond the SYNACK headroom, invoking skb_under_panic(); the stale-offset writes in ip_options_build() can also oops the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:08:46.326Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6"
},
{
"url": "https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5"
},
{
"url": "https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036"
},
{
"url": "https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a"
},
{
"url": "https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568"
},
{
"url": "https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2"
},
{
"url": "https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936"
},
{
"url": "https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b"
}
],
"title": "ipv4: free inet_opt and ireq_opt after an RCU grace period",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98432",
"datePublished": "2026-10-15T12:08:22.205Z",
"dateReserved": "2026-09-25T10:25:14.348Z",
"dateUpdated": "2026-10-24T14:08:46.326Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89838 (GCVE-0-2026-89838)
Vulnerability from cvelistv5
Published
2026-09-16 10:31
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: limit recovery filename logging to stored length
F2FS stores recovery filenames as a length plus a fixed-size i_name
buffer. The buffer is not NUL-terminated, but recover_inode() and
recover_dentry() print it with %s.
For a 255-byte filename, recovery logging can read past i_name into the
following raw inode fields.
Print the name with a precision bounded by i_namelen and F2FS_NAME_LEN.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/recovery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e754120f8ede55cc773ade108cf7e5b17c859c46",
"status": "affected",
"version": "f356fe0cba0e3523e538987916bd2acedd4e6f41",
"versionType": "git"
},
{
"lessThan": "7ab1780074943508534343e1e5e5ab0c9ef9dd7b",
"status": "affected",
"version": "f356fe0cba0e3523e538987916bd2acedd4e6f41",
"versionType": "git"
},
{
"lessThan": "35c5abccd0924b02ad34126f562d93c8d75b0831",
"status": "affected",
"version": "f356fe0cba0e3523e538987916bd2acedd4e6f41",
"versionType": "git"
},
{
"lessThan": "317d32e1a8deaf1c01c388badc667334c39e62ca",
"status": "affected",
"version": "f356fe0cba0e3523e538987916bd2acedd4e6f41",
"versionType": "git"
},
{
"lessThan": "01027b2fcb74dade59fb833b51023f6593b6a9a2",
"status": "affected",
"version": "f356fe0cba0e3523e538987916bd2acedd4e6f41",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/recovery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.11"
},
{
"lessThan": "3.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: limit recovery filename logging to stored length\n\nF2FS stores recovery filenames as a length plus a fixed-size i_name\nbuffer. The buffer is not NUL-terminated, but recover_inode() and\nrecover_dentry() print it with %s.\n\nFor a 255-byte filename, recovery logging can read past i_name into the\nfollowing raw inode fields.\n\nPrint the name with a precision bounded by i_namelen and F2FS_NAME_LEN."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - recover_inode() and recover_dentry() run only during local f2fs roll-forward in f2fs_fill_super() -\u003e f2fs_recover_fsync_data(). This is a local block filesystem (Android userdata/portable storage), not a network protocol path such as ksmbd or nfsd.\nAC:L - A crafted f2fs image with a 255-byte non-NUL i_name and a pending fsync node makes printk %s over-read deterministically on mount. Roll-forward is default-enabled; no race or attacker-uncontrollable layout is required.\nPR:L - f2fs lacks FS_USERNS_MOUNT, but Android vold auto-mounts f2fs portable/adoptable storage and desktop/kiosk udisks2/polkit mounts removable media for an ordinary console user, so init-namespace root is not required.\nUI:N - The attacker supplies the crafted image; vold/udisks auto-mount runs roll-forward recovery without a separate deliberate victim mount or open. Recovery also fires automatically on the next mount after an unclean shutdown.\nS:U - The over-read and any resulting oops stay in the host kernel address space and security authority. This is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - recover_inode()/recover_dentry() pass the 255-byte, non-NUL-terminated i_name to printk %s with no precision, so vsprintf scans past the field and the rest of the 4KB node folio into adjacent kernel memory and copies it into dmesg, an unbounded OOB read.\nI:N - The defect is a read-only printk over-read of i_name; it does not write kernel memory, corrupt adjacent objects, or provide a control-flow hijack primitive.\nA:H - Unbounded %s scanning off the node folio can walk into unmapped pages or trip KASAN/page-poisoning and oops/panic the kernel during mount recovery, fully denying availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:01.146Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e754120f8ede55cc773ade108cf7e5b17c859c46"
},
{
"url": "https://git.kernel.org/stable/c/7ab1780074943508534343e1e5e5ab0c9ef9dd7b"
},
{
"url": "https://git.kernel.org/stable/c/35c5abccd0924b02ad34126f562d93c8d75b0831"
},
{
"url": "https://git.kernel.org/stable/c/317d32e1a8deaf1c01c388badc667334c39e62ca"
},
{
"url": "https://git.kernel.org/stable/c/01027b2fcb74dade59fb833b51023f6593b6a9a2"
}
],
"title": "f2fs: limit recovery filename logging to stored length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89838",
"datePublished": "2026-09-16T10:31:12.746Z",
"dateReserved": "2026-09-11T19:38:34.769Z",
"dateUpdated": "2026-10-21T12:49:01.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98276 (GCVE-0-2026-98276)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: lock the socket in sock_gettstamp()
sk->sk_flags must only be changed while holding the socket lock,
because sock_set_flag() and sock_reset_flag() use non atomic
operations (__set_bit() and __clear_bit()).
sock_gettstamp() is one of the last places where a bit of sk->sk_flags
is changed from a syscall without owning the socket lock, through
sock_enable_timestamp(sk, SOCK_TIMESTAMP).
sk_set_memalloc() and sk_clear_memalloc() also change sk->sk_flags
without the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp,
sunrpc, wireguard) need a careful audit, this will be addressed in a
separate patch.
Jungwoo Lee and Wongi Lee reported an UDP socket use-after-free
caused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind()
can cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set,
because both threads perform a read-modify-write on the same word.
CPU 0 (bind) CPU 1 (SIOCGSTAMPNS_NEW)
-------------------------------- ----------------------------
read sk_flags = F read sk_flags = F
compute F | BIT(SOCK_RCU_FREE) compute F | BIT(SOCK_TIMESTAMP)
store F | BIT(SOCK_RCU_FREE)
sk_add_node_rcu(sk, ...)
store F | BIT(SOCK_TIMESTAMP)
After the lost update, SOCK_RCU_FREE is clear while the socket is
visible to lockless UDP receive lookups. sk_destruct() then frees
the socket immediately instead of waiting for a RCU grace period,
while the receive path still holds a reference-less pointer to it:
BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410
Read of size 8 at addr ffff888008806610 by task exploit/207
CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1
ipv4_pktinfo_prepare+0x30/0x410
udp_queue_rcv_one_skb+0x51c/0x1180
udp_unicast_rcv_skb+0x109/0x350
ip_protocol_deliver_rcu+0x14b/0x310
ip_local_deliver_finish+0x29d/0x390
ip_local_deliver+0x24d/0x2a0
Only grab the socket lock when SOCK_TIMESTAMP has to be set,
to keep the common case lockless.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18899e2e4023369a8f7739c2255a59a9748d8d17",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "88c804847dd87dc613b771b392ccecdb94725032",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3b12d3967e96f1b7b977d9fc352ae29a1b299a82",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1f73253add8365d0dad0a4f421acaa8c21d20cef",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d9f96bc2d822501f84d1caa6275a2c6b316ca2c4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "899650bbf985b7bfd2a7b808357df9b16e6d6959",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9ed55f3dbef4f4adfe65eb03b0c35c53229a8490",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lock the socket in sock_gettstamp()\n\nsk-\u003esk_flags must only be changed while holding the socket lock,\nbecause sock_set_flag() and sock_reset_flag() use non atomic\noperations (__set_bit() and __clear_bit()).\n\nsock_gettstamp() is one of the last places where a bit of sk-\u003esk_flags\nis changed from a syscall without owning the socket lock, through\nsock_enable_timestamp(sk, SOCK_TIMESTAMP).\n\nsk_set_memalloc() and sk_clear_memalloc() also change sk-\u003esk_flags\nwithout the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp,\nsunrpc, wireguard) need a careful audit, this will be addressed in a\nseparate patch.\n\nJungwoo Lee and Wongi Lee reported an UDP socket use-after-free\ncaused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind()\ncan cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set,\nbecause both threads perform a read-modify-write on the same word.\n\n CPU 0 (bind) CPU 1 (SIOCGSTAMPNS_NEW)\n -------------------------------- ----------------------------\n read sk_flags = F read sk_flags = F\n compute F | BIT(SOCK_RCU_FREE) compute F | BIT(SOCK_TIMESTAMP)\n store F | BIT(SOCK_RCU_FREE)\n sk_add_node_rcu(sk, ...)\n store F | BIT(SOCK_TIMESTAMP)\n\nAfter the lost update, SOCK_RCU_FREE is clear while the socket is\nvisible to lockless UDP receive lookups. sk_destruct() then frees\nthe socket immediately instead of waiting for a RCU grace period,\nwhile the receive path still holds a reference-less pointer to it:\n\n BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410\n Read of size 8 at addr ffff888008806610 by task exploit/207\n CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1\n ipv4_pktinfo_prepare+0x30/0x410\n udp_queue_rcv_one_skb+0x51c/0x1180\n udp_unicast_rcv_skb+0x109/0x350\n ip_protocol_deliver_rcu+0x14b/0x310\n ip_local_deliver_finish+0x29d/0x390\n ip_local_deliver+0x24d/0x2a0\n\nOnly grab the socket lock when SOCK_TIMESTAMP has to be set,\nto keep the common case lockless."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The lost update is caused by a local process racing the SIOCGSTAMP*/SIOCGSTAMPNS* ioctl (sock_ioctl -\u003e sock_gettstamp -\u003e sock_enable_timestamp) against bind() -\u003e udp_lib_get_port() setting SOCK_RCU_FREE on its own UDP socket. No network message supplies the triggering state; remote packets only deliver into the already-corrupted socket.\nAC:L - The attacker owns both sides of the race: one thread calls bind(), another calls the timestamp ioctl on the same fd. It can create, bind and close sockets in a loop until the __set_bit read-modify-write on sk_flags loses SOCK_RCU_FREE, then send loopback UDP to hit the freed sock.\nPR:L - It only needs an ordinary AF_INET/AF_INET6 UDP socket. sock_ioctl\u0027s SIOCGSTAMP case and inet bind to an ephemeral or unprivileged port have no capability check, and the reporters reproduced it as UID 1000.\nUI:N - The attacker drives every step (socket creation, concurrent bind/ioctl, close, sending packets to its own port) with no action from any other user.\nS:U - The freed struct sock and the code that reads it are both in the same kernel; this is local kernel memory corruption that leads to privilege escalation inside one authority, with no VM or sandbox boundary crossed.\nC:H - With SOCK_RCU_FREE lost, sk_destruct frees the UDP struct sock immediately while lockless RCU lookups in udp_unicast_rcv_skb/udp_queue_rcv_one_skb still hold a pointer to it. A slab UAF of a struct sock can be reclaimed with sprayed data to leak kernel memory.\nI:H - The receive path operates on the freed sock: it queues skbs, updates counters and reads sk_prot/sk_filter-related fields. If the attacker reclaims the slab, these become writes into, and function-pointer use from, attacker-controlled memory, which is a path to control-flow hijack.\nA:H - Even when not exploited, the use-after-free in ipv4_pktinfo_prepare/udp_queue_rcv_one_skb (shown by KASAN) corrupts slab memory and can oops or panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:47.879Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18899e2e4023369a8f7739c2255a59a9748d8d17"
},
{
"url": "https://git.kernel.org/stable/c/88c804847dd87dc613b771b392ccecdb94725032"
},
{
"url": "https://git.kernel.org/stable/c/3b12d3967e96f1b7b977d9fc352ae29a1b299a82"
},
{
"url": "https://git.kernel.org/stable/c/17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f"
},
{
"url": "https://git.kernel.org/stable/c/1f73253add8365d0dad0a4f421acaa8c21d20cef"
},
{
"url": "https://git.kernel.org/stable/c/d9f96bc2d822501f84d1caa6275a2c6b316ca2c4"
},
{
"url": "https://git.kernel.org/stable/c/899650bbf985b7bfd2a7b808357df9b16e6d6959"
},
{
"url": "https://git.kernel.org/stable/c/9ed55f3dbef4f4adfe65eb03b0c35c53229a8490"
}
],
"title": "net: lock the socket in sock_gettstamp()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98276",
"datePublished": "2026-10-06T08:45:36.837Z",
"dateReserved": "2026-09-25T10:25:14.334Z",
"dateUpdated": "2026-10-19T09:16:47.879Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98213 (GCVE-0-2026-98213)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mmc: core: Cancel SDIO IRQ work before freeing host
A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work
from its interrupt handler. That work is only cancelled on the suspend
path (mmc_sdio_suspend()), not on the remove/free path, so a worker armed
just before the controller freed its IRQ can run after
mmc_host_classdev_release() has freed the host and dereference it through
container_of().
Cancel host->sdio_irq_work in mmc_free_host(), like the existing
host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel
delayed work before releasing host").
This issue was found by an in-house static analysis tool.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 682696605c7093d2800c498c04166831e5aedf87 Version: 682696605c7093d2800c498c04166831e5aedf87 Version: 682696605c7093d2800c498c04166831e5aedf87 Version: 682696605c7093d2800c498c04166831e5aedf87 Version: 682696605c7093d2800c498c04166831e5aedf87 Version: 682696605c7093d2800c498c04166831e5aedf87 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mmc/core/host.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bae1cf4f9902b2065bd78b759c7fe6312855f05e",
"status": "affected",
"version": "682696605c7093d2800c498c04166831e5aedf87",
"versionType": "git"
},
{
"lessThan": "0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589",
"status": "affected",
"version": "682696605c7093d2800c498c04166831e5aedf87",
"versionType": "git"
},
{
"lessThan": "1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0",
"status": "affected",
"version": "682696605c7093d2800c498c04166831e5aedf87",
"versionType": "git"
},
{
"lessThan": "4553b5004eca9c9eae29a421f1a9c4d5db2c9114",
"status": "affected",
"version": "682696605c7093d2800c498c04166831e5aedf87",
"versionType": "git"
},
{
"lessThan": "2a863458828ade0671c2bc2e469bbd7f2340eb03",
"status": "affected",
"version": "682696605c7093d2800c498c04166831e5aedf87",
"versionType": "git"
},
{
"lessThan": "6feadbecdae60a6324c967f3b1493741083793a3",
"status": "affected",
"version": "682696605c7093d2800c498c04166831e5aedf87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mmc/core/host.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: core: Cancel SDIO IRQ work before freeing host\n\nA host controller that uses sdio_signal_irq() schedules host-\u003esdio_irq_work\nfrom its interrupt handler. That work is only cancelled on the suspend\npath (mmc_sdio_suspend()), not on the remove/free path, so a worker armed\njust before the controller freed its IRQ can run after\nmmc_host_classdev_release() has freed the host and dereference it through\ncontainer_of().\n\nCancel host-\u003esdio_irq_work in mmc_free_host(), like the existing\nhost-\u003edetect drain added by commit 1036f69e2513 (\"mmc: core: Cancel\ndelayed work before releasing host\").\n\nThis issue was found by an in-house static analysis tool."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:44.065Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bae1cf4f9902b2065bd78b759c7fe6312855f05e"
},
{
"url": "https://git.kernel.org/stable/c/0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589"
},
{
"url": "https://git.kernel.org/stable/c/1d6e7315ee1c992b4ca42c9b11c5ed0e925a00e0"
},
{
"url": "https://git.kernel.org/stable/c/4553b5004eca9c9eae29a421f1a9c4d5db2c9114"
},
{
"url": "https://git.kernel.org/stable/c/2a863458828ade0671c2bc2e469bbd7f2340eb03"
},
{
"url": "https://git.kernel.org/stable/c/6feadbecdae60a6324c967f3b1493741083793a3"
}
],
"title": "mmc: core: Cancel SDIO IRQ work before freeing host",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98213",
"datePublished": "2026-10-06T08:44:49.352Z",
"dateReserved": "2026-09-25T10:25:14.325Z",
"dateUpdated": "2026-10-19T09:15:44.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98327 (GCVE-0-2026-98327)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: mesh: reset the CSA state when leaving
ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() and only freed
in ieee80211_mesh_finish_csa(), i.e. when the channel switch completes.
Leaving the mesh while a switch is still pending therefore leaks it.
Additionally, ifmsh->csa_role and ifmsh->chsw_ttl have their state leak
in this case, so things can get mixed up in addition to the memory
leak.
Refactor the reset and call it in ieee80211_stop_mesh() to fix it all.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/mesh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aba8dfb45864441199748c33ce3c1c8ca121c8bd",
"status": "affected",
"version": "b8456a14e9d2770846fcf74de18ff95b676149a3",
"versionType": "git"
},
{
"lessThan": "bd3b21145ae2e781daac1bbd19216a63ab4e0cbd",
"status": "affected",
"version": "b8456a14e9d2770846fcf74de18ff95b676149a3",
"versionType": "git"
},
{
"lessThan": "ba5bf83a81e8832cb84bb3a2da67512f81f57a02",
"status": "affected",
"version": "b8456a14e9d2770846fcf74de18ff95b676149a3",
"versionType": "git"
},
{
"lessThan": "860134b3af77970e006feab7e5decb8c84771c7f",
"status": "affected",
"version": "b8456a14e9d2770846fcf74de18ff95b676149a3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/mesh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: mesh: reset the CSA state when leaving\n\nifmsh-\u003ecsa is allocated in ieee80211_mesh_csa_beacon() and only freed\nin ieee80211_mesh_finish_csa(), i.e. when the channel switch completes.\nLeaving the mesh while a switch is still pending therefore leaks it.\n\nAdditionally, ifmsh-\u003ecsa_role and ifmsh-\u003echsw_ttl have their state leak\nin this case, so things can get mixed up in addition to the memory\nleak.\n\nRefactor the reset and call it in ieee80211_stop_mesh() to fix it all."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:37.676Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aba8dfb45864441199748c33ce3c1c8ca121c8bd"
},
{
"url": "https://git.kernel.org/stable/c/bd3b21145ae2e781daac1bbd19216a63ab4e0cbd"
},
{
"url": "https://git.kernel.org/stable/c/ba5bf83a81e8832cb84bb3a2da67512f81f57a02"
},
{
"url": "https://git.kernel.org/stable/c/860134b3af77970e006feab7e5decb8c84771c7f"
}
],
"title": "wifi: mac80211: mesh: reset the CSA state when leaving",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98327",
"datePublished": "2026-10-06T08:46:20.317Z",
"dateReserved": "2026-09-25T10:25:14.341Z",
"dateUpdated": "2026-10-19T09:17:37.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98381 (GCVE-0-2026-98381)
Vulnerability from cvelistv5
Published
2026-10-09 07:34
Modified
2026-10-24 14:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
veth: manage XDP program pointers during channel resize
veth_set_channels() tears down XDP resources for removed RX queues
without clearing rq->xdp_prog. If the program is then detached or
replaced, those queues keep the old pointer after bpf_prog_put().
A later channel increase can re-enable NAPI and run the freed program.
BUG: unable to handle page fault for address: ffffc90000256048
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: veth_xdp_rcv_skb (include/linux/filter.h:779
include/net/xdp.h:696 drivers/net/veth.c:820)
Call Trace:
veth_xdp_rcv (drivers/net/veth.c:941)
veth_poll (drivers/net/veth.c:986)
__napi_poll (net/core/dev.c:7787)
net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)
handle_softirqs (kernel/softirq.c:645)
Kernel panic - not syncing: Fatal exception in interrupt
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 Version: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 Version: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 Version: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 Version: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 Version: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 Version: 4752eeb3d891c27905a8fdf4d80e899c0efd4ec7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a8e143109ff2736dc79e41dcd55af7ceab7520a",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "1a5c5b9c64ba5f39dba55da6e12561ca56eeb758",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "25bb7c36225220d30f404d7e29d2e052bc5f4b99",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "43f6b647f209591b1e3f726bb16b8dcba6b95908",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
},
{
"lessThan": "7104a370714346b667712913dc16abf14bbc97ed",
"status": "affected",
"version": "4752eeb3d891c27905a8fdf4d80e899c0efd4ec7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/veth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nveth: manage XDP program pointers during channel resize\n\nveth_set_channels() tears down XDP resources for removed RX queues\nwithout clearing rq-\u003exdp_prog. If the program is then detached or\nreplaced, those queues keep the old pointer after bpf_prog_put().\nA later channel increase can re-enable NAPI and run the freed program.\n\n BUG: unable to handle page fault for address: ffffc90000256048\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n RIP: veth_xdp_rcv_skb (include/linux/filter.h:779\n include/net/xdp.h:696 drivers/net/veth.c:820)\n Call Trace:\n veth_xdp_rcv (drivers/net/veth.c:941)\n veth_poll (drivers/net/veth.c:986)\n __napi_poll (net/core/dev.c:7787)\n net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)\n handle_softirqs (kernel/softirq.c:645)\n Kernel panic - not syncing: Fatal exception in interrupt"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - ETHTOOL_MSG_CHANNELS_SET enters ethnl_set_channels() -\u003e veth_set_channels() -\u003e veth_disable_range_safe()/veth_enable_range_safe() -\u003e the patched veth_napi_del_range()/__veth_napi_enable_range(); this is local netlink configuration, and final traffic comes from the veth peer, not a remote protocol message.\nAC:L - The same attacker can resize down, replace XDP so veth_xdp_set() calls bpf_prog_put(), resize up, and transmit on the restored queue. RTNL serialization makes this a deterministic sequence rather than a race or victim-dependent condition.\nPR:L - ETHTOOL_MSG_CHANNELS_SET is GENL_UNS_ADMIN_PERM and RTM_SETLINK checks CAP_NET_ADMIN in the target network namespace; BPF_PROG_LOAD uses bpf_token_capable() to accept CAP_BPF/CAP_NET_ADMIN in a delegated token\u0027s user namespace, so init-namespace root is not required.\nUI:N - The attacker performs the XDP replacement, both channel resizes, and the peer transmission; no victim must mount, open, or otherwise act on attacker-supplied data.\nS:U - The stale rq-\u003exdp_prog is consumed by veth_xdp_rcv_skb() inside the same host kernel that owns the veth device; it does not cross a VM, IOMMU, or separate security authority.\nC:H - The removed rq retains a freed vmalloc-backed struct bpf_prog; reclaiming it controls fields read by __bpf_prog_run(), including insnsi and bpf_func, enabling kernel code execution and arbitrary kernel reads.\nI:H - veth_xdp_rcv_skb() passes the stale program to bpf_prog_run_xdp(), and __bpf_prog_run() performs an indirect call through freed prog-\u003ebpf_func; controlled reuse can redirect kernel control flow.\nA:H - The reported restored-queue packet reaches veth_xdp_rcv_skb() through veth_poll() and faults on the freed program, producing an oops and fatal kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:08:38.193Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a8e143109ff2736dc79e41dcd55af7ceab7520a"
},
{
"url": "https://git.kernel.org/stable/c/1a5c5b9c64ba5f39dba55da6e12561ca56eeb758"
},
{
"url": "https://git.kernel.org/stable/c/f0e8dba8c224981e53c792c6b3dbb7604fb2c2c6"
},
{
"url": "https://git.kernel.org/stable/c/3c10a5dd0d38f506f671dbb59e9d0ee4c72076f9"
},
{
"url": "https://git.kernel.org/stable/c/25bb7c36225220d30f404d7e29d2e052bc5f4b99"
},
{
"url": "https://git.kernel.org/stable/c/43f6b647f209591b1e3f726bb16b8dcba6b95908"
},
{
"url": "https://git.kernel.org/stable/c/7104a370714346b667712913dc16abf14bbc97ed"
}
],
"title": "veth: manage XDP program pointers during channel resize",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98381",
"datePublished": "2026-10-09T07:34:21.029Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-24T14:08:38.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98323 (GCVE-0-2026-98323)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Bound fragmented header copies by the remaining length
siw_get_hdr() can receive an extended DDP/RDMAP header across more than
one TCP callback. The first callback may receive most of the header,
while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead
of the number of missing bytes. This makes the destination move past the
end of the header and overwrite the receive state, including
fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd
value as a copy offset, which creates an OOB write.
Use the number of header bytes already received when calculating the
next copy length.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e3917c85f41ef1df64e27dc0e46ab0d803c5e73e Version: 308cd50f174c95a507527037f4de1a0396aa4325 Version: 754209850df8367c954ac1de7671c7430b1f342c Version: 754209850df8367c954ac1de7671c7430b1f342c Version: 754209850df8367c954ac1de7671c7430b1f342c Version: 754209850df8367c954ac1de7671c7430b1f342c Version: 754209850df8367c954ac1de7671c7430b1f342c Version: 754209850df8367c954ac1de7671c7430b1f342c Version: e09caa38e10bcf027100cc22b0e3cc745a39ef0a Version: 0c14f795a9eab9344230f9933798b8ee496f497d Version: 7fada7c6962219b6fc4ff4e62e46a936af110dd9 Version: 5.10.150 ≤ Version: 5.15.75 ≤ Version: 5.4.220 ≤ Version: 5.19.17 ≤ Version: 6.0.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_qp_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7",
"status": "affected",
"version": "e3917c85f41ef1df64e27dc0e46ab0d803c5e73e",
"versionType": "git"
},
{
"lessThan": "af9f5b474a260ad23ffb9793d716a5e3bbce3b48",
"status": "affected",
"version": "308cd50f174c95a507527037f4de1a0396aa4325",
"versionType": "git"
},
{
"lessThan": "262dcd809723723ed8a4e05437ec7e9c21a8f17e",
"status": "affected",
"version": "754209850df8367c954ac1de7671c7430b1f342c",
"versionType": "git"
},
{
"lessThan": "eb4d7a946970469b3ab0c762432bf161d5b0836c",
"status": "affected",
"version": "754209850df8367c954ac1de7671c7430b1f342c",
"versionType": "git"
},
{
"lessThan": "8628f8ebf41669302513fb3f0bf0eba38b226742",
"status": "affected",
"version": "754209850df8367c954ac1de7671c7430b1f342c",
"versionType": "git"
},
{
"lessThan": "b72dcfb9bf1f0f0147cda03dc59e4002a315067f",
"status": "affected",
"version": "754209850df8367c954ac1de7671c7430b1f342c",
"versionType": "git"
},
{
"lessThan": "e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d",
"status": "affected",
"version": "754209850df8367c954ac1de7671c7430b1f342c",
"versionType": "git"
},
{
"lessThan": "9ff797e516dbc1ecb73701ec4c24055712d44411",
"status": "affected",
"version": "754209850df8367c954ac1de7671c7430b1f342c",
"versionType": "git"
},
{
"status": "affected",
"version": "e09caa38e10bcf027100cc22b0e3cc745a39ef0a",
"versionType": "git"
},
{
"status": "affected",
"version": "0c14f795a9eab9344230f9933798b8ee496f497d",
"versionType": "git"
},
{
"status": "affected",
"version": "7fada7c6962219b6fc4ff4e62e46a936af110dd9",
"versionType": "git"
},
{
"lessThan": "5.10.271",
"status": "affected",
"version": "5.10.150",
"versionType": "semver"
},
{
"lessThan": "5.15.222",
"status": "affected",
"version": "5.15.75",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.220",
"versionType": "semver"
},
{
"lessThan": "5.20",
"status": "affected",
"version": "5.19.17",
"versionType": "semver"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_qp_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.10.150",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.15.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.220",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Bound fragmented header copies by the remaining length\n\nsiw_get_hdr() can receive an extended DDP/RDMAP header across more than\none TCP callback. The first callback may receive most of the header,\nwhile the next one still limits the copy to hdrlen - MIN_DDP_HDR instead\nof the number of missing bytes. This makes the destination move past the\nend of the header and overwrite the receive state, including\nfpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd\nvalue as a copy offset, which creates an OOB write.\n\nUse the number of header bytes already received when calculating the\nnext copy length."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The malformed input is the remote iWARP peer\u0027s own MPA/DDP/RDMAP header bytes on the siw TCP connection. The peer splits an extended header (e.g. RDMA Read Request, 44 bytes) across TCP segments, and siw_qp_llp_data_ready() -\u003e tcp_read_sock() -\u003e siw_tcp_rx_data() -\u003e siw_get_hdr() parses them. The transport is routable TCP.\nAC:L - The peer fully controls TCP segmentation, so it can deterministically end a segment with fpdu_part_rcvd between 16 and hdrlen. The next segment then copies hdrlen-16 bytes at that offset. No race or state outside the attacker\u0027s control is involved beyond siw serving an iWARP listener.\nPR:N - Once the MPA exchange puts the QP in RTS, siw_get_hdr() parses every incoming FPDU header, and neither MPA nor DDP authenticates the peer. ULP authorisation (such as an nvmet-rdma host NQN check) only arrives in messages parsed by this same path, so the overflow fires before any credential check.\nUI:N - No victim action is needed. The attacker connects to the iWARP service and sends crafted fragmented FPDUs, and siw processes them in its sk_data_ready callback.\nS:U - The corruption is confined to kernel memory of the host running siw (struct siw_qp and its neighbours). That is the same security authority as the vulnerable component, with no VM or IOMMU boundary crossed.\nC:H - The overflow writes peer bytes over siw_rx_stream fields after hdr, including fpdu_part_rcvd. A negative fpdu_part_rcvd then makes skb_copy_bits() write to c_hdr plus an attacker-chosen offset. A controlled kernel write like this can be turned into arbitrary kernel memory disclosure.\nI:H - siw_get_hdr() copies up to hdrlen-17 attacker bytes past srx-\u003ehdr (27 for rreq), overwriting the receive state. The next callback uses the corrupted negative fpdu_part_rcvd as the destination offset of skb_copy_bits(), giving an out-of-bounds kernel write whose offset and data are attacker-controlled.\nA:H - Corrupting fpdu_part_rcvd/fpdu_part_rem and writing out of bounds from siw_qp crashes or panics the kernel. A remote peer can repeat this on every connection."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:33.779Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7"
},
{
"url": "https://git.kernel.org/stable/c/af9f5b474a260ad23ffb9793d716a5e3bbce3b48"
},
{
"url": "https://git.kernel.org/stable/c/262dcd809723723ed8a4e05437ec7e9c21a8f17e"
},
{
"url": "https://git.kernel.org/stable/c/eb4d7a946970469b3ab0c762432bf161d5b0836c"
},
{
"url": "https://git.kernel.org/stable/c/8628f8ebf41669302513fb3f0bf0eba38b226742"
},
{
"url": "https://git.kernel.org/stable/c/b72dcfb9bf1f0f0147cda03dc59e4002a315067f"
},
{
"url": "https://git.kernel.org/stable/c/e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d"
},
{
"url": "https://git.kernel.org/stable/c/9ff797e516dbc1ecb73701ec4c24055712d44411"
}
],
"title": "RDMA/siw: Bound fragmented header copies by the remaining length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98323",
"datePublished": "2026-10-06T08:46:17.150Z",
"dateReserved": "2026-09-25T10:25:14.340Z",
"dateUpdated": "2026-10-19T09:17:33.779Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98161 (GCVE-0-2026-98161)
Vulnerability from cvelistv5
Published
2026-09-25 13:06
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvdimm: pmem: keep PREFLUSH before data writes
pmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the
bio data and can later overwrite the error with a successful REQ_FUA flush.
That lets data writes run after a failed preflush and can complete the bio
successfully despite the failed ordering barrier.
Run the REQ_PREFLUSH flush synchronously before touching the bio data and
complete the bio with the flush error if it fails. Keep asynchronous flush
chaining for REQ_FUA. At that point, data copy has completed and the parent
bio can wait for the chained flush bio.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "22d1f4dcdc9c6d0295c6db0c8933126098b14e05",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "d34c30bc994328d9cf6749b2e9a32aabd08fd076",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "770a90c2127220f0fc194ce909ad4f0842e141cb",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "72561ca1ab96f0f0f32737a6171641e05a318538",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
},
{
"lessThan": "c644a2f8fef5618fcf453c591177700fd07dd024",
"status": "affected",
"version": "c5d4355d10d414a96ca870b731756b89d068d57a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvdimm/pmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvdimm: pmem: keep PREFLUSH before data writes\n\npmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the\nbio data and can later overwrite the error with a successful REQ_FUA flush.\nThat lets data writes run after a failed preflush and can complete the bio\nsuccessfully despite the failed ordering barrier.\n\nRun the REQ_PREFLUSH flush synchronously before touching the bio data and\ncomplete the bio with the flush error if it fails. Keep asynchronous flush\nchaining for REQ_FUA. At that point, data copy has completed and the parent\nbio can wait for the chained flush bio."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:44.996Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/22d1f4dcdc9c6d0295c6db0c8933126098b14e05"
},
{
"url": "https://git.kernel.org/stable/c/d34c30bc994328d9cf6749b2e9a32aabd08fd076"
},
{
"url": "https://git.kernel.org/stable/c/770a90c2127220f0fc194ce909ad4f0842e141cb"
},
{
"url": "https://git.kernel.org/stable/c/72561ca1ab96f0f0f32737a6171641e05a318538"
},
{
"url": "https://git.kernel.org/stable/c/c644a2f8fef5618fcf453c591177700fd07dd024"
}
],
"title": "nvdimm: pmem: keep PREFLUSH before data writes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98161",
"datePublished": "2026-09-25T13:06:51.138Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-10-21T12:54:44.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98214 (GCVE-0-2026-98214)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
selinux: recheck intermediate backing files on mprotect()
mprotect() can be used to bypass the SELinux checks that mmap() performs
against the intermediate layers of a stacked filesystem.
mmap() checks every backing layer as the request descends through the
stack. mprotect() only has the lowest backing file in vma->vm_file, so it
rechecks the top-level user and the lowest mounter, but skips the mounters
of every layer in between. With two nested overlayfs mounts and a policy
denying mounter_t -> middle_file_t:file { execute }, a direct
mmap(PROT_EXEC) is denied:
avc: denied { execute } for pid=71 comm="nested_exec"
path="/payload" dev="overlay" ino=9
scontext=user_u:base_r:mounter_t
tcontext=user_u:object_r:middle_file_t tclass=file permissive=0
while mmap(PROT_NONE) followed by mprotect(PROT_EXEC) succeeds.
Preserve each intermediate path, mounter SID and file-description SID in
the backing-file security blob, copying the saved entries when another
backing layer is opened. Allocate the array only for nested backing files,
and release it and the path references in the backing_file_free hook.
During mprotect(), recheck fd { use } and the requested inode permissions
for every saved mounter, and include the intermediate layers in the execmod
checks. Policy for nested stacking may then need to grant intermediate
mounters what a direct mmap() already requires, and execmod on intermediate
labels for binaries using text relocations.
Tested on arm64 QEMU with a small BusyBox initramfs and a purpose-built
SELinux policy, on a mainline tree containing
commit f2381b546e7e ("fs: fix user path of nested backing files").
[PM: subject tweak]
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bc6c380c1159de52a252ed11f19a42c47f60a735 Version: 8bacd09f12c27710228562e4d13163e58c5f4a45 Version: d844702198395d3f80222777030f69db6be6b709 Version: 82544d36b1729153c8aeb179e84750f0c085d3b1 Version: 82544d36b1729153c8aeb179e84750f0c085d3b1 Version: cd0e707a927a70cdfd8bc5a512a9719a87f5ed51 Version: 6.6.144 ≤ Version: 6.12.95 ≤ Version: 6.18.38 ≤ Version: 7.0.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/selinux/hooks.c",
"security/selinux/include/objsec.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4d50ebe5a27724e020747ffd61a051dec67cb8ec",
"status": "affected",
"version": "bc6c380c1159de52a252ed11f19a42c47f60a735",
"versionType": "git"
},
{
"lessThan": "89376fbfdcc1a728e1775f98752cdd90b0930a00",
"status": "affected",
"version": "8bacd09f12c27710228562e4d13163e58c5f4a45",
"versionType": "git"
},
{
"lessThan": "d127c7e1f3e1231d8ac8b2738e3f00bea12afe74",
"status": "affected",
"version": "d844702198395d3f80222777030f69db6be6b709",
"versionType": "git"
},
{
"lessThan": "c2bbb905af2293549651b614a52ad91e0b462b60",
"status": "affected",
"version": "82544d36b1729153c8aeb179e84750f0c085d3b1",
"versionType": "git"
},
{
"lessThan": "78fc54b934bfb2c18aad8154c7302067146946f9",
"status": "affected",
"version": "82544d36b1729153c8aeb179e84750f0c085d3b1",
"versionType": "git"
},
{
"status": "affected",
"version": "cd0e707a927a70cdfd8bc5a512a9719a87f5ed51",
"versionType": "git"
},
{
"lessThan": "6.6.158",
"status": "affected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThan": "6.18.54",
"status": "affected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThan": "7.1",
"status": "affected",
"version": "7.0.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/selinux/hooks.c",
"security/selinux/include/objsec.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.6.144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12.95",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.18.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: recheck intermediate backing files on mprotect()\n\nmprotect() can be used to bypass the SELinux checks that mmap() performs\nagainst the intermediate layers of a stacked filesystem.\n\nmmap() checks every backing layer as the request descends through the\nstack. mprotect() only has the lowest backing file in vma-\u003evm_file, so it\nrechecks the top-level user and the lowest mounter, but skips the mounters\nof every layer in between. With two nested overlayfs mounts and a policy\ndenying mounter_t -\u003e middle_file_t:file { execute }, a direct\nmmap(PROT_EXEC) is denied:\n\n avc: denied { execute } for pid=71 comm=\"nested_exec\"\n path=\"/payload\" dev=\"overlay\" ino=9\n scontext=user_u:base_r:mounter_t\n tcontext=user_u:object_r:middle_file_t tclass=file permissive=0\n\nwhile mmap(PROT_NONE) followed by mprotect(PROT_EXEC) succeeds.\n\nPreserve each intermediate path, mounter SID and file-description SID in\nthe backing-file security blob, copying the saved entries when another\nbacking layer is opened. Allocate the array only for nested backing files,\nand release it and the path references in the backing_file_free hook.\n\nDuring mprotect(), recheck fd { use } and the requested inode permissions\nfor every saved mounter, and include the intermediate layers in the execmod\nchecks. Policy for nested stacking may then need to grant intermediate\nmounters what a direct mmap() already requires, and execmod on intermediate\nlabels for binaries using text relocations.\n\nTested on arm64 QEMU with a small BusyBox initramfs and a purpose-built\nSELinux policy, on a mainline tree containing\ncommit f2381b546e7e (\"fs: fix user path of nested backing files\").\n\n[PM: subject tweak]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:45.082Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4d50ebe5a27724e020747ffd61a051dec67cb8ec"
},
{
"url": "https://git.kernel.org/stable/c/89376fbfdcc1a728e1775f98752cdd90b0930a00"
},
{
"url": "https://git.kernel.org/stable/c/d127c7e1f3e1231d8ac8b2738e3f00bea12afe74"
},
{
"url": "https://git.kernel.org/stable/c/c2bbb905af2293549651b614a52ad91e0b462b60"
},
{
"url": "https://git.kernel.org/stable/c/78fc54b934bfb2c18aad8154c7302067146946f9"
}
],
"title": "selinux: recheck intermediate backing files on mprotect()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98214",
"datePublished": "2026-10-06T08:44:50.209Z",
"dateReserved": "2026-09-25T10:25:14.325Z",
"dateUpdated": "2026-10-19T09:15:45.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97938 (GCVE-0-2026-97938)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
reboot: fix cad_pid use-after-free race
cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
reads it and passes it to pid_vnr() without protecting the lifetime of
the referenced struct pid. A concurrent writer can replace cad_pid and
drop the final reference to the old struct pid after the reader has
loaded the pointer but before pid_vnr() has finished dereferencing it,
causing a use-after-free.
kill_cad_pid() has the same lifetime race when it passes cad_pid to
kill_pid().
At the time this issue was reported, an unprivileged user could reach the
sysctl through user and PID namespaces because cad_pid was registered in
pid_table[]. Moving cad_pid back to the global reboot sysctl table
corrected that namespace and permission mismatch, but did not fix the
underlying lifetime race.
Fix this by treating cad_pid as an RCU-protected pointer at both read
sites and by waiting for a grace period before dropping the old reference
on the write side.
call_rcu(&old_pid->rcu, ...) cannot be used here because free_pid()
also queues pid->rcu; queueing the same rcu_head twice can corrupt the
RCU callback list.
Original KASAN crash stack:
kernel/pid.c:545 pid_nr_ns() # reads freed pid->level
kernel/pid.c:556 pid_vnr() # calls pid_nr_ns()
kernel/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/sched.h",
"include/linux/sched/signal.h",
"init/main.c",
"kernel/reboot.c",
"kernel/signal.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c1a966bc047af2801a70b8eb13f9df5d7ab925f",
"status": "affected",
"version": "9ec52099e4b8678a60e9f93e41ad87885d64f3e6",
"versionType": "git"
},
{
"lessThan": "ae3e53fe3c1241855e3a88f74877738349948c78",
"status": "affected",
"version": "9ec52099e4b8678a60e9f93e41ad87885d64f3e6",
"versionType": "git"
},
{
"lessThan": "ad72e2566643fff7f01666d845fb026898155e1f",
"status": "affected",
"version": "9ec52099e4b8678a60e9f93e41ad87885d64f3e6",
"versionType": "git"
},
{
"lessThan": "9a17b0e053197a6a42cdc75e75a35b17aa662088",
"status": "affected",
"version": "9ec52099e4b8678a60e9f93e41ad87885d64f3e6",
"versionType": "git"
},
{
"lessThan": "5a88f78df753993469dab4d1831f8fb4256a9468",
"status": "affected",
"version": "9ec52099e4b8678a60e9f93e41ad87885d64f3e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/sched.h",
"include/linux/sched/signal.h",
"init/main.c",
"kernel/reboot.c",
"kernel/signal.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.19"
},
{
"lessThan": "2.6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nreboot: fix cad_pid use-after-free race\n\ncad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()\nreads it and passes it to pid_vnr() without protecting the lifetime of\nthe referenced struct pid. A concurrent writer can replace cad_pid and\ndrop the final reference to the old struct pid after the reader has\nloaded the pointer but before pid_vnr() has finished dereferencing it,\ncausing a use-after-free.\n\nkill_cad_pid() has the same lifetime race when it passes cad_pid to\nkill_pid().\n\nAt the time this issue was reported, an unprivileged user could reach the\nsysctl through user and PID namespaces because cad_pid was registered in\npid_table[]. Moving cad_pid back to the global reboot sysctl table\ncorrected that namespace and permission mismatch, but did not fix the\nunderlying lifetime race.\n\nFix this by treating cad_pid as an RCU-protected pointer at both read\nsites and by waiting for a grace period before dropping the old reference\non the write side.\n\ncall_rcu(\u0026old_pid-\u003ercu, ...) cannot be used here because free_pid()\nalso queues pid-\u003ercu; queueing the same rcu_head twice can corrupt the\nRCU callback list.\n\nOriginal KASAN crash stack:\n kernel/pid.c:545 pid_nr_ns() # reads freed pid-\u003elevel\n kernel/pid.c:556 pid_vnr() # calls pid_nr_ns()\n kernel/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:45.385Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c1a966bc047af2801a70b8eb13f9df5d7ab925f"
},
{
"url": "https://git.kernel.org/stable/c/ae3e53fe3c1241855e3a88f74877738349948c78"
},
{
"url": "https://git.kernel.org/stable/c/ad72e2566643fff7f01666d845fb026898155e1f"
},
{
"url": "https://git.kernel.org/stable/c/9a17b0e053197a6a42cdc75e75a35b17aa662088"
},
{
"url": "https://git.kernel.org/stable/c/5a88f78df753993469dab4d1831f8fb4256a9468"
}
],
"title": "reboot: fix cad_pid use-after-free race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97938",
"datePublished": "2026-09-25T10:22:51.720Z",
"dateReserved": "2026-09-25T10:18:58.204Z",
"dateUpdated": "2026-10-21T12:53:45.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98290 (GCVE-0-2026-98290)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
rfcomm_sock_cleanup_listen() closes unaccepted child sockets through
rfcomm_sock_close(), which takes the child socket lock before
rfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these
locks in reverse order while handling connections and DLC state changes,
so lockdep reports a possible deadlock.
Close dequeued children without taking their socket lock. The accept queue
owns a reference to each child, and bt_accept_dequeue() locks the child
while unlinking it and clearing its parent pointer.
Dropping the child lock makes it important to prevent a concurrent
rfcomm_connect_ind() from enqueueing a new child after cleanup observes an
empty queue. Set a listening socket to BT_CLOSED while its lock is still
held, before dropping the lock and draining the queue. The state check in
rfcomm_connect_ind() then rejects new children once cleanup starts.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b7ce436a5d798bc59e71797952566608a4b4626b Version: b7ce436a5d798bc59e71797952566608a4b4626b Version: b7ce436a5d798bc59e71797952566608a4b4626b Version: b7ce436a5d798bc59e71797952566608a4b4626b Version: b7ce436a5d798bc59e71797952566608a4b4626b Version: b7ce436a5d798bc59e71797952566608a4b4626b Version: b7ce436a5d798bc59e71797952566608a4b4626b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/rfcomm/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eb4adaa46e4c9e6efa7be3ce06398f4d7c39b57c",
"status": "affected",
"version": "b7ce436a5d798bc59e71797952566608a4b4626b",
"versionType": "git"
},
{
"lessThan": "4aafb47301a799d3e01230d6568c4e93524e1523",
"status": "affected",
"version": "b7ce436a5d798bc59e71797952566608a4b4626b",
"versionType": "git"
},
{
"lessThan": "c741977e413f5b49d306700820fb55ccb8269f5a",
"status": "affected",
"version": "b7ce436a5d798bc59e71797952566608a4b4626b",
"versionType": "git"
},
{
"lessThan": "c6792c441767256030606eb82dca5d5fc360dd9a",
"status": "affected",
"version": "b7ce436a5d798bc59e71797952566608a4b4626b",
"versionType": "git"
},
{
"lessThan": "bfce253f039eb5f58b810af267942a9f59207254",
"status": "affected",
"version": "b7ce436a5d798bc59e71797952566608a4b4626b",
"versionType": "git"
},
{
"lessThan": "18174b166547ef41973cc19feb5ef9cab39a8def",
"status": "affected",
"version": "b7ce436a5d798bc59e71797952566608a4b4626b",
"versionType": "git"
},
{
"lessThan": "801fb950cae7048eb7d83b18857d1ca37b8cd5a4",
"status": "affected",
"version": "b7ce436a5d798bc59e71797952566608a4b4626b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/rfcomm/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: avoid socket lock inversion in listener cleanup\n\nrfcomm_sock_cleanup_listen() closes unaccepted child sockets through\nrfcomm_sock_close(), which takes the child socket lock before\nrfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these\nlocks in reverse order while handling connections and DLC state changes,\nso lockdep reports a possible deadlock.\n\nClose dequeued children without taking their socket lock. The accept queue\nowns a reference to each child, and bt_accept_dequeue() locks the child\nwhile unlinking it and clearing its parent pointer.\n\nDropping the child lock makes it important to prevent a concurrent\nrfcomm_connect_ind() from enqueueing a new child after cleanup observes an\nempty queue. Set a listening socket to BT_CLOSED while its lock is still\nheld, before dropping the lock and draining the queue. The state check in\nrfcomm_connect_ind() then rejects new children once cleanup starts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - A Bluetooth peer drives both halves of this bug. Its RFCOMM SABM creates a child in rfcomm_connect_ind(), and its later DISC makes krfcommd call rfcomm_sk_state_change() on that child (taking lock_sock(child) under rfcomm_mutex, and dereferencing bt_sk(child)-\u003eparent). Bluetooth requires radio range, so the vector is Adjacent.\nAC:H - The peer can send SABM and DISC at will, but both the ABBA deadlock and the late-enqueue window need the victim to close its listener at that moment. That window runs from rfcomm_sock_shutdown dropping the listener lock to cleanup_listen setting BT_CLOSED, and the peer cannot control when the application closes the socket.\nPR:N - rfcomm_connect_ind() only checks for a BT_LISTEN socket on the channel and for room in the backlog before it enqueues a child, so the peer needs no credentials.\nUI:N - No victim action beyond normal operation is needed. A service closing its RFCOMM listener on its own (exit, restart, or Bluetooth teardown) is a timing condition and is counted in AC:H.\nS:U - The deadlock and the dangling parent pointer both stay inside kernel RFCOMM socket state and do not cross a virtualization or hardware boundary.\nC:H - A child enqueued after the drain keeps bt_sk(sk)-\u003eparent pointing at the listener, but bt_accept_enqueue takes no reference on it, so rfcomm_sock_kill frees the listener while the pointer is still live. A later state change then reads the freed sock through parent-\u003esk_data_ready, a use-after-free that can be groomed for disclosure.\nI:H - On the peer\u0027s DISC, rfcomm_sk_state_change calls bt_accept_unlink(), which does list_del on the freed listener\u0027s accept_q and decrements its backlog, then makes an indirect call through the freed parent-\u003esk_data_ready. That is a write to freed memory and a call through a function pointer an attacker can replace.\nA:H - The ABBA blocks krfcommd forever while it holds rfcomm_mutex (rfcomm_dlc_close in the closer against lock_sock(child) in rfcomm_sk_state_change). That stops all RFCOMM processing and hangs the closing task, and the use-after-free path can oops the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:01.498Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eb4adaa46e4c9e6efa7be3ce06398f4d7c39b57c"
},
{
"url": "https://git.kernel.org/stable/c/4aafb47301a799d3e01230d6568c4e93524e1523"
},
{
"url": "https://git.kernel.org/stable/c/c741977e413f5b49d306700820fb55ccb8269f5a"
},
{
"url": "https://git.kernel.org/stable/c/c6792c441767256030606eb82dca5d5fc360dd9a"
},
{
"url": "https://git.kernel.org/stable/c/bfce253f039eb5f58b810af267942a9f59207254"
},
{
"url": "https://git.kernel.org/stable/c/18174b166547ef41973cc19feb5ef9cab39a8def"
},
{
"url": "https://git.kernel.org/stable/c/801fb950cae7048eb7d83b18857d1ca37b8cd5a4"
}
],
"title": "Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98290",
"datePublished": "2026-10-06T08:45:50.299Z",
"dateReserved": "2026-09-25T10:25:14.336Z",
"dateUpdated": "2026-10-19T09:17:01.498Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80939 (GCVE-0-2026-80939)
Vulnerability from cvelistv5
Published
2026-09-11 19:42
Modified
2026-10-19 08:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot
Since the hardware rfkill polling was introduced, arm64 platforms can
panic with an asynchronous SError during warm reboot:
SError Interrupt on CPU8, code 0x00000000be000011 -- SError
Workqueue: events_power_efficient rfkill_poll [rfkill]
rtw89_pci_ops_read8+0x94/0x160 [rtw89_pci]
rtw89_core_rfkill_poll+0x50/0x1e0 [rtw89_core]
rtw89_ops_rfkill_poll+0x40/0x68 [rtw89_core]
ieee80211_rfkill_poll+0x3c/0x70 [mac80211]
cfg80211_rfkill_poll+0x40/0x2a0 [cfg80211]
rfkill_poll+0x30/0x88 [rfkill]
Kernel panic - not syncing: Asynchronous SError Interrupt
On the reboot path the kernel only runs device_shutdown(), which calls
each driver's .shutdown callback; .remove is not invoked. The rtw89 PCI
driver had no .shutdown callback, so nothing stopped the rfkill polling
work while the platform was tearing the PCIe link down. Once the link
is gone, the next MMIO read from the poll handler targets a
non-responding device and is reported as a fatal asynchronous SError on
arm64.
Add rtw89_pci_shutdown(), wired to all rtw89 PCI device drivers, which
sets a new RTW89_FLAG_SHUTDOWN flag (mirroring the USB
RTW89_FLAG_UNPLUGGED pattern). When the flag is set,
rtw89_ops_rfkill_poll() returns early, so no MMIO read is issued to the
chip after shutdown begins and the SError no longer occurs.
This does not call the full .remove path from .shutdown, to keep the
shutdown handler minimal and avoid running the non-idempotent teardown
twice.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw89/core.h",
"drivers/net/wireless/realtek/rtw89/mac80211.c",
"drivers/net/wireless/realtek/rtw89/pci.c",
"drivers/net/wireless/realtek/rtw89/pci.h",
"drivers/net/wireless/realtek/rtw89/rtw8851be.c",
"drivers/net/wireless/realtek/rtw89/rtw8852ae.c",
"drivers/net/wireless/realtek/rtw89/rtw8852be.c",
"drivers/net/wireless/realtek/rtw89/rtw8852bte.c",
"drivers/net/wireless/realtek/rtw89/rtw8852ce.c",
"drivers/net/wireless/realtek/rtw89/rtw8922ae.c",
"drivers/net/wireless/realtek/rtw89/rtw8922de.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dfe2b5b2056918d186ad890079a9e7ec1898429a",
"status": "affected",
"version": "0b38e6277aed8a59ccb64fcc1172d962c1f11b4c",
"versionType": "git"
},
{
"lessThan": "9693980cd7d2f5b17e5ef5922b922f2e1a770fca",
"status": "affected",
"version": "0b38e6277aed8a59ccb64fcc1172d962c1f11b4c",
"versionType": "git"
},
{
"lessThan": "c1f214dd1351244156deb57761b14190a233aef6",
"status": "affected",
"version": "0b38e6277aed8a59ccb64fcc1172d962c1f11b4c",
"versionType": "git"
},
{
"lessThan": "667c12782aaf8dd3cb2213e528fe63a73cb63345",
"status": "affected",
"version": "0b38e6277aed8a59ccb64fcc1172d962c1f11b4c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw89/core.h",
"drivers/net/wireless/realtek/rtw89/mac80211.c",
"drivers/net/wireless/realtek/rtw89/pci.c",
"drivers/net/wireless/realtek/rtw89/pci.h",
"drivers/net/wireless/realtek/rtw89/rtw8851be.c",
"drivers/net/wireless/realtek/rtw89/rtw8852ae.c",
"drivers/net/wireless/realtek/rtw89/rtw8852be.c",
"drivers/net/wireless/realtek/rtw89/rtw8852bte.c",
"drivers/net/wireless/realtek/rtw89/rtw8852ce.c",
"drivers/net/wireless/realtek/rtw89/rtw8922ae.c",
"drivers/net/wireless/realtek/rtw89/rtw8922de.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot\n\nSince the hardware rfkill polling was introduced, arm64 platforms can\npanic with an asynchronous SError during warm reboot:\n\n SError Interrupt on CPU8, code 0x00000000be000011 -- SError\n Workqueue: events_power_efficient rfkill_poll [rfkill]\n rtw89_pci_ops_read8+0x94/0x160 [rtw89_pci]\n rtw89_core_rfkill_poll+0x50/0x1e0 [rtw89_core]\n rtw89_ops_rfkill_poll+0x40/0x68 [rtw89_core]\n ieee80211_rfkill_poll+0x3c/0x70 [mac80211]\n cfg80211_rfkill_poll+0x40/0x2a0 [cfg80211]\n rfkill_poll+0x30/0x88 [rfkill]\n Kernel panic - not syncing: Asynchronous SError Interrupt\n\nOn the reboot path the kernel only runs device_shutdown(), which calls\neach driver\u0027s .shutdown callback; .remove is not invoked. The rtw89 PCI\ndriver had no .shutdown callback, so nothing stopped the rfkill polling\nwork while the platform was tearing the PCIe link down. Once the link\nis gone, the next MMIO read from the poll handler targets a\nnon-responding device and is reported as a fatal asynchronous SError on\narm64.\n\nAdd rtw89_pci_shutdown(), wired to all rtw89 PCI device drivers, which\nsets a new RTW89_FLAG_SHUTDOWN flag (mirroring the USB\nRTW89_FLAG_UNPLUGGED pattern). When the flag is set,\nrtw89_ops_rfkill_poll() returns early, so no MMIO read is issued to the\nchip after shutdown begins and the SError no longer occurs.\n\nThis does not call the full .remove path from .shutdown, to keep the\nshutdown handler minimal and avoid running the non-idempotent teardown\ntwice."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:45:23.179Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dfe2b5b2056918d186ad890079a9e7ec1898429a"
},
{
"url": "https://git.kernel.org/stable/c/9693980cd7d2f5b17e5ef5922b922f2e1a770fca"
},
{
"url": "https://git.kernel.org/stable/c/c1f214dd1351244156deb57761b14190a233aef6"
},
{
"url": "https://git.kernel.org/stable/c/667c12782aaf8dd3cb2213e528fe63a73cb63345"
}
],
"title": "wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80939",
"datePublished": "2026-09-11T19:42:12.340Z",
"dateReserved": "2026-08-26T14:34:25.803Z",
"dateUpdated": "2026-10-19T08:45:23.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98253 (GCVE-0-2026-98253)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/ucma: Serialize join and leave on copy_to_user failure
rdma_join_multicast() queues RoCE work that later reads the ucma_multicast
through event->param.ud.private_data, then list_add()s the CMA multicast
at the head of id_priv->mc_list. rdma_leave_multicast() matches only by
sockaddr and destroys the first hit.
ucma_process_join() used to drop ctx->mutex after a successful join and
retake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls
with the same address can therefore insert a second CMA entry before the
first thread's leave. leave then cancels the newer work and the older
worker still dereferences the ucma_multicast that the first thread frees.
Keep ctx->mutex held from rdma_join_multicast() through copy_to_user() and,
on -EFAULT, through rdma_leave_multicast() so leave cannot miss this join.
Do not leave if join itself failed: that path never published this address
on mc_list, and a leave-by-addr would destroy an earlier successful join.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 60d613b39e8d0c9f3b526e9c96445422b4562d76 Version: fe454dc31e84f8c14cb8942fcb61666c9f40745b Version: fe454dc31e84f8c14cb8942fcb61666c9f40745b Version: fe454dc31e84f8c14cb8942fcb61666c9f40745b Version: fe454dc31e84f8c14cb8942fcb61666c9f40745b Version: fe454dc31e84f8c14cb8942fcb61666c9f40745b Version: fe454dc31e84f8c14cb8942fcb61666c9f40745b Version: fe454dc31e84f8c14cb8942fcb61666c9f40745b Version: a3262b3884dd67b4c5632ce7cdf9cff9d1a575d4 Version: 5.10.20 ≤ Version: 5.11.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/ucma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9",
"status": "affected",
"version": "60d613b39e8d0c9f3b526e9c96445422b4562d76",
"versionType": "git"
},
{
"lessThan": "52172e11bd074ccaded21740ffeb67123f01dd00",
"status": "affected",
"version": "fe454dc31e84f8c14cb8942fcb61666c9f40745b",
"versionType": "git"
},
{
"lessThan": "01e29d0d78a8f66f221625720a04939eef5ec1f6",
"status": "affected",
"version": "fe454dc31e84f8c14cb8942fcb61666c9f40745b",
"versionType": "git"
},
{
"lessThan": "ae805d204cf1f15b87d1bf3529b4c649f3519420",
"status": "affected",
"version": "fe454dc31e84f8c14cb8942fcb61666c9f40745b",
"versionType": "git"
},
{
"lessThan": "43c4e24bd10370fc976f6220518049ce71419399",
"status": "affected",
"version": "fe454dc31e84f8c14cb8942fcb61666c9f40745b",
"versionType": "git"
},
{
"lessThan": "01cbdb724c584d7772fd25af2e4dfdf8527ce0d5",
"status": "affected",
"version": "fe454dc31e84f8c14cb8942fcb61666c9f40745b",
"versionType": "git"
},
{
"lessThan": "83610ee5e498fa5bfcb80031d2b959baea276bf6",
"status": "affected",
"version": "fe454dc31e84f8c14cb8942fcb61666c9f40745b",
"versionType": "git"
},
{
"lessThan": "662ade4de9ff5eceb0820a9f8e9fac70ba6a815b",
"status": "affected",
"version": "fe454dc31e84f8c14cb8942fcb61666c9f40745b",
"versionType": "git"
},
{
"status": "affected",
"version": "a3262b3884dd67b4c5632ce7cdf9cff9d1a575d4",
"versionType": "git"
},
{
"lessThan": "5.10.271",
"status": "affected",
"version": "5.10.20",
"versionType": "semver"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/ucma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.10.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ucma: Serialize join and leave on copy_to_user failure\n\nrdma_join_multicast() queues RoCE work that later reads the ucma_multicast\nthrough event-\u003eparam.ud.private_data, then list_add()s the CMA multicast\nat the head of id_priv-\u003emc_list. rdma_leave_multicast() matches only by\nsockaddr and destroys the first hit.\n\nucma_process_join() used to drop ctx-\u003emutex after a successful join and\nretake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls\nwith the same address can therefore insert a second CMA entry before the\nfirst thread\u0027s leave. leave then cancels the newer work and the older\nworker still dereferences the ucma_multicast that the first thread frees.\n\nKeep ctx-\u003emutex held from rdma_join_multicast() through copy_to_user() and,\non -EFAULT, through rdma_leave_multicast() so leave cannot miss this join.\nDo not leave if join itself failed: that path never published this address\non mc_list, and a leave-by-addr would destroy an earlier successful join."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached by write() of RDMA_USER_CM_CMD_JOIN_MCAST/JOIN_IP_MCAST on the local char device /dev/infiniband/rdma_cm into ucma_process_join(). The trigger is local: two racing joins and a bad response pointer. No remote peer supplies the data that causes it, so AV:L.\nAC:L - The attacker drives every part of the race. They make copy_to_user() fail with a bad cmd-\u003eresponse pointer, and a second thread issues JOIN_MCAST for the same address while ctx-\u003emutex is dropped. rdma_leave_multicast() then destroys the newer mc_list head and cancels the wrong iboe_join work. The attempt can be repeated until it wins.\nPR:L - rdma_cm is created with mode 0666 and ucma_write() does no capability check. Any local user on a host with a RoCE port can create a UD cm_id, bind it and join multicast. An unprivileged user cannot create a soft-RoCE device, because nldev NEWLINK needs CAP_NET_ADMIN in the initial namespace, so the RoCE port must already exist.\nUI:N - The attacker triggers the bug entirely through their own writes on an rdma_cm file descriptor they opened. No other user or administrator has to act.\nS:U - The freed ucma_multicast and the corrupted kernel heap are in the same kernel security authority. This is local kernel memory corruption, not a VM or IOMMU boundary crossing.\nC:H - cma_iboe_join_work_handler() calls ucma_create_uevent() on the freed ucma_multicast, reading mc-\u003euid and mc-\u003eid into the event that GET_EVENT copies to userspace. If the freed slot is reclaimed with sprayed objects, this use-after-free gives a read primitive.\nI:H - uevent-\u003emc keeps a pointer to the freed ucma_multicast, and ucma_get_event() then runs uevent-\u003emc-\u003eevents_reported++. That is an attacker-timed write into freed and reclaimable slab memory, usable to corrupt an object sprayed into the slot.\nA:H - The use-after-free of ucma_multicast in the RoCE join worker and in ucma_get_event() can corrupt the slab or oops the kernel, crashing the host. Syzbot reported this bug (extid a6ffe86390c8a6afc818)."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:24.567Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9"
},
{
"url": "https://git.kernel.org/stable/c/52172e11bd074ccaded21740ffeb67123f01dd00"
},
{
"url": "https://git.kernel.org/stable/c/01e29d0d78a8f66f221625720a04939eef5ec1f6"
},
{
"url": "https://git.kernel.org/stable/c/ae805d204cf1f15b87d1bf3529b4c649f3519420"
},
{
"url": "https://git.kernel.org/stable/c/43c4e24bd10370fc976f6220518049ce71419399"
},
{
"url": "https://git.kernel.org/stable/c/01cbdb724c584d7772fd25af2e4dfdf8527ce0d5"
},
{
"url": "https://git.kernel.org/stable/c/83610ee5e498fa5bfcb80031d2b959baea276bf6"
},
{
"url": "https://git.kernel.org/stable/c/662ade4de9ff5eceb0820a9f8e9fac70ba6a815b"
}
],
"title": "RDMA/ucma: Serialize join and leave on copy_to_user failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98253",
"datePublished": "2026-10-06T08:45:20.077Z",
"dateReserved": "2026-09-25T10:25:14.331Z",
"dateUpdated": "2026-10-19T09:16:24.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98282 (GCVE-0-2026-98282)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified
IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba().
While doing so, the passed in argument npages is ignored and constant
value '1' is used leaving out a possible overflow as the callers can
legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT
cases.
Fix this by accounting for 'npages', checking for arithmetic overflow,
and verifying that the entire requested range (ioba - offset + npages)
does not exceed the table capacity 'size'.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b1af23d836f811137d504d14d4cbdd01929dec34 Version: b1af23d836f811137d504d14d4cbdd01929dec34 Version: b1af23d836f811137d504d14d4cbdd01929dec34 Version: b1af23d836f811137d504d14d4cbdd01929dec34 Version: b1af23d836f811137d504d14d4cbdd01929dec34 Version: b1af23d836f811137d504d14d4cbdd01929dec34 Version: b1af23d836f811137d504d14d4cbdd01929dec34 Version: b1af23d836f811137d504d14d4cbdd01929dec34 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/powerpc/kernel/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "98d8dcc4ebd10523507d4478e148809a7771a213",
"status": "affected",
"version": "b1af23d836f811137d504d14d4cbdd01929dec34",
"versionType": "git"
},
{
"lessThan": "9fd9c9bbb05417f468a11fb6d145d7ff61f4a868",
"status": "affected",
"version": "b1af23d836f811137d504d14d4cbdd01929dec34",
"versionType": "git"
},
{
"lessThan": "3776bf56e06980e8a12c8c0565d9e6ac44965f03",
"status": "affected",
"version": "b1af23d836f811137d504d14d4cbdd01929dec34",
"versionType": "git"
},
{
"lessThan": "d6a1779129d936bc1fbab80181165da544eab736",
"status": "affected",
"version": "b1af23d836f811137d504d14d4cbdd01929dec34",
"versionType": "git"
},
{
"lessThan": "d48ceb6e1a6915c7bac4f902554a1047365cdff2",
"status": "affected",
"version": "b1af23d836f811137d504d14d4cbdd01929dec34",
"versionType": "git"
},
{
"lessThan": "0543813753ef5cfbd6fa96694f7acf783fa01af7",
"status": "affected",
"version": "b1af23d836f811137d504d14d4cbdd01929dec34",
"versionType": "git"
},
{
"lessThan": "314091243159f8e3749bc719bb129f423f72fd86",
"status": "affected",
"version": "b1af23d836f811137d504d14d4cbdd01929dec34",
"versionType": "git"
},
{
"lessThan": "0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71",
"status": "affected",
"version": "b1af23d836f811137d504d14d4cbdd01929dec34",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/powerpc/kernel/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba\n\nThe commit b1af23d836f8 (\"KVM: PPC: iommu: Unify TCE checking\") unified\nIOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba().\nWhile doing so, the passed in argument npages is ignored and constant\nvalue \u00271\u0027 is used leaving out a possible overflow as the callers can\nlegitimately be using npages \u003e 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT\ncases.\n\nFix this by accounting for \u0027npages\u0027, checking for arithmetic overflow,\nand verifying that the entire requested range (ioba - offset + npages)\ndoes not exceed the table capacity \u0027size\u0027."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bad ioba/npages values come from a KVM guest\u0027s H_STUFF_TCE or H_PUT_TCE_INDIRECT hypercall registers. book3s_hv.c passes them to kvmppc_h_stuff_tce()/kvmppc_h_put_tce_indirect(), which call kvmppc_ioba_validate() -\u003e iommu_tce_check_ioba(). The attacker is code running on the host in a guest, not a remote network peer.\nAC:L - The guest picks liobn, ioba (the last valid entry) and npages itself. The flawed check only tests ioba+1, so every such hypercall reliably walks kvmppc_tce_put() past stt-\u003esize. No race or outside condition is involved; only heap grooming affects how far exploitation goes.\nPR:L - The attacker needs kernel privilege inside their own guest, which any tenant of a pseries KVM VM has. Relative to the host, that is a low-privilege tenant position. The guest\u0027s TCE table already exists because QEMU creates it through KVM_CREATE_SPAPR_TCE_64 for the default PHB/VIO DMA windows.\nUI:N - The guest issues the hypercalls whenever it wants. No action by the host administrator or any other user is needed.\nS:C - A guest-controlled hypercall corrupts host kernel memory and touches the host\u0027s hardware IOMMU table outside the guest\u0027s DMA window. The impact therefore crosses the guest-to-host virtualization boundary.\nC:H - kvmppc_tce_put() and kvmppc_h_get_tce paths index stt-\u003epages[] past the kmalloc\u0027d flexible array, and the TCE iommu_unmap/map paths use entries beyond the window. This gives out-of-bounds access to host heap and IOMMU state that can be turned into host memory disclosure.\nI:H - In H_STUFF_TCE, npages is unbounded and tce_value is guest-chosen. kvmppc_tce_put() writes that 8-byte value through an out-of-bounds stt-\u003epages[] pointer, or stores a newly allocated page pointer into the out-of-bounds slot. Both are host heap writes.\nA:H - Dereferencing an out-of-bounds stt-\u003epages[] entry as a struct page, or corrupting the host heap and IOMMU tables, crashes or oopses the host. That takes down every VM running on it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:53.780Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/98d8dcc4ebd10523507d4478e148809a7771a213"
},
{
"url": "https://git.kernel.org/stable/c/9fd9c9bbb05417f468a11fb6d145d7ff61f4a868"
},
{
"url": "https://git.kernel.org/stable/c/3776bf56e06980e8a12c8c0565d9e6ac44965f03"
},
{
"url": "https://git.kernel.org/stable/c/d6a1779129d936bc1fbab80181165da544eab736"
},
{
"url": "https://git.kernel.org/stable/c/d48ceb6e1a6915c7bac4f902554a1047365cdff2"
},
{
"url": "https://git.kernel.org/stable/c/0543813753ef5cfbd6fa96694f7acf783fa01af7"
},
{
"url": "https://git.kernel.org/stable/c/314091243159f8e3749bc719bb129f423f72fd86"
},
{
"url": "https://git.kernel.org/stable/c/0b271f7d7f5ed45bc498a03ce0aa9cfd8402fc71"
}
],
"title": "powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98282",
"datePublished": "2026-10-06T08:45:43.775Z",
"dateReserved": "2026-09-25T10:25:14.335Z",
"dateUpdated": "2026-10-19T09:16:53.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98231 (GCVE-0-2026-98231)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: serialize state GC with device state flush
The deferred-device pass in xfrm_dev_state_flush() finds states under
xfrm_state_dev_gc_lock, but drops the lock before calling
xfrm_dev_state_free() because the driver callback may sleep. The device
GC list does not hold an xfrm_state reference, so the state GC worker can
destroy the same state concurrently.
The race can proceed as follows:
CPU 0 CPU 1
find x on the device GC list
drop xfrm_state_dev_gc_lock
read x->xso.dev
xfrm_state_gc_destroy(x)
xfrm_dev_state_free(x)
xfrm_state_free(x)
continue xfrm_dev_state_free(x)
Both paths can invoke the driver callback and drop the device reference.
CPU 0 can also access the xfrm_state after CPU 1 has freed it.
KASAN reported:
BUG: KASAN: slab-use-after-free in xfrm_dev_state_free+0x24c/0x2a0
Read of size 8 at addr ffff88810bbaa960 by task poc/102
Call Trace:
xfrm_dev_state_free+0x24c/0x2a0
xfrm_dev_state_flush+0x353/0x400
xfrm_dev_event+0x26d/0x3a0
notifier_call_chain+0xc0/0x280
__dev_notify_flags+0x169/0x250
netif_change_flags+0xe7/0x160
dev_change_flags+0x96/0x220
devinet_ioctl+0x7f4/0x1880
Allocated by task 87:
xfrm_state_alloc+0x1e/0x5c0
xfrm_add_sa+0xe7f/0x5820
xfrm_user_rcv_msg+0x4f3/0x940
Freed by task 57:
kmem_cache_free+0xcb/0x3d0
xfrm_state_gc_task+0x4a8/0x650
process_one_work+0x63a/0x1070
Serialize xfrm_state destruction against the deferred-device pass with a
mutex. Keep xfrm_state_dev_gc_lock limited to list operations and retain
the existing callback and device-reference release ordering.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d5f53edd43daf3e6e1633a49c561387f8f99e13f Version: 07b87f9eea0c30675084d50c82532d20168da009 Version: 07b87f9eea0c30675084d50c82532d20168da009 Version: 07b87f9eea0c30675084d50c82532d20168da009 Version: 07b87f9eea0c30675084d50c82532d20168da009 Version: 8ecee44464a4926c9bef989a1490b7394785f584 Version: 6.6.44 ≤ Version: 6.10.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "937108dc0258d6ac69926b00bc53598c98986ee1",
"status": "affected",
"version": "d5f53edd43daf3e6e1633a49c561387f8f99e13f",
"versionType": "git"
},
{
"lessThan": "39e41af3653ee45c985190dd97426f318918d201",
"status": "affected",
"version": "07b87f9eea0c30675084d50c82532d20168da009",
"versionType": "git"
},
{
"lessThan": "75fc4561772e2f9811abf39ed10443e6f4a4bc6c",
"status": "affected",
"version": "07b87f9eea0c30675084d50c82532d20168da009",
"versionType": "git"
},
{
"lessThan": "84e378395494963b1e581cf223a7cbeec8c0e2d6",
"status": "affected",
"version": "07b87f9eea0c30675084d50c82532d20168da009",
"versionType": "git"
},
{
"lessThan": "89fefad9f971bc637fb22373078144f2563c4be9",
"status": "affected",
"version": "07b87f9eea0c30675084d50c82532d20168da009",
"versionType": "git"
},
{
"status": "affected",
"version": "8ecee44464a4926c9bef989a1490b7394785f584",
"versionType": "git"
},
{
"lessThan": "6.6.158",
"status": "affected",
"version": "6.6.44",
"versionType": "semver"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.6.44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: serialize state GC with device state flush\n\nThe deferred-device pass in xfrm_dev_state_flush() finds states under\nxfrm_state_dev_gc_lock, but drops the lock before calling\nxfrm_dev_state_free() because the driver callback may sleep. The device\nGC list does not hold an xfrm_state reference, so the state GC worker can\ndestroy the same state concurrently.\n\nThe race can proceed as follows:\n\n CPU 0 CPU 1\n find x on the device GC list\n drop xfrm_state_dev_gc_lock\n read x-\u003exso.dev\n xfrm_state_gc_destroy(x)\n xfrm_dev_state_free(x)\n xfrm_state_free(x)\n continue xfrm_dev_state_free(x)\n\nBoth paths can invoke the driver callback and drop the device reference.\nCPU 0 can also access the xfrm_state after CPU 1 has freed it.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in xfrm_dev_state_free+0x24c/0x2a0\n Read of size 8 at addr ffff88810bbaa960 by task poc/102\n\n Call Trace:\n xfrm_dev_state_free+0x24c/0x2a0\n xfrm_dev_state_flush+0x353/0x400\n xfrm_dev_event+0x26d/0x3a0\n notifier_call_chain+0xc0/0x280\n __dev_notify_flags+0x169/0x250\n netif_change_flags+0xe7/0x160\n dev_change_flags+0x96/0x220\n devinet_ioctl+0x7f4/0x1880\n\n Allocated by task 87:\n xfrm_state_alloc+0x1e/0x5c0\n xfrm_add_sa+0xe7f/0x5820\n xfrm_user_rcv_msg+0x4f3/0x940\n\n Freed by task 57:\n kmem_cache_free+0xcb/0x3d0\n xfrm_state_gc_task+0x4a8/0x650\n process_one_work+0x63a/0x1070\n\nSerialize xfrm_state destruction against the deferred-device pass with a\nmutex. Keep xfrm_state_dev_gc_lock limited to list operations and retain\nthe existing callback and device-reference release ordering."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:03.101Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/937108dc0258d6ac69926b00bc53598c98986ee1"
},
{
"url": "https://git.kernel.org/stable/c/39e41af3653ee45c985190dd97426f318918d201"
},
{
"url": "https://git.kernel.org/stable/c/75fc4561772e2f9811abf39ed10443e6f4a4bc6c"
},
{
"url": "https://git.kernel.org/stable/c/84e378395494963b1e581cf223a7cbeec8c0e2d6"
},
{
"url": "https://git.kernel.org/stable/c/89fefad9f971bc637fb22373078144f2563c4be9"
}
],
"title": "xfrm: serialize state GC with device state flush",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98231",
"datePublished": "2026-10-06T08:45:05.183Z",
"dateReserved": "2026-09-25T10:25:14.328Z",
"dateUpdated": "2026-10-19T09:16:03.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74347 (GCVE-0-2026-74347)
Vulnerability from cvelistv5
Published
2026-08-15 05:58
Modified
2026-10-21 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount
Add a refcount for struct nf_ct_timeout which is used by ct extension to
set the custom ct timeout policy, this tells us that the ct timeout is
being used by a conntrack entry. When the last conntrack entry drops the
refcount on the ct timeout, the ct timeout is released.
Remove the refcount for control plane which controls if the ruleset
refers to the timeout policy. After this update, it is possible to
remove the ct timeout policy from nfnetlink_cttimeout immediately.
This is for simplicity not to handle two refcounts on a single object.
Remove nf_queue_nf_hook_drop(): a packet sitting in nfqueue will just
hold a reference to the nf_ct_timeout object until packet is reinjected,
since this is part of the ct extension, this will be released by the
time the conntrack is freed.
nf_ct_untimeout() is still called to clean up in a best effort basis:
the ct timeout on existing entries gets removed when the ct timeout goes
away, but as long as the iptables ruleset still refers to the ct timeout
through a template, new conntracks may keep attaching it and extend its
lifetime until the rule is removed.
nf_ct_untimeout() is not called anymore from module removal path, this
is unlikely to find timeouts give module refcount is bumped, and the new
refcount already tracks the ct timeout policy use so it is released when
unused.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74347",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:54:09.373919Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:55:34.556Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_conntrack_timeout.h",
"net/netfilter/nf_conntrack_core.c",
"net/netfilter/nf_conntrack_timeout.c",
"net/netfilter/nfnetlink_cttimeout.c",
"net/netfilter/nft_ct.c",
"net/netfilter/xt_CT.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1241e459a1bd17044fa6bbb68f491ab5543c3a1b",
"status": "affected",
"version": "50978462300f74dc48aea4a38471cb69bdf741a5",
"versionType": "git"
},
{
"lessThan": "b2e84317f334d834fb06c9b340ea465f398b6d4f",
"status": "affected",
"version": "50978462300f74dc48aea4a38471cb69bdf741a5",
"versionType": "git"
},
{
"lessThan": "44583fd5735cb0bdf3bfe11b1e51504ce387bdb7",
"status": "affected",
"version": "50978462300f74dc48aea4a38471cb69bdf741a5",
"versionType": "git"
},
{
"lessThan": "9aeb0dcfeb460d33d61d434148b51103ab1d2013",
"status": "affected",
"version": "50978462300f74dc48aea4a38471cb69bdf741a5",
"versionType": "git"
},
{
"lessThan": "7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549",
"status": "affected",
"version": "50978462300f74dc48aea4a38471cb69bdf741a5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_conntrack_timeout.h",
"net/netfilter/nf_conntrack_core.c",
"net/netfilter/nf_conntrack_timeout.c",
"net/netfilter/nfnetlink_cttimeout.c",
"net/netfilter/nft_ct.c",
"net/netfilter/xt_CT.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: cttimeout: detach dataplane timeout policy and repurpose refcount\n\nAdd a refcount for struct nf_ct_timeout which is used by ct extension to\nset the custom ct timeout policy, this tells us that the ct timeout is\nbeing used by a conntrack entry. When the last conntrack entry drops the\nrefcount on the ct timeout, the ct timeout is released.\n\nRemove the refcount for control plane which controls if the ruleset\nrefers to the timeout policy. After this update, it is possible to\nremove the ct timeout policy from nfnetlink_cttimeout immediately.\nThis is for simplicity not to handle two refcounts on a single object.\n\nRemove nf_queue_nf_hook_drop(): a packet sitting in nfqueue will just\nhold a reference to the nf_ct_timeout object until packet is reinjected,\nsince this is part of the ct extension, this will be released by the\ntime the conntrack is freed.\n\nnf_ct_untimeout() is still called to clean up in a best effort basis:\nthe ct timeout on existing entries gets removed when the ct timeout goes\naway, but as long as the iptables ruleset still refers to the ct timeout\nthrough a template, new conntracks may keep attaching it and extend its\nlifetime until the rule is removed.\n\nnf_ct_untimeout() is not called anymore from module removal path, this\nis unlikely to find timeouts give module refcount is bumped, and the new\nrefcount already tracks the ct timeout policy use so it is released when\nunused."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires netlink control-plane operations (nfnetlink_cttimeout delete, nftables timeout object destroy, or iptables CT template removal) gated by CAP_NET_ADMIN; the UAF is exercised in local conntrack packet handling, not by unauthenticated remote packets alone.\nAC:L - An attacker with namespace admin can create timeout policies, drive concurrent conntrack traffic on multiple CPUs, and delete or replace the policy while packets still read it via RCU in nf_conntrack_tcp_packet; they control both teardown and dataplane readers.\nPR:L - All trigger paths require CAP_NET_ADMIN for nfnetlink/nftables/iptables configuration; netlink_net_capable() checks capability against the socket network namespace user_ns, so unprivileged local users can obtain it via user and network namespaces on common kernels.\nUI:N - No victim interaction is required; the attacker configures timeout policies, generates matching traffic, and tears down the policy while conntrack handlers still reference it, fully driving the race themselves.\nS:U - Impact is kernel heap corruption within the netfilter/conntrack subsystem of the same kernel security authority; it does not cross VM, hypervisor, or IOMMU isolation boundaries.\nC:H - This is a slab use-after-free of nf_ct_timeout objects still dereferenced through RCU in nf_ct_timeout_lookup() during TCP/UDP/SCTP conntrack handlers; freed objects can be reallocated to obtain arbitrary kernel memory read primitives.\nI:H - UAF of heap-allocated timeout policy data enables heap spraying and object replacement to corrupt adjacent structures or control flow, supporting arbitrary kernel write and local privilege escalation.\nA:H - Concurrent readers of freed timeout policy memory in nf_conntrack_tcp_packet and related handlers can trigger KASAN slab-use-after-free faults and kernel oops or panic, as demonstrated in the closely related nft_ct timeout destroy report."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:45:25.907Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1241e459a1bd17044fa6bbb68f491ab5543c3a1b"
},
{
"url": "https://git.kernel.org/stable/c/b2e84317f334d834fb06c9b340ea465f398b6d4f"
},
{
"url": "https://git.kernel.org/stable/c/44583fd5735cb0bdf3bfe11b1e51504ce387bdb7"
},
{
"url": "https://git.kernel.org/stable/c/9aeb0dcfeb460d33d61d434148b51103ab1d2013"
},
{
"url": "https://git.kernel.org/stable/c/7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549"
}
],
"title": "netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74347",
"datePublished": "2026-08-15T05:58:35.287Z",
"dateReserved": "2026-08-15T05:44:03.886Z",
"dateUpdated": "2026-10-21T12:45:25.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98187 (GCVE-0-2026-98187)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
The PDR_INTERFACE_LIST loop only checks that the record start is within
the entry before reading an entire struct exp_if from it. A truncated
trailing record makes the if_id/variant reads cross the entry boundary
into the heap beyond the EEPROM buffer (verified with a KASAN
reproducer of the loop). The variant also feeds the synth front-end
selection, so this is not only a leak.
Advance only while a full record still fits in the entry.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intersil/p54/eeprom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "162dbe1c285a621eab6a9f2851086b63a0378928",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "70bf34b425fe549a4f6a8d50a319f8f05d1f91c9",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "487f966421014de41e835bbce3feb30b35f4f729",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "bc83c04be042f53869c315b8e1eb5f124959d1d7",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "d44c1badc2dcb042985f7e37f4c448c84548b81f",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "d2fb6b588dc5bbab4f603661e41cd60f0d931628",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "d82492fd0a3fb61963c236521852763238ad3898",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "d8efd84f49379ed28624098821f80e992657d935",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intersil/p54/eeprom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: require a full exp_if record in PDR_INTERFACE_LIST\n\nThe PDR_INTERFACE_LIST loop only checks that the record start is within\nthe entry before reading an entire struct exp_if from it. A truncated\ntrailing record makes the if_id/variant reads cross the entry boundary\ninto the heap beyond the EEPROM buffer (verified with a KASAN\nreproducer of the loop). The variant also feeds the synth front-end\nselection, so this is not only a leak.\n\nAdvance only while a full record still fits in the entry."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:18.735Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/162dbe1c285a621eab6a9f2851086b63a0378928"
},
{
"url": "https://git.kernel.org/stable/c/70bf34b425fe549a4f6a8d50a319f8f05d1f91c9"
},
{
"url": "https://git.kernel.org/stable/c/487f966421014de41e835bbce3feb30b35f4f729"
},
{
"url": "https://git.kernel.org/stable/c/bc83c04be042f53869c315b8e1eb5f124959d1d7"
},
{
"url": "https://git.kernel.org/stable/c/d44c1badc2dcb042985f7e37f4c448c84548b81f"
},
{
"url": "https://git.kernel.org/stable/c/d2fb6b588dc5bbab4f603661e41cd60f0d931628"
},
{
"url": "https://git.kernel.org/stable/c/d82492fd0a3fb61963c236521852763238ad3898"
},
{
"url": "https://git.kernel.org/stable/c/d8efd84f49379ed28624098821f80e992657d935"
}
],
"title": "wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98187",
"datePublished": "2026-10-06T08:44:29.258Z",
"dateReserved": "2026-09-25T10:25:14.323Z",
"dateUpdated": "2026-10-19T09:15:18.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98168 (GCVE-0-2026-98168)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
In cifs_query_reparse_point(), the start >= end check before casting to
struct reparse_data_buffer * only ensures the start pointer is within the
response. It fails to verify that there is enough space remaining for the
fixed 8-byte header of the structure.
If a server provides a DataOffset that leaves less than 8 bytes remaining,
the check passes, but subsequent reads of ReparseTag and ReparseDataLength
will occur out-of-bounds.
Fix this by ensuring the remaining space is at least the size of the
reparse_data_buffer structure before accessing its fields.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 848d78e3625f15de09d34a562dc49a98b78a62f3 Version: 48ca7139ab7f0bbed95ff7a901ea497017769657 Version: 56e84c64fc257a95728ee73165456b025c48d408 Version: 56e84c64fc257a95728ee73165456b025c48d408 Version: 56e84c64fc257a95728ee73165456b025c48d408 Version: c13b779d26b3702fba8f7d5fe757aba5bda85fd0 Version: 6.6.94 ≤ Version: 6.12.34 ≤ Version: 6.15.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifssmb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aa00eead258e4fe8158a3a3e2d65facf06274abd",
"status": "affected",
"version": "848d78e3625f15de09d34a562dc49a98b78a62f3",
"versionType": "git"
},
{
"lessThan": "3d67f155fe5813cfb02a551a9a12d6ea06a902e9",
"status": "affected",
"version": "48ca7139ab7f0bbed95ff7a901ea497017769657",
"versionType": "git"
},
{
"lessThan": "d1152c96a3002e3df6b9a5b007cecaa7b19b4f79",
"status": "affected",
"version": "56e84c64fc257a95728ee73165456b025c48d408",
"versionType": "git"
},
{
"lessThan": "8dc5db3a0e583ea8d31d0613cefd99e93e095c3c",
"status": "affected",
"version": "56e84c64fc257a95728ee73165456b025c48d408",
"versionType": "git"
},
{
"lessThan": "5f0306e731e2f46e91419eae57eee3a241c055e0",
"status": "affected",
"version": "56e84c64fc257a95728ee73165456b025c48d408",
"versionType": "git"
},
{
"status": "affected",
"version": "c13b779d26b3702fba8f7d5fe757aba5bda85fd0",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.94",
"versionType": "semver"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "6.12.34",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifssmb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix reparse buffer bounds in cifs_query_reparse_point()\n\nIn cifs_query_reparse_point(), the start \u003e= end check before casting to\nstruct reparse_data_buffer * only ensures the start pointer is within the\nresponse. It fails to verify that there is enough space remaining for the\nfixed 8-byte header of the structure.\n\nIf a server provides a DataOffset that leaves less than 8 bytes remaining,\nthe check passes, but subsequent reads of ReparseTag and ReparseDataLength\nwill occur out-of-bounds.\n\nFix this by ensuring the remaining space is at least the size of the\nreparse_data_buffer structure before accessing its fields."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:47.190Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aa00eead258e4fe8158a3a3e2d65facf06274abd"
},
{
"url": "https://git.kernel.org/stable/c/3d67f155fe5813cfb02a551a9a12d6ea06a902e9"
},
{
"url": "https://git.kernel.org/stable/c/d1152c96a3002e3df6b9a5b007cecaa7b19b4f79"
},
{
"url": "https://git.kernel.org/stable/c/8dc5db3a0e583ea8d31d0613cefd99e93e095c3c"
},
{
"url": "https://git.kernel.org/stable/c/5f0306e731e2f46e91419eae57eee3a241c055e0"
}
],
"title": "smb: client: fix reparse buffer bounds in cifs_query_reparse_point()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98168",
"datePublished": "2026-10-06T08:44:13.534Z",
"dateReserved": "2026-09-25T10:25:14.321Z",
"dateUpdated": "2026-10-21T12:54:47.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98173 (GCVE-0-2026-98173)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix use-after-free of iface in cifs_try_adding_channels()
cifs_try_adding_channels() iterates ses->iface_list with
list_for_each_entry_safe_from(), which captures the next entry
(niface) under iface_lock. The loop body then drops iface_lock for
the whole duration of cifs_ses_add_channel().
A concurrent interface refresh (SMB3_request_interfaces() ->
parse_server_interfaces()) marks all ifaces inactive and removes and
frees any that are not re-advertised via list_del() + kref_put(),
where release_iface() is a bare kfree(). Since niface typically has
no channel holding a reference, the list reference is its last and it
can be freed inside the unlocked window. On continue, the iterator
advance step then dereferences niface->iface_head.next, and the loop
body reads iface->rdma_capable/is_active, both on freed memory.
Fix this by never keeping an unreferenced list pointer across the
unlocked window. Each channel attempt now re-scans the list from the
head under iface_lock, takes a kref on the selected candidate, and
passes only that referenced candidate to cifs_ses_add_channel().
weight_fulfilled still tracks selection progress, so restarting the
scan preserves the original weighted distribution and the
weight_fulfilled-before-kref_put ordering on the failure path.
Add a per-pass attempts cap so a flapping interface refresh cannot
keep the inner loop spinning within a single tries increment.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/sess.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee0d8f83d68f6e6509f092c997ccab3c8c801538",
"status": "affected",
"version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
"versionType": "git"
},
{
"lessThan": "c941f1ebfd26f683de81091473f3596a218abff0",
"status": "affected",
"version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
"versionType": "git"
},
{
"lessThan": "e99040e5e9c60441e6b4725e1a7b88c3106ae903",
"status": "affected",
"version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
"versionType": "git"
},
{
"lessThan": "ec36b38e65596950e6c29bed7dfc90b98707c19c",
"status": "affected",
"version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
"versionType": "git"
},
{
"lessThan": "d034e836eefd7ce75e588f7031cffbeec594f5ac",
"status": "affected",
"version": "aa45dadd34e44fcd6a9df4b395bee5b5633b4cec",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/sess.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix use-after-free of iface in cifs_try_adding_channels()\n\ncifs_try_adding_channels() iterates ses-\u003eiface_list with\nlist_for_each_entry_safe_from(), which captures the next entry\n(niface) under iface_lock. The loop body then drops iface_lock for\nthe whole duration of cifs_ses_add_channel().\n\nA concurrent interface refresh (SMB3_request_interfaces() -\u003e\nparse_server_interfaces()) marks all ifaces inactive and removes and\nfrees any that are not re-advertised via list_del() + kref_put(),\nwhere release_iface() is a bare kfree(). Since niface typically has\nno channel holding a reference, the list reference is its last and it\ncan be freed inside the unlocked window. On continue, the iterator\nadvance step then dereferences niface-\u003eiface_head.next, and the loop\nbody reads iface-\u003erdma_capable/is_active, both on freed memory.\n\nFix this by never keeping an unreferenced list pointer across the\nunlocked window. Each channel attempt now re-scans the list from the\nhead under iface_lock, takes a kref on the selected candidate, and\npasses only that referenced candidate to cifs_ses_add_channel().\nweight_fulfilled still tracks selection progress, so restarting the\nscan preserves the original weighted distribution and the\nweight_fulfilled-before-kref_put ordering on the failure path.\n\nAdd a per-pass attempts cap so a flapping interface refresh cannot\nkeep the inner loop spinning within a single tries increment."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious SMB server sends the bad data over TCP/445 in its FSCTL_QUERY_NETWORK_INTERFACE_INFO responses. A later response leaves out an interface, so parse_server_interfaces() does list_del() and kref_put() and frees it. cifs_try_adding_channels() still holds niface after dropping iface_lock for cifs_ses_add_channel(), and that pointer now refers to freed memory.\nAC:H - Multichannel is off by default (multichannel=false, max_channels=1), so the victim must mount with multichannel or max_channels\u003e1. The server also has to line up a refresh from the 600s smb2_query_server_interfaces worker with the unlocked add-channel window. It can stall channel setup and force reconnects to retry, but it does not schedule the worker.\nPR:N - The attacker only runs a rogue SMB server and needs no account or privilege on the victim client. The interface list is server-supplied data the client trusts during the session it opened.\nUI:R - A victim or admin has to mount a share from the attacker\u0027s server with multichannel turned on. CIFS mounts are not FS_USERNS_MOUNT, so the attacker cannot set up the client side alone.\nS:U - The memory corruption stays inside the client kernel\u0027s own security authority. No VM or other trust boundary is crossed.\nC:H - The loop continues through freed niface-\u003eiface_head.next and reads iface-\u003erdma_capable, is_active, speed and sockaddr from the freed cifs_server_iface. The attacker can refill that heap object with their own data, which lets the kernel follow attacker-chosen pointers.\nI:H - Once the freed entry is reallocated, the loop does kref_get() and weight_fulfilled++/num_channels++ through the stale or forged iface pointer. That is a kernel write at a location the attacker influences, and cifs_ses_add_channel() then uses the forged object.\nA:H - Dereferencing the freed list entry in cifs_try_adding_channels() can oops or panic the client. The server can force reconnects to re-enter this path repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:49.437Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee0d8f83d68f6e6509f092c997ccab3c8c801538"
},
{
"url": "https://git.kernel.org/stable/c/c941f1ebfd26f683de81091473f3596a218abff0"
},
{
"url": "https://git.kernel.org/stable/c/e99040e5e9c60441e6b4725e1a7b88c3106ae903"
},
{
"url": "https://git.kernel.org/stable/c/ec36b38e65596950e6c29bed7dfc90b98707c19c"
},
{
"url": "https://git.kernel.org/stable/c/d034e836eefd7ce75e588f7031cffbeec594f5ac"
}
],
"title": "smb: client: fix use-after-free of iface in cifs_try_adding_channels()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98173",
"datePublished": "2026-10-06T08:44:17.567Z",
"dateReserved": "2026-09-25T10:25:14.322Z",
"dateUpdated": "2026-10-21T12:54:49.437Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98184 (GCVE-0-2026-98184)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: prevent authentication frame length truncation
mwifiex_cfg80211_authenticate() derives the authentication frame length
from req->ie_len and req->auth_data_len, both of type size_t, but stores
it in a u16.
NL80211_ATTR_AUTH_DATA only has a minimum length policy. Since nla_len is
a u16, a single attribute can carry up to 65531 bytes of payload, so the
sum can exceed U16_MAX before it is assigned to pkt_len. The truncated
pkt_len determines the skb frame area, while the copy length remains
req->auth_data_len - 4, resulting in a heap buffer overflow.
For example, with auth_data_len equal to 65510 and no IEs, the sum is
65546. It is truncated to 10 and then reduced by four to 6. The driver
appends only six bytes to the skb with skb_put(), but then copies 65506
user-provided bytes into the authentication body.
Reaching this path requires CAP_NET_ADMIN in the user namespace owning
the network namespace, an up station netdev, and a suitable BSS/SAE
authentication request.
Compute the length in size_t, reject values that cannot be represented by
the firmware's u16 frame length field, and only then assign it to pkt_len.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/cfg80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "25c45a2075cc00faed45f92a64bb172fb074a2ee",
"status": "affected",
"version": "36995892c271cce5e2230bc165a06f109b117222",
"versionType": "git"
},
{
"lessThan": "5747eaa38a7fcad48be2fd910b65008198b2b06c",
"status": "affected",
"version": "36995892c271cce5e2230bc165a06f109b117222",
"versionType": "git"
},
{
"lessThan": "877b61a67d5eb3e616478daf3908114b57feff1e",
"status": "affected",
"version": "36995892c271cce5e2230bc165a06f109b117222",
"versionType": "git"
},
{
"lessThan": "fa00193eb991f92b007aefe7afb6a7566976dacf",
"status": "affected",
"version": "36995892c271cce5e2230bc165a06f109b117222",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/cfg80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: prevent authentication frame length truncation\n\nmwifiex_cfg80211_authenticate() derives the authentication frame length\nfrom req-\u003eie_len and req-\u003eauth_data_len, both of type size_t, but stores\nit in a u16.\n\nNL80211_ATTR_AUTH_DATA only has a minimum length policy. Since nla_len is\na u16, a single attribute can carry up to 65531 bytes of payload, so the\nsum can exceed U16_MAX before it is assigned to pkt_len. The truncated\npkt_len determines the skb frame area, while the copy length remains\nreq-\u003eauth_data_len - 4, resulting in a heap buffer overflow.\n\nFor example, with auth_data_len equal to 65510 and no IEs, the sum is\n65546. It is truncated to 10 and then reduced by four to 6. The driver\nappends only six bytes to the skb with skb_put(), but then copies 65506\nuser-provided bytes into the authentication body.\n\nReaching this path requires CAP_NET_ADMIN in the user namespace owning\nthe network namespace, an up station netdev, and a suitable BSS/SAE\nauthentication request.\n\nCompute the length in size_t, reject values that cannot be represented by\nthe firmware\u0027s u16 frame length field, and only then assign it to pkt_len."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:15.381Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/25c45a2075cc00faed45f92a64bb172fb074a2ee"
},
{
"url": "https://git.kernel.org/stable/c/5747eaa38a7fcad48be2fd910b65008198b2b06c"
},
{
"url": "https://git.kernel.org/stable/c/877b61a67d5eb3e616478daf3908114b57feff1e"
},
{
"url": "https://git.kernel.org/stable/c/fa00193eb991f92b007aefe7afb6a7566976dacf"
}
],
"title": "wifi: mwifiex: prevent authentication frame length truncation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98184",
"datePublished": "2026-10-06T08:44:26.836Z",
"dateReserved": "2026-09-25T10:25:14.323Z",
"dateUpdated": "2026-10-19T09:15:15.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98363 (GCVE-0-2026-98363)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
scpi_dvfs_get_info() already rejected a zero opp_count, but still trusted
any larger value from the SCP firmware. The shared-memory reply only holds
MAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array
and then sizes the allocated OPP table incorrectly (garbage OPPs / OOB).
The missing upper bound dates back to the original SCPI DVFS support.
Reject zero and out-of-range counts in one check and return -EINVAL.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa Version: 8cb7cf56c9fe5412de238465b27ef35b4d2801aa |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_scpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e9887eeaa138c6b5697af3d2f7c71dc82407b154",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "1aadbef648e92ca642125f188f99b0a26628e3ba",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "7daaa684097377b66b98a832de307688a7f3bbc7",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "f17865332cc4ceaac846bcd7c28badbaedfabeff",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "69ec03cd481973e4be44a7158ed6c0fa06a9a5f9",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "cc563a59aded6f3b02d75dcc3c0bc5e90755d99e",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
},
{
"lessThan": "32471d84a487c7fd74532bc96be56f8028cf4a3f",
"status": "affected",
"version": "8cb7cf56c9fe5412de238465b27ef35b4d2801aa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/arm_scpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS\n\nscpi_dvfs_get_info() already rejected a zero opp_count, but still trusted\nany larger value from the SCP firmware. The shared-memory reply only holds\nMAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array\nand then sizes the allocated OPP table incorrectly (garbage OPPs / OOB).\nThe missing upper bound dates back to the original SCPI DVFS support.\n\nReject zero and out-of-range counts in one check and return -EINVAL."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:15.202Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e9887eeaa138c6b5697af3d2f7c71dc82407b154"
},
{
"url": "https://git.kernel.org/stable/c/1aadbef648e92ca642125f188f99b0a26628e3ba"
},
{
"url": "https://git.kernel.org/stable/c/7daaa684097377b66b98a832de307688a7f3bbc7"
},
{
"url": "https://git.kernel.org/stable/c/f17865332cc4ceaac846bcd7c28badbaedfabeff"
},
{
"url": "https://git.kernel.org/stable/c/0130f9ad3974a5b2ad0fa03d0b300a9fb83ed901"
},
{
"url": "https://git.kernel.org/stable/c/69ec03cd481973e4be44a7158ed6c0fa06a9a5f9"
},
{
"url": "https://git.kernel.org/stable/c/cc563a59aded6f3b02d75dcc3c0bc5e90755d99e"
},
{
"url": "https://git.kernel.org/stable/c/32471d84a487c7fd74532bc96be56f8028cf4a3f"
}
],
"title": "firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98363",
"datePublished": "2026-10-06T08:46:49.235Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:15.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98262 (GCVE-0-2026-98262)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
A user reported that commit 105c42566a55 ("ata: ahci: force 32-bit DMA for
JMicron JMB582/JMB585") made the JMicron JMB585 unusable on his board.
The failure is seen as soon as the ahci driver is probed, and booting with
iommu=off does not solve the problem.
Looking at the AHCI specification, PxCLBU and PxFBU are both read only '0'
for HBAs that do not support 64-bit addressing.
For HBAs that do support 64-bit addressing, the registers are read write,
with a reset value that is Implementation Specific.
When using the AHCI_HFLAG_32BIT_ONLY flag, the HBA does support 64-bit
addressing, and a 32-bit DMA mask is set by simply clearing HOST_CAP_64.
Thus, in this case, we need to explicitly clear the registers to 0.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c Version: c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c Version: c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c Version: c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c Version: c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c Version: c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c Version: c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c Version: c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ata/libahci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0191c9ff23ef1678dbfb5ad253a2dee92feb5d71",
"status": "affected",
"version": "c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c",
"versionType": "git"
},
{
"lessThan": "8f510f68208a1f673d7c7234a687be4671490e9c",
"status": "affected",
"version": "c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c",
"versionType": "git"
},
{
"lessThan": "4719424bb7cb9f20b73986bcb72dd528f0e5c6eb",
"status": "affected",
"version": "c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c",
"versionType": "git"
},
{
"lessThan": "a5a8b4737f68bbac8aa0685af0c8921e6003c22b",
"status": "affected",
"version": "c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c",
"versionType": "git"
},
{
"lessThan": "b28a17d4a9bb0aa38b48681c3927b012ba40eabe",
"status": "affected",
"version": "c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c",
"versionType": "git"
},
{
"lessThan": "b691a3e244278362e552439d6d3ee5a5d3703488",
"status": "affected",
"version": "c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c",
"versionType": "git"
},
{
"lessThan": "7912ad8fb5233bb8cfe21d50df639c7f4854ff9d",
"status": "affected",
"version": "c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c",
"versionType": "git"
},
{
"lessThan": "82e47533221d4746947b74d2e79a478c36c6433a",
"status": "affected",
"version": "c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ata/libahci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY\n\nA user reported that commit 105c42566a55 (\"ata: ahci: force 32-bit DMA for\nJMicron JMB582/JMB585\") made the JMicron JMB585 unusable on his board.\n\nThe failure is seen as soon as the ahci driver is probed, and booting with\niommu=off does not solve the problem.\n\nLooking at the AHCI specification, PxCLBU and PxFBU are both read only \u00270\u0027\nfor HBAs that do not support 64-bit addressing.\n\nFor HBAs that do support 64-bit addressing, the registers are read write,\nwith a reset value that is Implementation Specific.\n\nWhen using the AHCI_HFLAG_32BIT_ONLY flag, the HBA does support 64-bit\naddressing, and a 32-bit DMA mask is set by simply clearing HOST_CAP_64.\nThus, in this case, we need to explicitly clear the registers to 0."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:33.319Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0191c9ff23ef1678dbfb5ad253a2dee92feb5d71"
},
{
"url": "https://git.kernel.org/stable/c/8f510f68208a1f673d7c7234a687be4671490e9c"
},
{
"url": "https://git.kernel.org/stable/c/4719424bb7cb9f20b73986bcb72dd528f0e5c6eb"
},
{
"url": "https://git.kernel.org/stable/c/a5a8b4737f68bbac8aa0685af0c8921e6003c22b"
},
{
"url": "https://git.kernel.org/stable/c/b28a17d4a9bb0aa38b48681c3927b012ba40eabe"
},
{
"url": "https://git.kernel.org/stable/c/b691a3e244278362e552439d6d3ee5a5d3703488"
},
{
"url": "https://git.kernel.org/stable/c/7912ad8fb5233bb8cfe21d50df639c7f4854ff9d"
},
{
"url": "https://git.kernel.org/stable/c/82e47533221d4746947b74d2e79a478c36c6433a"
}
],
"title": "ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98262",
"datePublished": "2026-10-06T08:45:26.118Z",
"dateReserved": "2026-09-25T10:25:14.332Z",
"dateUpdated": "2026-10-19T09:16:33.319Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98340 (GCVE-0-2026-98340)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: only group hidden BSSes with beacon entries
When a probe response for an unknown BSS comes in, __cfg80211_bss_update()
looks for an existing entry with the same BSSID and a hidden (zero-length
or NUL-filled) SSID, and if it finds one it groups them, using the beacon
IEs from the existing entry.
But that could find another entry without a beacon, if it was also from a
probe response (with SSID), so there's a group without beacon elements.
If a beacon with a hidden SSID for that BSSID arrives later,
cfg80211_combine_bsses() goes looking for the probe response entries that
belong to it - i.e. entries with the same BSSID and channel that have no
beacon IEs - and finds those two. They are already grouped with each
other, so it hits its
WARN_ON_ONCE(bss->pub.hidden_beacon_bss)
WARN_ON_ONCE(!list_empty(&bss->hidden_list))
which are there because an entry without beacon elements is not supposed
to be part of a group yet.
Only combine entries when a beacon was already received, ones that are
kept separate will be combined when a beacon arrives.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc Version: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc Version: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc Version: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc Version: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc Version: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc Version: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc Version: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4cd6a518ce7527284bbc9baab5fa2453a7d477c2",
"status": "affected",
"version": "4593c4cbe1c96b3995727dc42f6aa103f4ff5afc",
"versionType": "git"
},
{
"lessThan": "74ed0d992f392c75e1969415527e06df3f7a4034",
"status": "affected",
"version": "4593c4cbe1c96b3995727dc42f6aa103f4ff5afc",
"versionType": "git"
},
{
"lessThan": "3658093df69849daf4f813a8f087f358e13be203",
"status": "affected",
"version": "4593c4cbe1c96b3995727dc42f6aa103f4ff5afc",
"versionType": "git"
},
{
"lessThan": "73365b81630b57e1a1f9d50dc87281797855c2ac",
"status": "affected",
"version": "4593c4cbe1c96b3995727dc42f6aa103f4ff5afc",
"versionType": "git"
},
{
"lessThan": "7405dd19bda4537a2843637d8d7bed1efd4776cf",
"status": "affected",
"version": "4593c4cbe1c96b3995727dc42f6aa103f4ff5afc",
"versionType": "git"
},
{
"lessThan": "86235be788094131912e9bd8412b358d91d99f49",
"status": "affected",
"version": "4593c4cbe1c96b3995727dc42f6aa103f4ff5afc",
"versionType": "git"
},
{
"lessThan": "332ea1502c46f53375cb109fa82bfaff818f3a41",
"status": "affected",
"version": "4593c4cbe1c96b3995727dc42f6aa103f4ff5afc",
"versionType": "git"
},
{
"lessThan": "068843ed0902c552a13860c5ec6b2ca65b57a065",
"status": "affected",
"version": "4593c4cbe1c96b3995727dc42f6aa103f4ff5afc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: only group hidden BSSes with beacon entries\n\nWhen a probe response for an unknown BSS comes in, __cfg80211_bss_update()\nlooks for an existing entry with the same BSSID and a hidden (zero-length\nor NUL-filled) SSID, and if it finds one it groups them, using the beacon\nIEs from the existing entry.\n\nBut that could find another entry without a beacon, if it was also from a\nprobe response (with SSID), so there\u0027s a group without beacon elements.\n\nIf a beacon with a hidden SSID for that BSSID arrives later,\ncfg80211_combine_bsses() goes looking for the probe response entries that\nbelong to it - i.e. entries with the same BSSID and channel that have no\nbeacon IEs - and finds those two. They are already grouped with each\nother, so it hits its\n\n WARN_ON_ONCE(bss-\u003epub.hidden_beacon_bss)\n WARN_ON_ONCE(!list_empty(\u0026bss-\u003ehidden_list))\n\nwhich are there because an entry without beacon elements is not supposed\nto be part of a group yet.\n\nOnly combine entries when a beacon was already received, ones that are\nkept separate will be combined when a beacon arrives."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:51.387Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4cd6a518ce7527284bbc9baab5fa2453a7d477c2"
},
{
"url": "https://git.kernel.org/stable/c/74ed0d992f392c75e1969415527e06df3f7a4034"
},
{
"url": "https://git.kernel.org/stable/c/3658093df69849daf4f813a8f087f358e13be203"
},
{
"url": "https://git.kernel.org/stable/c/73365b81630b57e1a1f9d50dc87281797855c2ac"
},
{
"url": "https://git.kernel.org/stable/c/7405dd19bda4537a2843637d8d7bed1efd4776cf"
},
{
"url": "https://git.kernel.org/stable/c/86235be788094131912e9bd8412b358d91d99f49"
},
{
"url": "https://git.kernel.org/stable/c/332ea1502c46f53375cb109fa82bfaff818f3a41"
},
{
"url": "https://git.kernel.org/stable/c/068843ed0902c552a13860c5ec6b2ca65b57a065"
}
],
"title": "wifi: cfg80211: only group hidden BSSes with beacon entries",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98340",
"datePublished": "2026-10-06T08:46:30.796Z",
"dateReserved": "2026-09-25T10:25:14.342Z",
"dateUpdated": "2026-10-19T09:17:51.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98352 (GCVE-0-2026-98352)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
The client borrows shared CQ credits in the ADDR_RESOLVED handler via
ib_cq_pool_get(), before the peer is connected. create_cm() can return
-ERESTARTSYS from wait_event_interruptible_timeout() without destroying
the CM ID. The init_conns() and stop-and-destroy paths then call
destroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards
rdma_destroy_id().
CMA serializes the handler against rdma_destroy_id() with handler_mutex,
but that does not order the GET against destroy_con_cq_qp(). If
ADDR_RESOLVED has already passed the DESTROYING check, it can take
con_mutex, GET credits, and then lose the con to kfree. Device
unregister later hits WARN_ON(cq->cqe_used) in ib_cq_pool_cleanup().
Set a per-connection flag under con_mutex before CQ/QP teardown so a
racing ADDR_RESOLVED cannot borrow credits after teardown has begun.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3b89e92c2a95a39c38a3808f4528e502a39bd94d Version: 3b89e92c2a95a39c38a3808f4528e502a39bd94d Version: 3b89e92c2a95a39c38a3808f4528e502a39bd94d Version: 3b89e92c2a95a39c38a3808f4528e502a39bd94d Version: 3b89e92c2a95a39c38a3808f4528e502a39bd94d Version: 3b89e92c2a95a39c38a3808f4528e502a39bd94d Version: 3b89e92c2a95a39c38a3808f4528e502a39bd94d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/rtrs/rtrs-clt.c",
"drivers/infiniband/ulp/rtrs/rtrs-clt.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a82cca40139d9fcae8208901856bd5bb4051f097",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
},
{
"lessThan": "74c4ed55e61f1b65ddbebc5b635d136461a1c3da",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
},
{
"lessThan": "6f8020fe7465f49e234a576c04e415e9d08c7878",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
},
{
"lessThan": "31024e158b45358370a0a14ed96589e6aa62d6cb",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
},
{
"lessThan": "8f253d5893f991742464b9e7203c43fc08d0aa11",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
},
{
"lessThan": "bf88ac4867050112a6c819c8d1a7209bf48ef427",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
},
{
"lessThan": "2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/rtrs/rtrs-clt.c",
"drivers/infiniband/ulp/rtrs/rtrs-clt.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted\n\nThe client borrows shared CQ credits in the ADDR_RESOLVED handler via\nib_cq_pool_get(), before the peer is connected. create_cm() can return\n-ERESTARTSYS from wait_event_interruptible_timeout() without destroying\nthe CM ID. The init_conns() and stop-and-destroy paths then call\ndestroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards\nrdma_destroy_id().\n\nCMA serializes the handler against rdma_destroy_id() with handler_mutex,\nbut that does not order the GET against destroy_con_cq_qp(). If\nADDR_RESOLVED has already passed the DESTROYING check, it can take\ncon_mutex, GET credits, and then lose the con to kfree. Device\nunregister later hits WARN_ON(cq-\u003ecqe_used) in ib_cq_pool_cleanup().\n\nSet a per-connection flag under con_mutex before CQ/QP teardown so a\nracing ADDR_RESOLVED cannot borrow credits after teardown has begun."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:03.073Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a82cca40139d9fcae8208901856bd5bb4051f097"
},
{
"url": "https://git.kernel.org/stable/c/74c4ed55e61f1b65ddbebc5b635d136461a1c3da"
},
{
"url": "https://git.kernel.org/stable/c/6f8020fe7465f49e234a576c04e415e9d08c7878"
},
{
"url": "https://git.kernel.org/stable/c/31024e158b45358370a0a14ed96589e6aa62d6cb"
},
{
"url": "https://git.kernel.org/stable/c/8f253d5893f991742464b9e7203c43fc08d0aa11"
},
{
"url": "https://git.kernel.org/stable/c/bf88ac4867050112a6c819c8d1a7209bf48ef427"
},
{
"url": "https://git.kernel.org/stable/c/2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda"
}
],
"title": "RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98352",
"datePublished": "2026-10-06T08:46:40.151Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-19T09:18:03.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98197 (GCVE-0-2026-98197)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
When the fan/pwm 4-5 pins are not used as GPIO, w83791d_probe()
creates the w83791d_group_fanpwm45 sysfs group on the I2C client
device.
The probe error path removes this group when a later initialization
step fails, but the normal remove path only removes w83791d_group.
As a result, the optional fan/pwm 4-5 sysfs files can remain after the
driver is unbound.
The callbacks associated with these files access the driver data,
which is devm allocated and released after driver unbind. Leaving the
sysfs files behind can therefore result in accesses to stale driver
data.
Remove w83791d_group_fanpwm45 during normal teardown as well.
This issue was found by manual code inspection.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6e1ecd9b8f1358ed4d099f0c54434240dc40debe Version: 6e1ecd9b8f1358ed4d099f0c54434240dc40debe Version: 6e1ecd9b8f1358ed4d099f0c54434240dc40debe Version: 6e1ecd9b8f1358ed4d099f0c54434240dc40debe Version: 6e1ecd9b8f1358ed4d099f0c54434240dc40debe Version: 6e1ecd9b8f1358ed4d099f0c54434240dc40debe Version: 6e1ecd9b8f1358ed4d099f0c54434240dc40debe Version: 6e1ecd9b8f1358ed4d099f0c54434240dc40debe |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/w83791d.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "081e3a78453635fb370b1712809d2af29e60b4c5",
"status": "affected",
"version": "6e1ecd9b8f1358ed4d099f0c54434240dc40debe",
"versionType": "git"
},
{
"lessThan": "b1d419eb3bc41245c3d3d99dfe1a7b6c45989586",
"status": "affected",
"version": "6e1ecd9b8f1358ed4d099f0c54434240dc40debe",
"versionType": "git"
},
{
"lessThan": "2ccf6c512290a288a2d4d7f076430dfb0c6ee476",
"status": "affected",
"version": "6e1ecd9b8f1358ed4d099f0c54434240dc40debe",
"versionType": "git"
},
{
"lessThan": "f6e2ab72f32d16d71a2549c7ea062dd209f71670",
"status": "affected",
"version": "6e1ecd9b8f1358ed4d099f0c54434240dc40debe",
"versionType": "git"
},
{
"lessThan": "2dd37d00f1f1af8e02ffa70ee573c10fd1a76864",
"status": "affected",
"version": "6e1ecd9b8f1358ed4d099f0c54434240dc40debe",
"versionType": "git"
},
{
"lessThan": "2c381e6e0f033f2df13bd64905e7232c42f49009",
"status": "affected",
"version": "6e1ecd9b8f1358ed4d099f0c54434240dc40debe",
"versionType": "git"
},
{
"lessThan": "583e04e88e75b8d57304015d83c38e82a9531600",
"status": "affected",
"version": "6e1ecd9b8f1358ed4d099f0c54434240dc40debe",
"versionType": "git"
},
{
"lessThan": "0ff9c7775e51ac6d47b1bb5c46f06b1434fe58a8",
"status": "affected",
"version": "6e1ecd9b8f1358ed4d099f0c54434240dc40debe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/w83791d.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.28"
},
{
"lessThan": "2.6.28",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove\n\nWhen the fan/pwm 4-5 pins are not used as GPIO, w83791d_probe()\ncreates the w83791d_group_fanpwm45 sysfs group on the I2C client\ndevice.\n\nThe probe error path removes this group when a later initialization\nstep fails, but the normal remove path only removes w83791d_group.\nAs a result, the optional fan/pwm 4-5 sysfs files can remain after the\ndriver is unbound.\n\nThe callbacks associated with these files access the driver data,\nwhich is devm allocated and released after driver unbind. Leaving the\nsysfs files behind can therefore result in accesses to stale driver\ndata.\n\nRemove w83791d_group_fanpwm45 during normal teardown as well.\n\nThis issue was found by manual code inspection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The trigger is a local read (or write) of the w83791d_group_fanpwm45 files (fan4_input, fan5_input, pwm4, pwm5...) that w83791d_remove() left on the I2C client kobject. These are sysfs files on a local hwmon I2C chip; no remote protocol carries any data into this path.\nAC:H - The files only go stale after the driver is unbound or the module is unloaded, which takes real root via /sys/bus/i2c/drivers/w83791d/unbind or rmmod. It also needs W83791D hardware with fan4/5 pins not set as GPIO (GPIO reg bit 0x10). The attacker cannot arrange either and can only wait for them.\nPR:L - Once the files are stale, fan4_input/fan5_input and the other fanpwm45 show attributes are S_IRUGO, so any unprivileged local user can read them and reach show_fan() -\u003e w83791d_update_device(). The 0644 store attributes stay root-only.\nUI:N - Apart from the admin unbind already counted under AC, the attacker only needs to read the stale sysfs attributes. No victim has to open a file, mount anything or take any other action.\nS:U - The stale accesses corrupt kernel memory (devm-allocated w83791d_data or freed module text/data) in the same kernel that hosts the driver. No VM, IOMMU or sandbox boundary is crossed.\nC:H - A read racing unbind\u0027s devres_release_all() runs w83791d_update_device() on the freed devm w83791d_data, which is a use-after-free of a kmalloc object. After rmmod, the leftover kernfs nodes point to freed module attribute structs and show callbacks. Either can be groomed into a memory disclosure.\nI:H - w83791d_update_device() writes register values into the freed object (data-\u003ein[], fan[], fan_min[], valid, last_updated) after taking its mutex, which is a UAF write. After rmmod, the stale attributes make an indirect call through freed module memory, a possible control-flow hijack if that memory is reallocated.\nA:H - Once unbind has set drvdata to NULL, any user reading fan4_input calls mutex_lock(\u0026data-\u003eupdate_lock) on a NULL pointer and the kernel oopses. After module unload, reading the attribute jumps into unmapped module memory. Both can be repeated at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:28.363Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/081e3a78453635fb370b1712809d2af29e60b4c5"
},
{
"url": "https://git.kernel.org/stable/c/b1d419eb3bc41245c3d3d99dfe1a7b6c45989586"
},
{
"url": "https://git.kernel.org/stable/c/2ccf6c512290a288a2d4d7f076430dfb0c6ee476"
},
{
"url": "https://git.kernel.org/stable/c/f6e2ab72f32d16d71a2549c7ea062dd209f71670"
},
{
"url": "https://git.kernel.org/stable/c/2dd37d00f1f1af8e02ffa70ee573c10fd1a76864"
},
{
"url": "https://git.kernel.org/stable/c/2c381e6e0f033f2df13bd64905e7232c42f49009"
},
{
"url": "https://git.kernel.org/stable/c/583e04e88e75b8d57304015d83c38e82a9531600"
},
{
"url": "https://git.kernel.org/stable/c/0ff9c7775e51ac6d47b1bb5c46f06b1434fe58a8"
}
],
"title": "hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98197",
"datePublished": "2026-10-06T08:44:36.283Z",
"dateReserved": "2026-09-25T10:25:14.324Z",
"dateUpdated": "2026-10-19T09:15:28.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98335 (GCVE-0-2026-98335)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: abort chanswitch when leaving a mesh
The code in ieee80211_stop_mesh() leaves CSA active, but leaving
the mesh released the channel context, so the CSA finalize work
crashes:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000003
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
RIP: 0010:ieee80211_put_srates_elem+0x42/0x640 net/mac80211/util.c:3272
Call Trace:
ieee80211_mesh_build_beacon+0xa83/0x1b50 net/mac80211/mesh.c:1093
ieee80211_mesh_rebuild_beacon+0xc7/0x170 net/mac80211/mesh.c:1147
ieee80211_mesh_finish_csa+0x131/0x210 net/mac80211/mesh.c:1542
ieee80211_set_after_csa_beacon net/mac80211/cfg.c:4085 [inline]
__ieee80211_csa_finalize net/mac80211/cfg.c:4133 [inline]
ieee80211_csa_finalize+0x633/0x1150 net/mac80211/cfg.c:4155
cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438
Abort the channel switch properly.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/mesh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bc544ef02327edf61c94d2b6bae9d14b217009b2",
"status": "affected",
"version": "b8456a14e9d2770846fcf74de18ff95b676149a3",
"versionType": "git"
},
{
"lessThan": "2e1d6e80148495e728a85a9250176f266312e55c",
"status": "affected",
"version": "b8456a14e9d2770846fcf74de18ff95b676149a3",
"versionType": "git"
},
{
"lessThan": "d222fdc973bb8dbf0357772bd9042ffdc8291939",
"status": "affected",
"version": "b8456a14e9d2770846fcf74de18ff95b676149a3",
"versionType": "git"
},
{
"lessThan": "ac7472a24bd433b81c06582835dd1d5547c10da9",
"status": "affected",
"version": "b8456a14e9d2770846fcf74de18ff95b676149a3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/mesh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: abort chanswitch when leaving a mesh\n\nThe code in ieee80211_stop_mesh() leaves CSA active, but leaving\nthe mesh released the channel context, so the CSA finalize work\ncrashes:\n\n Oops: general protection fault, probably for non-canonical address\n 0xdffffc0000000003\n KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]\n RIP: 0010:ieee80211_put_srates_elem+0x42/0x640 net/mac80211/util.c:3272\n Call Trace:\n ieee80211_mesh_build_beacon+0xa83/0x1b50 net/mac80211/mesh.c:1093\n ieee80211_mesh_rebuild_beacon+0xc7/0x170 net/mac80211/mesh.c:1147\n ieee80211_mesh_finish_csa+0x131/0x210 net/mac80211/mesh.c:1542\n ieee80211_set_after_csa_beacon net/mac80211/cfg.c:4085 [inline]\n __ieee80211_csa_finalize net/mac80211/cfg.c:4133 [inline]\n ieee80211_csa_finalize+0x633/0x1150 net/mac80211/cfg.c:4155\n cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438\n\nAbort the channel switch properly."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:46.461Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bc544ef02327edf61c94d2b6bae9d14b217009b2"
},
{
"url": "https://git.kernel.org/stable/c/2e1d6e80148495e728a85a9250176f266312e55c"
},
{
"url": "https://git.kernel.org/stable/c/d222fdc973bb8dbf0357772bd9042ffdc8291939"
},
{
"url": "https://git.kernel.org/stable/c/ac7472a24bd433b81c06582835dd1d5547c10da9"
}
],
"title": "wifi: mac80211: abort chanswitch when leaving a mesh",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98335",
"datePublished": "2026-10-06T08:46:26.816Z",
"dateReserved": "2026-09-25T10:25:14.342Z",
"dateUpdated": "2026-10-19T09:17:46.461Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98374 (GCVE-0-2026-98374)
Vulnerability from cvelistv5
Published
2026-10-07 13:01
Modified
2026-10-24 14:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
When tcp_send_synack() replaces the cloned SYN skb at the head of the
retransmit queue with a copy, it frees the original with
tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.
tp->retransmit_skb_hint keeps pointing at the freed
skbuff_fclone_cache object.
The dangling hint is read in tcp_verify_retransmit_hint() and used as
the root of the rbtree walk in tcp_xmit_retransmit_queue(). An
unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with
an attacker-supplied ICMP fragmentation-needed message, after which a
simultaneous open frees the armed SYN skb:
BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
Read of size 4 at addr ffff88800604d928 by task swapper/1/0
Call Trace:
tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)
tcp_v4_err (net/ipv4/tcp_ipv4.c:587)
Sync the hint to the copy.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c31b70c9968fe9c4194d1b5d06d07596a3b680de Version: c31b70c9968fe9c4194d1b5d06d07596a3b680de Version: c31b70c9968fe9c4194d1b5d06d07596a3b680de Version: c31b70c9968fe9c4194d1b5d06d07596a3b680de Version: c31b70c9968fe9c4194d1b5d06d07596a3b680de Version: c31b70c9968fe9c4194d1b5d06d07596a3b680de Version: c31b70c9968fe9c4194d1b5d06d07596a3b680de |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fad6d429651e748365e93ca54645accc212f0018",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "c5b4da1f403a658c1c19766be2b426003ada419f",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "71d45049b0d631dfdbf3c65305f7fca676de023b",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "e3ea71cb1408a013ed4e8a757b815f1a919324bd",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "631aa4cb45099f09e9385dd786bd291c6270bfc4",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "0f87720c7e4bcab07c24888b3cf12bfe857bb90e",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
},
{
"lessThan": "fe99bbeee5c5dbd3abc30721a8079ced59649d97",
"status": "affected",
"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()\n\nWhen tcp_send_synack() replaces the cloned SYN skb at the head of the\nretransmit queue with a copy, it frees the original with\ntcp_rtx_queue_unlink_and_free() and only repairs tp-\u003ehighest_sack.\ntp-\u003eretransmit_skb_hint keeps pointing at the freed\nskbuff_fclone_cache object.\n\nThe dangling hint is read in tcp_verify_retransmit_hint() and used as\nthe root of the rbtree walk in tcp_xmit_retransmit_queue(). An\nunprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with\nan attacker-supplied ICMP fragmentation-needed message, after which a\nsimultaneous open frees the armed SYN skb:\n\n BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n Read of size 4 at addr ffff88800604d928 by task swapper/1/0\n Call Trace:\n tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)\n tcp_v4_err (net/ipv4/tcp_ipv4.c:587)\n\nSync the hint to the copy."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious IPv4 peer supplies fragmentation-needed ICMP messages quoting the client\u0027s TFO SYN and an ACK-less crossed TCP SYN; ip_rcv() dispatches these through tcp_v4_err() and tcp_rcv_state_process() to the patched tcp_send_synack().\nAC:L - After the victim\u0027s TFO send, the peer controls packet ordering: ICMP makes tcp_simple_retransmit() cache and clone the SYN, then the crossed SYN makes tcp_send_synack() free it; a later PMTU event dereferences the stale hint without requiring a race or external failure.\nPR:N - The ordinary TCP and ICMP paths require only a matching tuple and quoted sequence, not authentication or target privileges; a peer that received the TFO SYN knows the values checked by tcp_v4_err() and the TCP socket lookup.\nUI:R - A victim-side process must issue sendmsg(MSG_FASTOPEN) with data and a usable cookie or no-cookie mode to establish tp-\u003esyn_data in TCP_SYN_SENT; remote packets alone cannot construct this vulnerable retransmit queue state.\nS:U - The freed skb, retransmit tree, and subsequent stale accesses all belong to the same host kernel TCP security authority; tcp_send_synack() does not cross a VM, IOMMU, or sandbox boundary.\nC:H - retransmit_skb_hint retains a freed skbuff_fclone_cache address, and tcp_verify_retransmit_hint() reads its TCP control block while tcp_xmit_retransmit_queue() follows its rbnode links, permitting attacker-influenced stale-object reads after slab reuse.\nI:H - tcp_xmit_retransmit_queue() can treat the reclaimed object as a live skb and pass it into retransmission code that modifies skb control and header state; attacker-shaped reuse of the stale rbnode and skb fields makes this UAF exploitable for kernel memory corruption.\nA:H - The demonstrated stale TCP_SKB_CB read already triggers KASAN in tcp_mark_skb_lost(), while using the freed object as an rbtree-walk root can dereference invalid links and cause a kernel oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:08:34.914Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fad6d429651e748365e93ca54645accc212f0018"
},
{
"url": "https://git.kernel.org/stable/c/c5b4da1f403a658c1c19766be2b426003ada419f"
},
{
"url": "https://git.kernel.org/stable/c/71d45049b0d631dfdbf3c65305f7fca676de023b"
},
{
"url": "https://git.kernel.org/stable/c/e3ea71cb1408a013ed4e8a757b815f1a919324bd"
},
{
"url": "https://git.kernel.org/stable/c/631aa4cb45099f09e9385dd786bd291c6270bfc4"
},
{
"url": "https://git.kernel.org/stable/c/0f87720c7e4bcab07c24888b3cf12bfe857bb90e"
},
{
"url": "https://git.kernel.org/stable/c/fe99bbeee5c5dbd3abc30721a8079ced59649d97"
}
],
"title": "tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98374",
"datePublished": "2026-10-07T13:01:48.600Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-24T14:08:34.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98169 (GCVE-0-2026-98169)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix potential OOB read in smb3_enum_snapshots()
If snapshot_array_size is smaller than GMT_TOKEN_SIZE,
smb3_enum_snapshots() sets ret_data_len to
sizeof(struct smb_snapshot_array) without verifying the actual length
of the server's reply.
Because SMB2_ioctl() places no lower bound on the server-supplied
OutputCount and allocates retbuf to exactly that length, a short reply
results in ret_data_len exceeding the size of retbuf. The subsequent
copy_to_user() then reads past the end of retbuf, leaking adjacent slab
memory to userspace. The subsequent clamp check is ineffective as it
only reduces ret_data_len.
Fix this by rejecting replies shorter than
sizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set
to the 12-byte struct size rather than the 16-byte
MIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes
is exactly what copy_to_user() attempts to read.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e02789a53d71334b067ad72eee5d4e88a0158083 Version: e02789a53d71334b067ad72eee5d4e88a0158083 Version: e02789a53d71334b067ad72eee5d4e88a0158083 Version: e02789a53d71334b067ad72eee5d4e88a0158083 Version: e02789a53d71334b067ad72eee5d4e88a0158083 Version: e02789a53d71334b067ad72eee5d4e88a0158083 Version: a94703ff8e3647f8a9a3a92a468450299a7b77e9 Version: 82a856f527334ffd69aae26e7dd9e03b19c4a520 Version: 25b981bfe192fd208ba04c81f4aa30ffb5141660 Version: 4.9.125 ≤ Version: 4.14.68 ≤ Version: 4.18.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "15a221c734b9d044ab769e7e3606b2cab96fb65a",
"status": "affected",
"version": "e02789a53d71334b067ad72eee5d4e88a0158083",
"versionType": "git"
},
{
"lessThan": "74995ee8305a7c4d76ee70d6acd996a75eda3c03",
"status": "affected",
"version": "e02789a53d71334b067ad72eee5d4e88a0158083",
"versionType": "git"
},
{
"lessThan": "210f0f1f67817e7d2348b86b5115a9b85ef5c98b",
"status": "affected",
"version": "e02789a53d71334b067ad72eee5d4e88a0158083",
"versionType": "git"
},
{
"lessThan": "1cdf0d304d820fb13bf0faf532c3459600f9ea43",
"status": "affected",
"version": "e02789a53d71334b067ad72eee5d4e88a0158083",
"versionType": "git"
},
{
"lessThan": "dbe452a905dfe2804647530a9ff3d7e3826ed04d",
"status": "affected",
"version": "e02789a53d71334b067ad72eee5d4e88a0158083",
"versionType": "git"
},
{
"lessThan": "4775c3b7a597907e0b97556c7986fda238a377ae",
"status": "affected",
"version": "e02789a53d71334b067ad72eee5d4e88a0158083",
"versionType": "git"
},
{
"status": "affected",
"version": "a94703ff8e3647f8a9a3a92a468450299a7b77e9",
"versionType": "git"
},
{
"status": "affected",
"version": "82a856f527334ffd69aae26e7dd9e03b19c4a520",
"versionType": "git"
},
{
"status": "affected",
"version": "25b981bfe192fd208ba04c81f4aa30ffb5141660",
"versionType": "git"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.125",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.68",
"versionType": "semver"
},
{
"lessThan": "4.19",
"status": "affected",
"version": "4.18.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.125",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.18.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential OOB read in smb3_enum_snapshots()\n\nIf snapshot_array_size is smaller than GMT_TOKEN_SIZE,\nsmb3_enum_snapshots() sets ret_data_len to\nsizeof(struct smb_snapshot_array) without verifying the actual length\nof the server\u0027s reply.\n\nBecause SMB2_ioctl() places no lower bound on the server-supplied\nOutputCount and allocates retbuf to exactly that length, a short reply\nresults in ret_data_len exceeding the size of retbuf. The subsequent\ncopy_to_user() then reads past the end of retbuf, leaking adjacent slab\nmemory to userspace. The subsequent clamp check is ineffective as it\nonly reduces ret_data_len.\n\nFix this by rejecting replies shorter than\nsizeof(struct smb_snapshot_array) with -EIO. Note that the bound is set\nto the 12-byte struct size rather than the 16-byte\nMIN_SNAPSHOT_ARRAY_SIZE defined in MS-SMB2 3.3.5.15.1, because 12 bytes\nis exactly what copy_to_user() attempts to read."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bad input is the OutputCount field of the SMB2 IOCTL response to FSCTL_SRV_ENUMERATE_SNAPSHOTS, sent by the SMB server over TCP. SMB2_ioctl() rejects only 0 or oversized values and kmemdup()s 1-11 bytes, and smb3_enum_snapshots() then copies 12 bytes from that buffer.\nAC:L - A server that always answers the snapshot FSCTL with OutputCount 1-11 hits the bug every time a caller passes snapshot_array_size \u003c GMT_TOKEN_SIZE, which is the normal first sizing query. No race or memory layout outside the server\u0027s control is needed.\nPR:N - The attacker is the SMB server answering the client\u0027s request. It needs no account or privilege on the client to send a short IOCTL response.\nUI:R - A victim has to mount the attacker\u0027s share, and a process on the client has to issue ioctl(CIFS_ENUMERATE_SNAPSHOTS) on a file there to make smb3_enum_snapshots() run.\nS:U - The out-of-bounds read and the crash both stay inside the client kernel. No VM, IOMMU or other security boundary is crossed.\nC:L - copy_to_user() reads at most 11 bytes past the kmemdup\u0027d retbuf, from the next kmalloc-8 object or the unused tail of a kmalloc-16 object. The leak is small and fixed in size, and it goes to the ioctl caller, not back over the wire.\nI:N - The defect is a read only: retbuf is copied out to user space, and no kernel memory is written out of bounds.\nA:H - With CONFIG_HARDENED_USERCOPY (common on distro and Android kernels), a 12-byte copy_to_user() from a kmalloc-8 retbuf (OutputCount 1-8) fails the heap object check. usercopy_abort() then calls BUG() and the kernel oopses, or panics if panic_on_oops is set. The server can trigger this on every enumeration."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:00.713Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/15a221c734b9d044ab769e7e3606b2cab96fb65a"
},
{
"url": "https://git.kernel.org/stable/c/74995ee8305a7c4d76ee70d6acd996a75eda3c03"
},
{
"url": "https://git.kernel.org/stable/c/210f0f1f67817e7d2348b86b5115a9b85ef5c98b"
},
{
"url": "https://git.kernel.org/stable/c/1cdf0d304d820fb13bf0faf532c3459600f9ea43"
},
{
"url": "https://git.kernel.org/stable/c/dbe452a905dfe2804647530a9ff3d7e3826ed04d"
},
{
"url": "https://git.kernel.org/stable/c/4775c3b7a597907e0b97556c7986fda238a377ae"
}
],
"title": "smb: client: fix potential OOB read in smb3_enum_snapshots()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98169",
"datePublished": "2026-10-06T08:44:14.339Z",
"dateReserved": "2026-09-25T10:25:14.322Z",
"dateUpdated": "2026-10-19T09:15:00.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98186 (GCVE-0-2026-98186)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
mwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a
beacon/probe-response RSN or WPA information element and then walks that
many 4-byte OUIs, comparing each with memcmp(). The count comes straight
from the (attacker-supplied) IE and is never checked against the
element's own length, and the callers admit the element on element_id
alone (has_ieee_hdr() / has_vendor_hdr(), no length check). A crafted
RSN/WPA IE with a large pairwise count therefore makes the walk read up
to 255 * 4 bytes past the element -- an out-of-bounds read of the
kmemdup()'d beacon buffer, reachable from any AP whose beacon/probe
response is processed during scan-result parsing.
Pass the number of IE bytes available at the OUI list and bound the walk
to the element. Keep the length signed and reject a negative value
before any unsigned arithmetic, so a small or zero IE length cannot
underflow to a large size_t and defeat the bound.
Found by 0sec automated security-research tooling (https://0sec.ai).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "77e642af7f2f6029e12a35c847c56cbd0466e799",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "58767b41f87244eebaa5a475b9d276c83b89b933",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "2402c9e2644b7e10c7aaaf87bf12743d7e363559",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "54a9cc5bd70b0d77a5069d4c46998c679a10c857",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "e667aee1c192d67d27c803007bfa9c6e0873e959",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length\n\nmwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a\nbeacon/probe-response RSN or WPA information element and then walks that\nmany 4-byte OUIs, comparing each with memcmp(). The count comes straight\nfrom the (attacker-supplied) IE and is never checked against the\nelement\u0027s own length, and the callers admit the element on element_id\nalone (has_ieee_hdr() / has_vendor_hdr(), no length check). A crafted\nRSN/WPA IE with a large pairwise count therefore makes the walk read up\nto 255 * 4 bytes past the element -- an out-of-bounds read of the\nkmemdup()\u0027d beacon buffer, reachable from any AP whose beacon/probe\nresponse is processed during scan-result parsing.\n\nPass the number of IE bytes available at the OUI list and bound the walk\nto the element. Keep the length signed and reject a negative value\nbefore any unsigned arithmetic, so a small or zero IE length cannot\nunderflow to a large size_t and defeat the bound.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:17.749Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/77e642af7f2f6029e12a35c847c56cbd0466e799"
},
{
"url": "https://git.kernel.org/stable/c/982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed"
},
{
"url": "https://git.kernel.org/stable/c/58767b41f87244eebaa5a475b9d276c83b89b933"
},
{
"url": "https://git.kernel.org/stable/c/2402c9e2644b7e10c7aaaf87bf12743d7e363559"
},
{
"url": "https://git.kernel.org/stable/c/54a9cc5bd70b0d77a5069d4c46998c679a10c857"
},
{
"url": "https://git.kernel.org/stable/c/8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960"
},
{
"url": "https://git.kernel.org/stable/c/46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df"
},
{
"url": "https://git.kernel.org/stable/c/e667aee1c192d67d27c803007bfa9c6e0873e959"
}
],
"title": "wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98186",
"datePublished": "2026-10-06T08:44:28.429Z",
"dateReserved": "2026-09-25T10:25:14.323Z",
"dateUpdated": "2026-10-19T09:15:17.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98230 (GCVE-0-2026-98230)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: use hlist_del_init_rcu for state_cache and state_cache_input
Commit 14acf9652e56 ("xfrm: defensively unhash xfrm_state lists in
__xfrm_state_delete") converted bydst/bysrc/byseq/byspi from
hlist_del_rcu() to hlist_del_init_rcu() so that a second
__xfrm_state_delete() on the same object becomes a no-op rather than a
write through LIST_POISON pprev. It missed state_cache and
state_cache_input, which kept hlist_del_rcu():
- hlist_del_rcu() leaves pprev = LIST_POISON2 (non-NULL), so
hlist_unhashed() returns false.
- hlist_del_init_rcu() leaves pprev = NULL, so hlist_unhashed()
returns true.
A second __xfrm_state_delete() therefore enters __hlist_del() on the
already-deleted state_cache/state_cache_input nodes and does
WRITE_ONCE(*pprev, next) through LIST_POISON2 — a write use-after-free
once the slab is reused. The corruption can in turn cause a subsequent
hlist_for_each_entry_rcu traversal to follow a dangling next pointer,
producing the read use-after-free reported in xfrm_input_state_lookup().
Switch state_cache and state_cache_input to hlist_del_init_rcu() to
match the other four lists, closing the write use-after-free and, with
it, the read use-after-free it spawns.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: aa48a18fdb0911572d133057cd579db704b87da4 Version: 0045e3d80613cc7174dc15f189ee6fc4e73b9365 Version: 0045e3d80613cc7174dc15f189ee6fc4e73b9365 Version: 0045e3d80613cc7174dc15f189ee6fc4e73b9365 Version: 5e4334dc39443645415450163ff5ff1ee7e79784 Version: 6.12.13 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb38fb7420d5f7192f9e2b6ac835ede149cd7ac5",
"status": "affected",
"version": "aa48a18fdb0911572d133057cd579db704b87da4",
"versionType": "git"
},
{
"lessThan": "4748c27e2e6a1969e02f1df46e62f79d2799b80b",
"status": "affected",
"version": "0045e3d80613cc7174dc15f189ee6fc4e73b9365",
"versionType": "git"
},
{
"lessThan": "9b74a47a4cbd0d29faff4f3b199212c73e6b6220",
"status": "affected",
"version": "0045e3d80613cc7174dc15f189ee6fc4e73b9365",
"versionType": "git"
},
{
"lessThan": "2afb8dc1f4390f164db8352f8e685e126e9db566",
"status": "affected",
"version": "0045e3d80613cc7174dc15f189ee6fc4e73b9365",
"versionType": "git"
},
{
"status": "affected",
"version": "5e4334dc39443645415450163ff5ff1ee7e79784",
"versionType": "git"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "6.12.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: use hlist_del_init_rcu for state_cache and state_cache_input\n\nCommit 14acf9652e56 (\"xfrm: defensively unhash xfrm_state lists in\n__xfrm_state_delete\") converted bydst/bysrc/byseq/byspi from\nhlist_del_rcu() to hlist_del_init_rcu() so that a second\n__xfrm_state_delete() on the same object becomes a no-op rather than a\nwrite through LIST_POISON pprev. It missed state_cache and\nstate_cache_input, which kept hlist_del_rcu():\n\n- hlist_del_rcu() leaves pprev = LIST_POISON2 (non-NULL), so\n hlist_unhashed() returns false.\n- hlist_del_init_rcu() leaves pprev = NULL, so hlist_unhashed()\n returns true.\n\nA second __xfrm_state_delete() therefore enters __hlist_del() on the\nalready-deleted state_cache/state_cache_input nodes and does\nWRITE_ONCE(*pprev, next) through LIST_POISON2 \u2014 a write use-after-free\nonce the slab is reused. The corruption can in turn cause a subsequent\nhlist_for_each_entry_rcu traversal to follow a dangling next pointer,\nproducing the read use-after-free reported in xfrm_input_state_lookup().\n\nSwitch state_cache and state_cache_input to hlist_del_init_rcu() to\nmatch the other four lists, closing the write use-after-free and, with\nit, the read use-after-free it spawns."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bad unlink is in __xfrm_state_delete(), reached when SAs are removed via XFRM_MSG_DELSA/FLUSHSA/EXPIRE over NETLINK_XFRM or the af_key socket, or via xfrm_timer_handler expiry. ESP packets only walk state_cache_input in xfrm_input_state_lookup() and carry no malformed data that causes the double unlink, so the vector is local.\nAC:H - A second unlink needs __xfrm_state_delete() to see a non-DEAD state that was already removed, but every caller holds x-\u003elock and checks km.state. The only path found that skips the VALID check is mlx5e_ipsec_handle_event(), which calls xfrm_state_check_expire() on a hardware hard-limit event and needs mlx5 packet offload, so the attacker cannot reliably arrange it.\nPR:L - Adding, expiring and flushing SAs over NETLINK_XFRM needs CAP_NET_ADMIN only in the user namespace that owns the netns. An unprivileged user gets it with unshare -Urn, and each netns has its own state_cache_input percpu lists and xfrm_state_lock.\nUI:N - The attacker drives the SA lifecycle (add, expire, delete, flush) and the traffic that fills the state caches themselves. No other user has to do anything.\nS:U - The corrupted hlist nodes are inside struct xfrm_state in kernel slab memory, so the impact stays within the kernel\u0027s own security authority.\nC:H - After the stale-pprev unlink, the state_cache_input chain can keep a freed xfrm_state, which hlist_for_each_entry_rcu in xfrm_input_state_lookup() then dereferences (the read UAF the commit reports). With slab reuse, an attacker can control the contents of that object.\nI:H - __hlist_del() on an already-unlinked state_cache/state_cache_input node does WRITE_ONCE(*pprev, next) through a stale pointer, a write use-after-free into reused slab memory that corrupts RCU hash-chain linkage.\nA:H - Writing through LIST_POISON2, or walking the corrupted per-CPU state_cache_input or policy state_cache_list chain, causes a general protection fault or KASAN oops in softirq or netns cleanup context, which takes down the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:02.121Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb38fb7420d5f7192f9e2b6ac835ede149cd7ac5"
},
{
"url": "https://git.kernel.org/stable/c/4748c27e2e6a1969e02f1df46e62f79d2799b80b"
},
{
"url": "https://git.kernel.org/stable/c/9b74a47a4cbd0d29faff4f3b199212c73e6b6220"
},
{
"url": "https://git.kernel.org/stable/c/2afb8dc1f4390f164db8352f8e685e126e9db566"
}
],
"title": "xfrm: use hlist_del_init_rcu for state_cache and state_cache_input",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98230",
"datePublished": "2026-10-06T08:45:04.548Z",
"dateReserved": "2026-09-25T10:25:14.328Z",
"dateUpdated": "2026-10-19T09:16:02.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97531 (GCVE-0-2026-97531)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Skip vport under deletion in report ID acquisition
qla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under
vport_slock, takes a vref_count on the matching vport and calls
qla_update_host_map() to register its port id.
A vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then
qla24xx_disable_vp() removes the vport from the host_map btree and zeroes
vha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later,
in qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX)
but does not touch host_map. In the window in between, report ID
acquisition can still find the vport on vp_list and call
qla_update_host_map(); with d_id already zeroed it takes the
btree_insert32() path and re-inserts the dying vport into host_map.
Nothing cleans that entry afterwards, so once scsi_host_put() frees the
vha a later host_map lookup dereferences freed memory.
Skip a vport that has VPORT_DELETE set before taking the reference, so it
is neither re-registered nor scheduled for DPC re-registration. This
mirrors the existing guard in qla2x00_alert_all_vps().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_mbx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "40dcd4a71a52414b47fbba2f956387f1077c6c15",
"status": "affected",
"version": "41dc529a4602ac737020f423f84686a81de38e6d",
"versionType": "git"
},
{
"lessThan": "20bb54601d2655e83795b73499c89f6b1cb31016",
"status": "affected",
"version": "41dc529a4602ac737020f423f84686a81de38e6d",
"versionType": "git"
},
{
"lessThan": "d61e8de98c5a52978fb1edd95fe4dde3131b280e",
"status": "affected",
"version": "41dc529a4602ac737020f423f84686a81de38e6d",
"versionType": "git"
},
{
"lessThan": "7a83979d92782f83c90888ebe19bdc9420521940",
"status": "affected",
"version": "41dc529a4602ac737020f423f84686a81de38e6d",
"versionType": "git"
},
{
"lessThan": "23582731afa35031c94fadb71a4f3b4afd094649",
"status": "affected",
"version": "41dc529a4602ac737020f423f84686a81de38e6d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_mbx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Skip vport under deletion in report ID acquisition\n\nqla24xx_report_id_acquisition() format-1 handling walks ha-\u003evp_list under\nvport_slock, takes a vref_count on the matching vport and calls\nqla_update_host_map() to register its port id.\n\nA vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then\nqla24xx_disable_vp() removes the vport from the host_map btree and zeroes\nvha-\u003ed_id (RESET_AL_PA). The vport is only unlinked from vp_list later,\nin qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX)\nbut does not touch host_map. In the window in between, report ID\nacquisition can still find the vport on vp_list and call\nqla_update_host_map(); with d_id already zeroed it takes the\nbtree_insert32() path and re-inserts the dying vport into host_map.\nNothing cleans that entry afterwards, so once scsi_host_put() frees the\nvha a later host_map lookup dereferences freed memory.\n\nSkip a vport that has VPORT_DELETE set before taking the reference, so it\nis neither re-registered nor scheduled for DPC re-registration. This\nmirrors the existing guard in qla2x00_alert_all_vps()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The patched format-1 (vp_idx != 0) path in qla24xx_report_id_acquisition() walks ha-\u003evp_list and calls qla_update_host_map() when a VP_RPT_ID_IOCB_TYPE for FDISC complete or VP_STAT_ID_CHG arrives via qla24xx_process_response_queue() from qla24xx_intr_handler/qla24xx_msix_rsp_q, or via qlt_24xx_atio_pkt_all_vps(). A Fibre Channel SAN peer or switch induces those RIDAs; native FC/FCoE is a non-routable L2 fabric, so Adjacent.\nAC:H - The stale host_map insert happens only after qla24xx_vport_delete() sets VPORT_DELETE and qla24xx_disable_vp() RESET_AL_PA zeroes d_id and drops the vport from host_map, but before qla24xx_deallocate_vp_id() unlinks it from vp_list. A fabric attacker cannot write the S_IWUSR sysfs store_fc_vport_delete attribute to start that teardown, so the window is a victim state they cannot induce.\nPR:N - VP_RPT_ID handling in qla24xx_process_response_queue() and qlt_24xx_atio_pkt_all_vps() is an unauthenticated firmware completion of fabric N_Port ID assignment; that interrupt path checks no Linux uid or capability. FC-SP/EDIF is opt-in and is not required to deliver a format-1 RIDA.\nUI:N - Format-1 RIDA is processed automatically in interrupt context when firmware reports a VP ID. Concurrent qla24xx_vport_delete() is an administrator NPIV teardown rather than a mount, open, or other interactive step the attacker solicits.\nS:U - The dangling scsi_qla_host pointer is stored in ha-\u003ehost_map and later consumed in the same host kernel by qla_find_host_by_d_id(); this does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After scsi_host_put() at the end of qla24xx_vport_delete() frees the vha, a later btree_lookup32() in qla_find_host_by_d_id() on the re-inserted host_map key returns the freed scsi_qla_host. That use-after-free enables disclosure of reused heap contents.\nI:H - With d_id already zeroed, qla_update_host_map() takes btree_insert32() and plants the dying vha into ha-\u003ehost_map. Later ATIO/ELS dispatch via qla_find_host_by_d_id() writes through that freed scsi_qla_host, giving a kernel write and control-flow primitive.\nA:H - A later host_map lookup of the freed vha from qlt_24xx_atio_pkt_all_vps() (ATIO_TYPE7 d_id) or qla_edif ELS handling oopses in interrupt context, panicking the storage host even without a full exploit."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:07.214Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/40dcd4a71a52414b47fbba2f956387f1077c6c15"
},
{
"url": "https://git.kernel.org/stable/c/20bb54601d2655e83795b73499c89f6b1cb31016"
},
{
"url": "https://git.kernel.org/stable/c/d61e8de98c5a52978fb1edd95fe4dde3131b280e"
},
{
"url": "https://git.kernel.org/stable/c/7a83979d92782f83c90888ebe19bdc9420521940"
},
{
"url": "https://git.kernel.org/stable/c/23582731afa35031c94fadb71a4f3b4afd094649"
}
],
"title": "scsi: qla2xxx: Skip vport under deletion in report ID acquisition",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97531",
"datePublished": "2026-09-25T10:21:31.968Z",
"dateReserved": "2026-09-24T16:01:01.153Z",
"dateUpdated": "2026-10-21T12:53:07.214Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98222 (GCVE-0-2026-98222)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KEYS: encrypted: fix integer overflow of datablob_len
encrypted_key_alloc() stores datablob_len in a u16. It is computed from
multiple string and payload lengths. If the result exceeds U16_MAX, the
assignment truncates the allocation size. KASAN reports a 32760-byte
slab-out-of-bounds write when __ekey_init() copies the master key
description into the undersized buffer.
The total payload length stored in key->datalen is also a u16. Use
check_add_overflow() to reject values that do not fit either destination,
and use kzalloc_flex() for the flexible-array allocation.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/keys/encrypted-keys/encrypted.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1e720f63dbafc093a8f5d519f05b67724993edd4",
"status": "affected",
"version": "7e70cb4978507cf31d76b90e4cfb4c28cad87f0c",
"versionType": "git"
},
{
"lessThan": "a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0",
"status": "affected",
"version": "7e70cb4978507cf31d76b90e4cfb4c28cad87f0c",
"versionType": "git"
},
{
"lessThan": "cca38f2102a4cd35eda8d48950df4817b4b24757",
"status": "affected",
"version": "7e70cb4978507cf31d76b90e4cfb4c28cad87f0c",
"versionType": "git"
},
{
"lessThan": "8697c431e297eb0d0ab13dda6bc172b48a34f05c",
"status": "affected",
"version": "7e70cb4978507cf31d76b90e4cfb4c28cad87f0c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/keys/encrypted-keys/encrypted.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: encrypted: fix integer overflow of datablob_len\n\nencrypted_key_alloc() stores datablob_len in a u16. It is computed from\nmultiple string and payload lengths. If the result exceeds U16_MAX, the\nassignment truncates the allocation size. KASAN reports a 32760-byte\nslab-out-of-bounds write when __ekey_init() copies the master key\ndescription into the undersized buffer.\n\nThe total payload length stored in key-\u003edatalen is also a u16. Use\ncheck_add_overflow() to reject values that do not fit either destination,\nand use kzalloc_flex() for the flexible-array allocation."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:54.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1e720f63dbafc093a8f5d519f05b67724993edd4"
},
{
"url": "https://git.kernel.org/stable/c/a1a98eca102b1cbbc37ff9eaa197ae4e6a3ea4b0"
},
{
"url": "https://git.kernel.org/stable/c/cca38f2102a4cd35eda8d48950df4817b4b24757"
},
{
"url": "https://git.kernel.org/stable/c/8697c431e297eb0d0ab13dda6bc172b48a34f05c"
}
],
"title": "KEYS: encrypted: fix integer overflow of datablob_len",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98222",
"datePublished": "2026-10-06T08:44:57.621Z",
"dateReserved": "2026-09-25T10:25:14.327Z",
"dateUpdated": "2026-10-19T09:15:54.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98430 (GCVE-0-2026-98430)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/efa: Keep admin queues alive while IRQ is registered
The management IRQ handler accesses both the admin completion queue and the
async event queue. The driver registered the IRQ before constructing these
queues and destroyed them before freeing the IRQ, so the handler's lifetime
was not contained by the resources it accesses.
Initialize the queues with interrupts masked, request the IRQ, and then
switch to interrupt mode. On removal, reset the device and free the IRQ
before destroying the queues. Also reset the device before destroying the
queues if IRQ registration fails, because the device already has their DMA
addresses.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b7f5e880f3774ff1934ce272e1c3b673a3a9c414 Version: b7f5e880f3774ff1934ce272e1c3b673a3a9c414 Version: b7f5e880f3774ff1934ce272e1c3b673a3a9c414 Version: b7f5e880f3774ff1934ce272e1c3b673a3a9c414 Version: b7f5e880f3774ff1934ce272e1c3b673a3a9c414 Version: b7f5e880f3774ff1934ce272e1c3b673a3a9c414 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/efa/efa_com.c",
"drivers/infiniband/hw/efa/efa_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0a8a105978e5ace0d885964317c5aed8ab4c0a0c",
"status": "affected",
"version": "b7f5e880f3774ff1934ce272e1c3b673a3a9c414",
"versionType": "git"
},
{
"lessThan": "00f7df59543cce445cfd2f109ace88c17d8aef4d",
"status": "affected",
"version": "b7f5e880f3774ff1934ce272e1c3b673a3a9c414",
"versionType": "git"
},
{
"lessThan": "bc7e64bad96c23fb343f47689670d0037f1a65e7",
"status": "affected",
"version": "b7f5e880f3774ff1934ce272e1c3b673a3a9c414",
"versionType": "git"
},
{
"lessThan": "d2a1c0bf4139c17b8d7668322b78c28d8c5b2dd0",
"status": "affected",
"version": "b7f5e880f3774ff1934ce272e1c3b673a3a9c414",
"versionType": "git"
},
{
"lessThan": "cf5520d1c931a70ccce0a1a247113bcec47a42be",
"status": "affected",
"version": "b7f5e880f3774ff1934ce272e1c3b673a3a9c414",
"versionType": "git"
},
{
"lessThan": "e08aca85c02ff290f785f07acae758f0daf5f49e",
"status": "affected",
"version": "b7f5e880f3774ff1934ce272e1c3b673a3a9c414",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/efa/efa_com.c",
"drivers/infiniband/hw/efa/efa_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Keep admin queues alive while IRQ is registered\n\nThe management IRQ handler accesses both the admin completion queue and the\nasync event queue. The driver registered the IRQ before constructing these\nqueues and destroyed them before freeing the IRQ, so the handler\u0027s lifetime\nwas not contained by the resources it accesses.\n\nInitialize the queues with interrupts masked, request the IRQ, and then\nswitch to interrupt mode. On removal, reset the device and free the IRQ\nbefore destroying the queues. Also reset the device before destroying the\nqueues if IRQ registration fails, because the device already has their DMA\naddresses."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:25.294Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a8a105978e5ace0d885964317c5aed8ab4c0a0c"
},
{
"url": "https://git.kernel.org/stable/c/00f7df59543cce445cfd2f109ace88c17d8aef4d"
},
{
"url": "https://git.kernel.org/stable/c/bc7e64bad96c23fb343f47689670d0037f1a65e7"
},
{
"url": "https://git.kernel.org/stable/c/d2a1c0bf4139c17b8d7668322b78c28d8c5b2dd0"
},
{
"url": "https://git.kernel.org/stable/c/cf5520d1c931a70ccce0a1a247113bcec47a42be"
},
{
"url": "https://git.kernel.org/stable/c/e08aca85c02ff290f785f07acae758f0daf5f49e"
}
],
"title": "RDMA/efa: Keep admin queues alive while IRQ is registered",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98430",
"datePublished": "2026-10-14T13:27:55.566Z",
"dateReserved": "2026-09-25T10:25:14.348Z",
"dateUpdated": "2026-10-19T09:19:25.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89441 (GCVE-0-2026-89441)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mmc: via-sdmmc: cancel card-detect work on remove
Disabling the device interrupt and freeing the IRQ prevents new card-detect
work from being queued, but carddet_work already queued by the handler can
still run after via_sd_remove() returns. via_sdc_card_detect() recovers the
host through container_of() and dereferences its MMIO base; once remove()
returns the host can be freed, so that work would touch freed memory.
Cancel carddet_work after freeing the IRQ and before cancelling
finish_bh_work, which the card-detect handler can also queue. carddet_work
can re-enable the interrupt through via_reset_pcictrl(); mask it again
afterwards.
This issue was found by an in-house static analysis tool and confirmed by
manual code review.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89441",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:22:13.294951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:26:38.639Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/via-sdmmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "55d71c70f11d9f92c7d2653774001e98cb509deb",
"status": "affected",
"version": "f0bf7f61b8405224bc52fc9a3ccd167a68126e00",
"versionType": "git"
},
{
"lessThan": "0a3c70191868fb007c03ff79693ad4e4b3fdcbb8",
"status": "affected",
"version": "f0bf7f61b8405224bc52fc9a3ccd167a68126e00",
"versionType": "git"
},
{
"lessThan": "f7ff3027ef004a331ef911a4886f12bc2e996037",
"status": "affected",
"version": "f0bf7f61b8405224bc52fc9a3ccd167a68126e00",
"versionType": "git"
},
{
"lessThan": "eaca730c6f5e3609df62a0469fb789235a93d276",
"status": "affected",
"version": "f0bf7f61b8405224bc52fc9a3ccd167a68126e00",
"versionType": "git"
},
{
"lessThan": "57e5d877f898d5e5c9d672a77bb6bdd24f0d9bf5",
"status": "affected",
"version": "f0bf7f61b8405224bc52fc9a3ccd167a68126e00",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/via-sdmmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: via-sdmmc: cancel card-detect work on remove\n\nDisabling the device interrupt and freeing the IRQ prevents new card-detect\nwork from being queued, but carddet_work already queued by the handler can\nstill run after via_sd_remove() returns. via_sdc_card_detect() recovers the\nhost through container_of() and dereferences its MMIO base; once remove()\nreturns the host can be freed, so that work would touch freed memory.\n\nCancel carddet_work after freeing the IRQ and before cancelling\nfinish_bh_work, which the card-detect handler can also queue. carddet_work\ncan re-enable the interrupt through via_reset_pcictrl(); mask it again\nafterwards.\n\nThis issue was found by an in-house static analysis tool and confirmed by\nmanual code review."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached from via_sd_remove() on the VIA VT9530 PCI SD/MMC host when unbind, rmmod, or PCI hot-remove leaves carddet_work pending; no network, Bluetooth, or USB hotplug path enters this teardown.\nAC:L - CIR IRQ queues carddet_work and via_sdc_card_detect() sleeps in via_reset_pcictrl while the attacker retries PCI unbind/rebind, so both sides of the missing cancel_work_sync race are attacker-controlled and retryable; such UAFs score AC:L.\nPR:L - Per CNA driver-removal UAF precedent, including sibling CVE-2026-89440 on this same via-sdmmc driver, an unprivileged local user on a machine with this PCI reader can spray the freed host while teardown proceeds; init-namespace root is not required.\nUI:N - No victim action such as mounting media or opening a file is required; the attacker queues carddet_work (or uses in-flight CIR work) and coordinates with driver removal themselves.\nS:U - The use-after-free corrupts the host kernel\u0027s via_crdr_mmc_host/mmc_host heap object within the same security authority; it is not a VM escape, IOMMU/DMA isolation bypass, or sandbox breakout.\nC:H - via_sdc_card_detect() recovers the freed via_crdr_mmc_host via container_of() and dereferences its MMIO bases, lock, and mrq; this kernel heap UAF enables arbitrary read via slab reuse.\nI:H - The dangling worker performs MMIO writes (DMA soft-reset, via_reset_pcictrl), may queue finish_bh_work, and can re-enable PCIINTCTRL after free_irq, yielding heap-spray write and control-flow hijack primitives.\nA:H - Use-after-free of sdhost after iounmap and devm mmc_free_host causes a kernel oops or panic even when not fully exploited, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:28.538Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/55d71c70f11d9f92c7d2653774001e98cb509deb"
},
{
"url": "https://git.kernel.org/stable/c/0a3c70191868fb007c03ff79693ad4e4b3fdcbb8"
},
{
"url": "https://git.kernel.org/stable/c/f7ff3027ef004a331ef911a4886f12bc2e996037"
},
{
"url": "https://git.kernel.org/stable/c/eaca730c6f5e3609df62a0469fb789235a93d276"
},
{
"url": "https://git.kernel.org/stable/c/57e5d877f898d5e5c9d672a77bb6bdd24f0d9bf5"
}
],
"title": "mmc: via-sdmmc: cancel card-detect work on remove",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89441",
"datePublished": "2026-09-11T19:43:10.083Z",
"dateReserved": "2026-09-11T19:38:34.703Z",
"dateUpdated": "2026-10-21T12:47:28.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98188 (GCVE-0-2026-98188)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: p54: validate curve data length in the calibration curve converters
p54_convert_rev0() and p54_convert_rev1() read calibration curve
data from the device-supplied EEPROM entry using channel and
points-per-channel counts taken verbatim from that same entry, so
an entry that declares more data than it carries drives an
out-of-bounds read past the EEPROM buffer (verified with a KASAN
reproducer of the conversion loop). The sibling converters
p54_convert_output_limits() and p54_convert_db() already validate
their counts against the entry length; this path was missed.
Reject the entry when the counts do not fit in the entry data.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d Version: eff1a59c48e3c6a006eb4fe5f2e405a996f2259d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intersil/p54/eeprom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81084c967c18233b19799a0c3352ebac043f31e2",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "41cdf14bf4b52fbe4673a172c2a6ad756cb08111",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "03d313e3dfb49a44c10a5c423452967694fb85e2",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "42f4b03971f9d6329c4cbd1ea5155210d16ab65b",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "4d767d6f8753db22bfc14c2724bd9cee677ffb03",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "3bdcc4d61212b001b8752d80036509b4974ce16c",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "b0c906107150b16925ee66da09127259864c7f36",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
},
{
"lessThan": "ce858fa6b8a214dee5adb82358885fa024cdd887",
"status": "affected",
"version": "eff1a59c48e3c6a006eb4fe5f2e405a996f2259d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intersil/p54/eeprom.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: p54: validate curve data length in the calibration curve converters\n\np54_convert_rev0() and p54_convert_rev1() read calibration curve\ndata from the device-supplied EEPROM entry using channel and\npoints-per-channel counts taken verbatim from that same entry, so\nan entry that declares more data than it carries drives an\nout-of-bounds read past the EEPROM buffer (verified with a KASAN\nreproducer of the conversion loop). The sibling converters\np54_convert_output_limits() and p54_convert_db() already validate\ntheir counts against the entry length; this path was missed.\n\nReject the entry when the counts do not fit in the entry data."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:19.711Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81084c967c18233b19799a0c3352ebac043f31e2"
},
{
"url": "https://git.kernel.org/stable/c/41cdf14bf4b52fbe4673a172c2a6ad756cb08111"
},
{
"url": "https://git.kernel.org/stable/c/03d313e3dfb49a44c10a5c423452967694fb85e2"
},
{
"url": "https://git.kernel.org/stable/c/42f4b03971f9d6329c4cbd1ea5155210d16ab65b"
},
{
"url": "https://git.kernel.org/stable/c/4d767d6f8753db22bfc14c2724bd9cee677ffb03"
},
{
"url": "https://git.kernel.org/stable/c/3bdcc4d61212b001b8752d80036509b4974ce16c"
},
{
"url": "https://git.kernel.org/stable/c/b0c906107150b16925ee66da09127259864c7f36"
},
{
"url": "https://git.kernel.org/stable/c/ce858fa6b8a214dee5adb82358885fa024cdd887"
}
],
"title": "wifi: p54: validate curve data length in the calibration curve converters",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98188",
"datePublished": "2026-10-06T08:44:30.096Z",
"dateReserved": "2026-09-25T10:25:14.323Z",
"dateUpdated": "2026-10-19T09:15:19.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98175 (GCVE-0-2026-98175)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: cancel reconnect work in clean_demultiplex_info()
clean_demultiplex_info() cancels server->echo delayed work but not
server->reconnect, which can cause a use-after-free when the
demultiplex thread exits while a reconnect work is still queued:
cifs_demultiplex_thread()
cifs_readv_from_socket()
cifs_reconnect()
__cifs_reconnect()
cifs_queue_server_reconn()
mod_delayed_work(cifsiod_wq, &server->reconnect, 0)
clean_demultiplex_info()
cancel_delayed_work_sync(&server->echo) // echo canceled
// reconnect NOT canceled
kfree_sensitive(server) // server freed
...later, on cifsiod_wq:
smb2_reconnect_server()
server->srv_count // UAF read of freed server
Fix this by canceling server->reconnect delayed work in
clean_demultiplex_info() before the server is freed, the same way
cifs_put_tcp_session() already does.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b Version: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b Version: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b Version: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b Version: 53e0e11efe9289535b060a51d4cf37c25e0d0f2b Version: e008a962311a875a828cbae54b43285858aaa6c8 Version: 123b228a09b90b50b0a9d6eb8294cf0c42efc029 Version: 0ba4c6eaaacbcc4b18f51bb3b1567c65a8fecca9 Version: d0d2a4c82942e2f51e4984beea1f7e5a994bd06c Version: 15a12fbbf365a483b1c19f9caeb707b3bea77e10 Version: f0b715409cb9cf7e21e690f9b163047739761962 Version: ff04da387c10b6bf7b510392742c8cd46c130fd6 Version: 48f9526f4dcb4b132fe0dc2450835311e3b013a6 Version: 3.10.107 ≤ Version: 3.12.70 ≤ Version: 3.16.42 ≤ Version: 3.18.47 ≤ Version: 4.1.38 ≤ Version: 4.4.40 ≤ Version: 4.8.16 ≤ Version: 4.9.1 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/connect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "180380272f116dbd2b0354c5c7872e112e519149",
"status": "affected",
"version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
"versionType": "git"
},
{
"lessThan": "e3f6a779433d13aafb5edab59e4f9313051e8a52",
"status": "affected",
"version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
"versionType": "git"
},
{
"lessThan": "7ab9ceedd860216fb97f2d8574cbe58b8906f42a",
"status": "affected",
"version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
"versionType": "git"
},
{
"lessThan": "2e5103e11a17c274715dd56cf185eeedccf686b8",
"status": "affected",
"version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
"versionType": "git"
},
{
"lessThan": "c65eae6f61d1778ff7a82e4aae4080e26f486af1",
"status": "affected",
"version": "53e0e11efe9289535b060a51d4cf37c25e0d0f2b",
"versionType": "git"
},
{
"status": "affected",
"version": "e008a962311a875a828cbae54b43285858aaa6c8",
"versionType": "git"
},
{
"status": "affected",
"version": "123b228a09b90b50b0a9d6eb8294cf0c42efc029",
"versionType": "git"
},
{
"status": "affected",
"version": "0ba4c6eaaacbcc4b18f51bb3b1567c65a8fecca9",
"versionType": "git"
},
{
"status": "affected",
"version": "d0d2a4c82942e2f51e4984beea1f7e5a994bd06c",
"versionType": "git"
},
{
"status": "affected",
"version": "15a12fbbf365a483b1c19f9caeb707b3bea77e10",
"versionType": "git"
},
{
"status": "affected",
"version": "f0b715409cb9cf7e21e690f9b163047739761962",
"versionType": "git"
},
{
"status": "affected",
"version": "ff04da387c10b6bf7b510392742c8cd46c130fd6",
"versionType": "git"
},
{
"status": "affected",
"version": "48f9526f4dcb4b132fe0dc2450835311e3b013a6",
"versionType": "git"
},
{
"lessThan": "3.11",
"status": "affected",
"version": "3.10.107",
"versionType": "semver"
},
{
"lessThan": "3.13",
"status": "affected",
"version": "3.12.70",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.42",
"versionType": "semver"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.47",
"versionType": "semver"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.38",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.40",
"versionType": "semver"
},
{
"lessThan": "4.9",
"status": "affected",
"version": "4.8.16",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/connect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.107",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.12.70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: cancel reconnect work in clean_demultiplex_info()\n\nclean_demultiplex_info() cancels server-\u003eecho delayed work but not\nserver-\u003ereconnect, which can cause a use-after-free when the\ndemultiplex thread exits while a reconnect work is still queued:\n\n cifs_demultiplex_thread()\n cifs_readv_from_socket()\n cifs_reconnect()\n __cifs_reconnect()\n cifs_queue_server_reconn()\n mod_delayed_work(cifsiod_wq, \u0026server-\u003ereconnect, 0)\n clean_demultiplex_info()\n cancel_delayed_work_sync(\u0026server-\u003eecho) // echo canceled\n // reconnect NOT canceled\n kfree_sensitive(server) // server freed\n\n ...later, on cifsiod_wq:\n\n smb2_reconnect_server()\n server-\u003esrv_count // UAF read of freed server\n\nFix this by canceling server-\u003ereconnect delayed work in\nclean_demultiplex_info() before the server is freed, the same way\ncifs_put_tcp_session() already does."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The SMB server at the other end of the client\u0027s TCP connection triggers the bug. When it resets the connection or sends an oversized SMB response, cifs_demultiplex_thread() calls cifs_reconnect() and then __cifs_reconnect(), which queues server-\u003ereconnect via cifs_queue_server_reconn(). clean_demultiplex_info() then frees the server without cancelling that work.\nAC:H - The malicious server can force reconnects whenever it likes. The free, though, only happens when the client drops its last TCP session reference (umount or a session put, via cifs_put_tcp_session) inside the window where __cifs_reconnect has re-queued the reconnect work. Then smb2_reconnect_server must run after kfree(server). The server cannot produce that client-side timing on demand.\nPR:N - A remote SMB server needs no credentials on the client host to drop its own connection or send a malformed response that drives the client into __cifs_reconnect. Mounting locally is not a lower-privilege route: cifs_fs_type has no FS_USERNS_MOUNT, so a local attacker would need real CAP_SYS_ADMIN.\nUI:R - The client has to mount a share from the attacker\u0027s SMB server, and a demultiplex thread only exists after that mount. The free also needs the client to unmount or otherwise drop the session at the wrong moment.\nS:U - The freed struct TCP_Server_Info and the cifsiod_wq worker that uses it after free are both in the client kernel. No VM, IOMMU or sandbox boundary is crossed.\nC:H - smb2_reconnect_server() reads server-\u003esrv_count from the freed TCP_Server_Info. If a reallocated object puts a nonzero value there, the worker carries on and dereferences primary_server, the reconnect_mutex and the session lists, all of which a heap spray would control.\nI:H - With a nonzero srv_count in reclaimed memory, the worker increments it, takes reconnect_mutex, manipulates the ses and tcon lists and calls cifs_put_tcp_session on the stale pointer. Those are writes through attacker-shaped memory, so they can corrupt kernel data.\nA:H - syzbot reproduced this use-after-free of TCP_Server_Info in smb2_reconnect_server. A stale worker running on the shared cifsiod_wq workqueue can oops or panic the client kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:06.742Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/180380272f116dbd2b0354c5c7872e112e519149"
},
{
"url": "https://git.kernel.org/stable/c/e3f6a779433d13aafb5edab59e4f9313051e8a52"
},
{
"url": "https://git.kernel.org/stable/c/7ab9ceedd860216fb97f2d8574cbe58b8906f42a"
},
{
"url": "https://git.kernel.org/stable/c/2e5103e11a17c274715dd56cf185eeedccf686b8"
},
{
"url": "https://git.kernel.org/stable/c/c65eae6f61d1778ff7a82e4aae4080e26f486af1"
}
],
"title": "smb: client: cancel reconnect work in clean_demultiplex_info()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98175",
"datePublished": "2026-10-06T08:44:19.155Z",
"dateReserved": "2026-09-25T10:25:14.322Z",
"dateUpdated": "2026-10-19T09:15:06.742Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98319 (GCVE-0-2026-98319)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
When an out_fence_ptr is provided but DRM_MODE_PAGE_FLIP_EVENT is not
set, a drm_pending_vblank_event will be allocated. If later, there is an
allocation failure or another failure at setup_out_fence(), that event
will not have base.fence set and it will not be released at
complete_signaling().
Release the event and set crtc_state->event to NULL just like in the
DRM_MODE_PAGE_FLIP_EVENT case when there is a failure at
drm_event_reserve_init(). That is, prepare_signaling() releases the
event and there is nothing to be done at complete_signaling(). Use
drm_event_cancel_free() as that will also undo drm_event_reserve_init()
in case it has been called.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 92c715fca907686f5298220ece53423e38ba3aed Version: 92c715fca907686f5298220ece53423e38ba3aed Version: 92c715fca907686f5298220ece53423e38ba3aed Version: 92c715fca907686f5298220ece53423e38ba3aed Version: 92c715fca907686f5298220ece53423e38ba3aed Version: 92c715fca907686f5298220ece53423e38ba3aed Version: 92c715fca907686f5298220ece53423e38ba3aed Version: 92c715fca907686f5298220ece53423e38ba3aed Version: 4cd462c7f2b6fcc208aebf44f2c831681feaa925 Version: 4.9.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_atomic_uapi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d6576ed3de01e8a378397b7020e33ae3d40aa6c",
"status": "affected",
"version": "92c715fca907686f5298220ece53423e38ba3aed",
"versionType": "git"
},
{
"lessThan": "86c33f740aa27e9cdc1259f0cc59c9c58f545e4b",
"status": "affected",
"version": "92c715fca907686f5298220ece53423e38ba3aed",
"versionType": "git"
},
{
"lessThan": "88c450e23b8fd4f1dcd329562f5e81ef05f3d941",
"status": "affected",
"version": "92c715fca907686f5298220ece53423e38ba3aed",
"versionType": "git"
},
{
"lessThan": "780716e2e019186fa6e5aad097a44b87b0b5388f",
"status": "affected",
"version": "92c715fca907686f5298220ece53423e38ba3aed",
"versionType": "git"
},
{
"lessThan": "d0be0516b5224eb5b6f42f8564a8deadb20ae16b",
"status": "affected",
"version": "92c715fca907686f5298220ece53423e38ba3aed",
"versionType": "git"
},
{
"lessThan": "daefd7ff159b0d1fb8c9e64430dcbe2aca1bdd09",
"status": "affected",
"version": "92c715fca907686f5298220ece53423e38ba3aed",
"versionType": "git"
},
{
"lessThan": "b9a68a9ccaada15d8dd0102c188cc6b868ff800b",
"status": "affected",
"version": "92c715fca907686f5298220ece53423e38ba3aed",
"versionType": "git"
},
{
"lessThan": "9eb1a393c89a79c4210230d23e7d88d239c61d7b",
"status": "affected",
"version": "92c715fca907686f5298220ece53423e38ba3aed",
"versionType": "git"
},
{
"status": "affected",
"version": "4cd462c7f2b6fcc208aebf44f2c831681feaa925",
"versionType": "git"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_atomic_uapi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr\n\nWhen an out_fence_ptr is provided but DRM_MODE_PAGE_FLIP_EVENT is not\nset, a drm_pending_vblank_event will be allocated. If later, there is an\nallocation failure or another failure at setup_out_fence(), that event\nwill not have base.fence set and it will not be released at\ncomplete_signaling().\n\nRelease the event and set crtc_state-\u003eevent to NULL just like in the\nDRM_MODE_PAGE_FLIP_EVENT case when there is a failure at\ndrm_event_reserve_init(). That is, prepare_signaling() releases the\nevent and there is nothing to be done at complete_signaling(). Use\ndrm_event_cancel_free() as that will also undo drm_event_reserve_init()\nin case it has been called."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:29.834Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d6576ed3de01e8a378397b7020e33ae3d40aa6c"
},
{
"url": "https://git.kernel.org/stable/c/86c33f740aa27e9cdc1259f0cc59c9c58f545e4b"
},
{
"url": "https://git.kernel.org/stable/c/88c450e23b8fd4f1dcd329562f5e81ef05f3d941"
},
{
"url": "https://git.kernel.org/stable/c/780716e2e019186fa6e5aad097a44b87b0b5388f"
},
{
"url": "https://git.kernel.org/stable/c/d0be0516b5224eb5b6f42f8564a8deadb20ae16b"
},
{
"url": "https://git.kernel.org/stable/c/daefd7ff159b0d1fb8c9e64430dcbe2aca1bdd09"
},
{
"url": "https://git.kernel.org/stable/c/b9a68a9ccaada15d8dd0102c188cc6b868ff800b"
},
{
"url": "https://git.kernel.org/stable/c/9eb1a393c89a79c4210230d23e7d88d239c61d7b"
}
],
"title": "drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98319",
"datePublished": "2026-10-06T08:46:13.948Z",
"dateReserved": "2026-09-25T10:25:14.340Z",
"dateUpdated": "2026-10-19T09:17:29.834Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98257 (GCVE-0-2026-98257)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
rds: ib: use rds_conn_drop() on protocol version mismatch
rds_ib_cm_connect_complete() runs from the RDMA-CM event handler with
conn->c_cm_lock held. When the peer negotiates a protocol version
older than RDS_PROTOCOL_COMPAT_VERSION, the handler calls
rds_conn_destroy(), which is only safe in the rmmod path: it
synchronously tears the connection down and flush_work()es the
shutdown work cp_down_w.
That shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is
the very lock the event handler still holds, so the flush never
completes: the two workers wait on each other and the RDS connection
workqueues stall for good.
All other RDMA-CM failure paths (REJECTED, CONNECT_ERROR,
DISCONNECTED) use rds_conn_drop(), which marks the connection
RDS_CONN_ERROR and schedules the shutdown work asynchronously. Use
it here as well.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f147dd9ecabf23fd63d2562ffe64252a0453ecde Version: f147dd9ecabf23fd63d2562ffe64252a0453ecde Version: f147dd9ecabf23fd63d2562ffe64252a0453ecde Version: f147dd9ecabf23fd63d2562ffe64252a0453ecde Version: f147dd9ecabf23fd63d2562ffe64252a0453ecde Version: f147dd9ecabf23fd63d2562ffe64252a0453ecde Version: f147dd9ecabf23fd63d2562ffe64252a0453ecde Version: f147dd9ecabf23fd63d2562ffe64252a0453ecde |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/ib_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "424019be3f637da76b74f44a40034669acbb166f",
"status": "affected",
"version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
"versionType": "git"
},
{
"lessThan": "14fb90067d13f4494cff0f03243fae3cf2911cbc",
"status": "affected",
"version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
"versionType": "git"
},
{
"lessThan": "344c72a0bc2703a6de4918ed935850e07dae3af2",
"status": "affected",
"version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
"versionType": "git"
},
{
"lessThan": "b5c9f2951d330d4a198a64d6e60f79b4bd6ef078",
"status": "affected",
"version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
"versionType": "git"
},
{
"lessThan": "d392b16acd0908f077289aad8bba066ff16de336",
"status": "affected",
"version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
"versionType": "git"
},
{
"lessThan": "65ca0a5037152a5a80b8fe6aac80eb80458be573",
"status": "affected",
"version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
"versionType": "git"
},
{
"lessThan": "7d8c22cb2cb1efb5e830a4545c76abf7b35cc2e8",
"status": "affected",
"version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
"versionType": "git"
},
{
"lessThan": "f97d8c7bab7843631206a114986c9059da03efeb",
"status": "affected",
"version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/ib_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: use rds_conn_drop() on protocol version mismatch\n\nrds_ib_cm_connect_complete() runs from the RDMA-CM event handler with\nconn-\u003ec_cm_lock held. When the peer negotiates a protocol version\nolder than RDS_PROTOCOL_COMPAT_VERSION, the handler calls\nrds_conn_destroy(), which is only safe in the rmmod path: it\nsynchronously tears the connection down and flush_work()es the\nshutdown work cp_down_w.\n\nThat shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is\nthe very lock the event handler still holds, so the flush never\ncompletes: the two workers wait on each other and the RDS connection\nworkqueues stall for good.\n\nAll other RDMA-CM failure paths (REJECTED, CONNECT_ERROR,\nDISCONNECTED) use rds_conn_drop(), which marks the connection\nRDS_CONN_ERROR and schedules the shutdown work asynchronously. Use\nit here as well."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bad input is dp_protocol_major/minor in the peer\u0027s RDMA-CM REP private data, which rds_ib_cm_connect_complete() reads on RDMA_CM_EVENT_ESTABLISHED from rds_rdma_cm_event_handler_cmn(). RDS/IB runs over RoCEv2, whose CM messages travel over routable UDP/IP, so a remote peer supplies the version that hits the rds_conn_destroy() branch.\nAC:L - The attacker produces the active-side state: connect to the RDS listener, then disconnect. IB has no lower-address rule in rds_queue_reconnect(), so the hashed conn reconnects to the attacker, who replies with version 3.0. The deadlock then fires every time.\nPR:N - RDS/IB connection setup has no authentication. rds_ib_cm_handle_connect() only checks the protocol version from the request, and the REP private data the fix concerns is taken from the peer as-is.\nUI:N - No local user action is needed. The victim kernel\u0027s own reconnect worker (rds_connect_worker via rds_queue_reconnect) starts the outgoing connection after the attacker drops the first one.\nS:U - The impact is a deadlock inside the same kernel that processes the RDMA-CM event. No VM, IOMMU or sandbox boundary is crossed.\nC:N - rds_conn_destroy() blocks in flush_work(\u0026cp-\u003ecp_down_w) before it reaches kmem_cache_free(), so the conn is never freed and then used. No memory is disclosed.\nI:N - No memory is corrupted. The fault is a lock-ordering deadlock between the CM handler holding c_cm_lock and rds_conn_shutdown() waiting for it, not a write to freed or out-of-bounds memory.\nA:H - The RDMA-CM event worker blocks forever in flush_work() while holding c_cm_lock, and the RDS shutdown work blocks on mutex_lock(\u0026cp-\u003ecp_cm_lock). This stalls the RDS connection workqueues and CM event handling for good, and the attacker can repeat it against new connections."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:28.470Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/424019be3f637da76b74f44a40034669acbb166f"
},
{
"url": "https://git.kernel.org/stable/c/14fb90067d13f4494cff0f03243fae3cf2911cbc"
},
{
"url": "https://git.kernel.org/stable/c/344c72a0bc2703a6de4918ed935850e07dae3af2"
},
{
"url": "https://git.kernel.org/stable/c/b5c9f2951d330d4a198a64d6e60f79b4bd6ef078"
},
{
"url": "https://git.kernel.org/stable/c/d392b16acd0908f077289aad8bba066ff16de336"
},
{
"url": "https://git.kernel.org/stable/c/65ca0a5037152a5a80b8fe6aac80eb80458be573"
},
{
"url": "https://git.kernel.org/stable/c/7d8c22cb2cb1efb5e830a4545c76abf7b35cc2e8"
},
{
"url": "https://git.kernel.org/stable/c/f97d8c7bab7843631206a114986c9059da03efeb"
}
],
"title": "rds: ib: use rds_conn_drop() on protocol version mismatch",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98257",
"datePublished": "2026-10-06T08:45:22.722Z",
"dateReserved": "2026-09-25T10:25:14.332Z",
"dateUpdated": "2026-10-19T09:16:28.470Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98325 (GCVE-0-2026-98325)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: set up the TX info early to fix failure paths
The previous commit 2c51457d930f ("wifi: mac80211: free ack status
frame on TX header build failure") cleaned up the leak, but still
left the code a bit messy and the failed SKB didn't get reported
to userspace.
Fix this up by initialising skb->cb[] earlier, which allows using
ieee80211_free_txskb() and therefore reports it for the failure
in ieee80211_build_hdr(), and unifies the ieee80211_skb_resize()
failure path with it.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8 Version: c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8 Version: c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8 Version: c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8 Version: c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8 Version: c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8 Version: fd39be7ff6f81f2dc91ba6e5f87944abef5b4802 Version: 3.6.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "df711e9fa20d7e996711c7f43a11a71805bef78d",
"status": "affected",
"version": "c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8",
"versionType": "git"
},
{
"lessThan": "420fcc2fdeae6ecd682d2b1605a0a54c88aed4aa",
"status": "affected",
"version": "c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8",
"versionType": "git"
},
{
"lessThan": "36e6f0a5e6d7238f4023e77f423c1c1414374309",
"status": "affected",
"version": "c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8",
"versionType": "git"
},
{
"lessThan": "0fb37d2b6cb829cebdaea80f39011469f474bdcc",
"status": "affected",
"version": "c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8",
"versionType": "git"
},
{
"lessThan": "03d67414bd05b86029afc14535238a9393eac1c6",
"status": "affected",
"version": "c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8",
"versionType": "git"
},
{
"lessThan": "50d3d79dc0743b616afb00d01a626c76758721f7",
"status": "affected",
"version": "c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8",
"versionType": "git"
},
{
"status": "affected",
"version": "fd39be7ff6f81f2dc91ba6e5f87944abef5b4802",
"versionType": "git"
},
{
"lessThan": "3.7",
"status": "affected",
"version": "3.6.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: set up the TX info early to fix failure paths\n\nThe previous commit 2c51457d930f (\"wifi: mac80211: free ack status\nframe on TX header build failure\") cleaned up the leak, but still\nleft the code a bit messy and the failed SKB didn\u0027t get reported\nto userspace.\n\nFix this up by initialising skb-\u003ecb[] earlier, which allows using\nieee80211_free_txskb() and therefore reports it for the failure\nin ieee80211_build_hdr(), and unifies the ieee80211_skb_resize()\nfailure path with it."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:35.760Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/df711e9fa20d7e996711c7f43a11a71805bef78d"
},
{
"url": "https://git.kernel.org/stable/c/420fcc2fdeae6ecd682d2b1605a0a54c88aed4aa"
},
{
"url": "https://git.kernel.org/stable/c/36e6f0a5e6d7238f4023e77f423c1c1414374309"
},
{
"url": "https://git.kernel.org/stable/c/0fb37d2b6cb829cebdaea80f39011469f474bdcc"
},
{
"url": "https://git.kernel.org/stable/c/03d67414bd05b86029afc14535238a9393eac1c6"
},
{
"url": "https://git.kernel.org/stable/c/50d3d79dc0743b616afb00d01a626c76758721f7"
}
],
"title": "wifi: mac80211: set up the TX info early to fix failure paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98325",
"datePublished": "2026-10-06T08:46:18.734Z",
"dateReserved": "2026-09-25T10:25:14.340Z",
"dateUpdated": "2026-10-19T09:17:35.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98171 (GCVE-0-2026-98171)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
Fix several related bounds checking and pointer lifecycle issues in
receive_encrypted_standard()'s handling of compound encrypted frames:
- Clear next_buffer after assigning it to server->bigbuf. A stale
next_buffer pointer can lead to a use-after-free on subsequent
error paths.
- Update pdu_length to the decrypted plaintext size (buf_size). Using
the pre-decryption length allows NextCommand to point into stale
ciphertext residue.
- Reject next_cmd values smaller than MID_HEADER_SIZE(server).
- Fix an integer overflow in the upper bound check by verifying
pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the
trailing slice is large enough for a header.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 Version: b24df3e30cbf48255db866720fb71f14bf9d2f39 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "72eaef1f37a3b6bec11c342736834dc3707be3e4",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "491e33144dee872cffda207f6fcb09260728f803",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "8749946579708ea0d339034bb7f423a67dbe89cf",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "96c436e4b010711452b2872558938f4ef276492a",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "858d5ac22cb889266993e7670f9f0c4f4aeedd78",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
},
{
"lessThan": "05762c5bc1cfdcac36747994fde2c04387a457f1",
"status": "affected",
"version": "b24df3e30cbf48255db866720fb71f14bf9d2f39",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs\n\nFix several related bounds checking and pointer lifecycle issues in\nreceive_encrypted_standard()\u0027s handling of compound encrypted frames:\n\n- Clear next_buffer after assigning it to server-\u003ebigbuf. A stale\n next_buffer pointer can lead to a use-after-free on subsequent\n error paths.\n- Update pdu_length to the decrypted plaintext size (buf_size). Using\n the pre-decryption length allows NextCommand to point into stale\n ciphertext residue.\n- Reject next_cmd values smaller than MID_HEADER_SIZE(server).\n- Fix an integer overflow in the upper bound check by verifying\n pdu_length - next_cmd \u003c MID_HEADER_SIZE(server), ensuring the\n trailing slice is large enough for a header."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The malformed input is an encrypted SMB2 compound response (TRANSFORM header, inner NextCommand chain) sent by the SMB server over TCP/445 and parsed by receive_encrypted_standard() via cifs_demultiplex_thread -\u003e smb3_receive_transform, so the bytes that cause the bug arrive over a routable network protocol.\nAC:L - The malicious server fully controls the sequence: a compound response whose first PDU has non-zero NextCommand, then a trailing PDU with NextCommand=0 and STATUS_PENDING or an unmatched MID with a bad header makes cifs_handle_standard() return non-zero, freeing the stale next_buffer every time; no race or external state is involved.\nPR:N - The attacker is the SMB server endpoint. It needs no account or privilege on the victim client, because it negotiates the session and encryption keys itself and so can produce valid encrypted frames.\nUI:R - A victim user or admin has to mount (or be redirected by DFS to) a share hosted on the attacker-controlled server before the client receives any encrypted compound response, so user action is required.\nS:U - The corruption is confined to the client kernel\u0027s own cifs receive buffers and slab/mempool objects, which is a standard kernel compromise and does not cross into a separate security authority.\nC:H - The error path frees server-\u003esmallbuf/bigbuf while it is still installed, which is a UAF on a kernel heap object. The object can be reallocated and its contents processed as SMB responses, a primitive usable for kernel memory disclosure.\nI:H - After the bad free, allocate_buffers() keeps the dangling smallbuf/bigbuf, and cifs_read_from_socket() writes the next frame\u0027s server-chosen bytes into the freed object (with a later double free), giving an attacker-controlled write into reallocated kernel memory.\nA:H - The use-after-free and double free of the cifs receive buffers in the demultiplex thread can corrupt the slab or mempool, causing a kernel oops or panic on the client and making every mount on that host unavailable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:02.660Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/72eaef1f37a3b6bec11c342736834dc3707be3e4"
},
{
"url": "https://git.kernel.org/stable/c/491e33144dee872cffda207f6fcb09260728f803"
},
{
"url": "https://git.kernel.org/stable/c/8749946579708ea0d339034bb7f423a67dbe89cf"
},
{
"url": "https://git.kernel.org/stable/c/96c436e4b010711452b2872558938f4ef276492a"
},
{
"url": "https://git.kernel.org/stable/c/858d5ac22cb889266993e7670f9f0c4f4aeedd78"
},
{
"url": "https://git.kernel.org/stable/c/05762c5bc1cfdcac36747994fde2c04387a457f1"
}
],
"title": "smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98171",
"datePublished": "2026-10-06T08:44:15.927Z",
"dateReserved": "2026-09-25T10:25:14.322Z",
"dateUpdated": "2026-10-19T09:15:02.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98369 (GCVE-0-2026-98369)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
syzbot reported a suspicious RCU usage warning in ip6_pkt_drop():
WARNING: suspicious RCU usage in ip6_pkt_drop
include/net/addrconf.h:389 suspicious rcu_dereference_check() usage!
Call Trace:
__in6_dev_get_safely include/net/addrconf.h:389 [inline]
ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620
ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651
xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
When commit 4f4920669d21 ("xfrm: Reinject transport-mode packets through
workqueue") converted xfrm_trans_reinject from a tasklet to a workqueue,
the reinjection loop ceased running in softirq context. Workqueue workers
run in process context where local_bh_disable() does not enter an RCU
read-side critical section under CONFIG_PREEMPT_RCU.
Because finish callbacks (such as ip6_rcv_finish) expect to run under an
RCU read lock (performing route lookups, l3mdev lookups, and accessing
RCU-protected data structures), invoking them in workqueue context without
rcu_read_lock() triggers RCU lockdep warnings.
Furthermore, packets queued to the workqueue via xfrm_trans_queue_net()
may carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref).
Additionally, on netdevice unregistration, dst_dev_put() replaces dst->dev
with blackhole_netdev, so dst entries do not keep skb->dev alive while
queued in the workqueue.
Fix these issues by:
1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the
caller's RCU section to ensure dst is reference-counted before queuing.
2. Holding a reference on skb->dev via dev_hold()/dev_put() across workqueue
deferral so skb->dev remains valid during finish() callback processing.
3. Acquiring rcu_read_lock() around the finish callback invocation loop in
xfrm_trans_reinject().
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7d98b26684cb2390729525b341ea099f0badbe18 Version: 4f4920669d21e1060b7243e5118dc3b71ced1276 Version: 4f4920669d21e1060b7243e5118dc3b71ced1276 Version: 4f4920669d21e1060b7243e5118dc3b71ced1276 Version: 4f4920669d21e1060b7243e5118dc3b71ced1276 Version: 4f4920669d21e1060b7243e5118dc3b71ced1276 Version: 4f4920669d21e1060b7243e5118dc3b71ced1276 Version: f520075da484306bbb8425afd2c42404ba74816f Version: 130d9e5017ade1b81d16783563edb38c12a2eab7 Version: 5.15.75 ≤ Version: 5.19.17 ≤ Version: 6.0.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "41e47f1664be86c91326f0afe0504a1162d00907",
"status": "affected",
"version": "7d98b26684cb2390729525b341ea099f0badbe18",
"versionType": "git"
},
{
"lessThan": "6601d91a85761f33351c71e04ec0bbd294ca07ce",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "0cda8273265d30cac6423834fd7d4acb75f04fdb",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "68a317b4aec8ca1868a39d69e40f9e29baa4f40a",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "6eb3b071be8e260543c604550c54dac66e6b174b",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "664fc0941df7c1918b2cd4de6ee00469ba77d8e4",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"lessThan": "d2f5082f9e84653fa1a9e8aebaaff23e688f5e19",
"status": "affected",
"version": "4f4920669d21e1060b7243e5118dc3b71ced1276",
"versionType": "git"
},
{
"status": "affected",
"version": "f520075da484306bbb8425afd2c42404ba74816f",
"versionType": "git"
},
{
"status": "affected",
"version": "130d9e5017ade1b81d16783563edb38c12a2eab7",
"versionType": "git"
},
{
"lessThan": "5.15.222",
"status": "affected",
"version": "5.15.75",
"versionType": "semver"
},
{
"lessThan": "5.20",
"status": "affected",
"version": "5.19.17",
"versionType": "semver"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.15.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()\n\nsyzbot reported a suspicious RCU usage warning in ip6_pkt_drop():\n\n WARNING: suspicious RCU usage in ip6_pkt_drop\n include/net/addrconf.h:389 suspicious rcu_dereference_check() usage!\n\n Call Trace:\n __in6_dev_get_safely include/net/addrconf.h:389 [inline]\n ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620\n ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651\n xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806\n process_one_work kernel/workqueue.c:3322 [inline]\n process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486\n\nWhen commit 4f4920669d21 (\"xfrm: Reinject transport-mode packets through\nworkqueue\") converted xfrm_trans_reinject from a tasklet to a workqueue,\nthe reinjection loop ceased running in softirq context. Workqueue workers\nrun in process context where local_bh_disable() does not enter an RCU\nread-side critical section under CONFIG_PREEMPT_RCU.\n\nBecause finish callbacks (such as ip6_rcv_finish) expect to run under an\nRCU read lock (performing route lookups, l3mdev lookups, and accessing\nRCU-protected data structures), invoking them in workqueue context without\nrcu_read_lock() triggers RCU lockdep warnings.\n\nFurthermore, packets queued to the workqueue via xfrm_trans_queue_net()\nmay carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref).\nAdditionally, on netdevice unregistration, dst_dev_put() replaces dst-\u003edev\nwith blackhole_netdev, so dst entries do not keep skb-\u003edev alive while\nqueued in the workqueue.\n\nFix these issues by:\n1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the\n caller\u0027s RCU section to ensure dst is reference-counted before queuing.\n2. Holding a reference on skb-\u003edev via dev_hold()/dev_put() across workqueue\n deferral so skb-\u003edev remains valid during finish() callback processing.\n3. Acquiring rcu_read_lock() around the finish callback invocation loop in\n xfrm_trans_reinject()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The use-after-free happens only when a queued packet\u0027s net_device or noref dst is freed before xfrm_trans_reinject() runs. A remote ESP peer sends the packet but cannot unregister the device or change routes, so the attacker who controls the whole race is local: they create the netns, veth and XFRM SA through xfrm_user netlink.\nAC:L - The attacker does both sides of the race. They send ESP transport-mode packets that xfrm4_transport_finish/xfrm6_transport_finish queue through xfrm_trans_queue(), then delete the veth or route while the workqueue is still behind. Flooding the queue up to max_backlog widens the window.\nPR:L - xfrm_user_rcv_msg checks netlink_net_capable(CAP_NET_ADMIN), which an unprivileged user gets in a new user and network namespace (unshare -Urn). That lets them create the SA, the veth devices and the routes the trigger needs.\nUI:N - No victim action is needed. The attacker sets up the namespace, sends the packets and tears down the device or route themselves.\nS:U - The freed net_device, dst_entry and RCU-protected route data are kernel memory, and the impact stays within the kernel\u0027s own security authority.\nC:H - ip6_rcv_finish and dst_input in xfrm_trans_reinject() read a freed skb-\u003edev or noref dst_entry with no reference and no RCU lock. If an attacker reclaims that memory, these use-after-free reads can leak kernel memory.\nI:H - The freed dst_entry holds an input function pointer that dst_input() calls, and net_device is full of ops pointers. Reclaiming either object with attacker-controlled data gives a path to hijacking control flow.\nA:H - A use-after-free of the net_device or dst in the xfrm_trans_reinject worker crashes the kernel, and syzbot hit the missing-RCU path in ip6_pkt_drop. The attacker can trigger it repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:21.221Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41e47f1664be86c91326f0afe0504a1162d00907"
},
{
"url": "https://git.kernel.org/stable/c/6601d91a85761f33351c71e04ec0bbd294ca07ce"
},
{
"url": "https://git.kernel.org/stable/c/0cda8273265d30cac6423834fd7d4acb75f04fdb"
},
{
"url": "https://git.kernel.org/stable/c/68a317b4aec8ca1868a39d69e40f9e29baa4f40a"
},
{
"url": "https://git.kernel.org/stable/c/6eb3b071be8e260543c604550c54dac66e6b174b"
},
{
"url": "https://git.kernel.org/stable/c/664fc0941df7c1918b2cd4de6ee00469ba77d8e4"
},
{
"url": "https://git.kernel.org/stable/c/d2f5082f9e84653fa1a9e8aebaaff23e688f5e19"
}
],
"title": "xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98369",
"datePublished": "2026-10-06T08:46:54.188Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:21.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98346 (GCVE-0-2026-98346)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: don't get the radio mask for netdev-less wdevs
cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with
wdev->netdev, which can be NULL and then crashes in mac80211.
To avoid that, invert the order of checks since wdev->netdev
is always valid for beaconing interfaces.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5b313159c970e945ee125ca87fad0d96ed913e55",
"status": "affected",
"version": "abb4cfe3661aa05426916b21164f88ca5a405a3a",
"versionType": "git"
},
{
"lessThan": "693d777846d525b8b218bad97a1befa5d9bd4334",
"status": "affected",
"version": "abb4cfe3661aa05426916b21164f88ca5a405a3a",
"versionType": "git"
},
{
"lessThan": "7166da84a7fe3553f9065782fd80299a37b150e5",
"status": "affected",
"version": "abb4cfe3661aa05426916b21164f88ca5a405a3a",
"versionType": "git"
},
{
"lessThan": "a7783e585360ee05dfe21d3173dbbe985c94f29e",
"status": "affected",
"version": "abb4cfe3661aa05426916b21164f88ca5a405a3a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: don\u0027t get the radio mask for netdev-less wdevs\n\ncfg80211_calculate_bi_data() calls rdev_get_radio_mask() with\nwdev-\u003enetdev, which can be NULL and then crashes in mac80211.\n\nTo avoid that, invert the order of checks since wdev-\u003enetdev\nis always valid for beaconing interfaces."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:57.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5b313159c970e945ee125ca87fad0d96ed913e55"
},
{
"url": "https://git.kernel.org/stable/c/693d777846d525b8b218bad97a1befa5d9bd4334"
},
{
"url": "https://git.kernel.org/stable/c/7166da84a7fe3553f9065782fd80299a37b150e5"
},
{
"url": "https://git.kernel.org/stable/c/a7783e585360ee05dfe21d3173dbbe985c94f29e"
}
],
"title": "wifi: cfg80211: don\u0027t get the radio mask for netdev-less wdevs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98346",
"datePublished": "2026-10-06T08:46:35.409Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-19T09:17:57.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89806 (GCVE-0-2026-89806)
Vulnerability from cvelistv5
Published
2026-09-16 10:30
Modified
2026-10-21 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation
The framebuffer size calculation `fb_size = linebytes * height` can
overflow when both values are large (e.g., 46341 * 46341 > INT_MAX).
Since linebytes and height are both int types, the multiplication is
performed as int * int, which results in undefined behavior on overflow.
Use check_mul_overflow() to detect and prevent this overflow, consistent
with the approach used in simpledrm.c and corebootdrm.c.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/sysfb/ofdrm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0cec951667a624fafaca2695c46042f45851caec",
"status": "affected",
"version": "c8a17756c42581ba1a567d1dd3b69e8f5619a7d8",
"versionType": "git"
},
{
"lessThan": "711fe7949d37656a5586244afee9523b9e5e37e9",
"status": "affected",
"version": "c8a17756c42581ba1a567d1dd3b69e8f5619a7d8",
"versionType": "git"
},
{
"lessThan": "ded6ad826fe0fd059333d3a3b3e1742c8e45ff41",
"status": "affected",
"version": "c8a17756c42581ba1a567d1dd3b69e8f5619a7d8",
"versionType": "git"
},
{
"lessThan": "d9daf9a6e7a6f82ef338a09386eefc6807100d3f",
"status": "affected",
"version": "c8a17756c42581ba1a567d1dd3b69e8f5619a7d8",
"versionType": "git"
},
{
"lessThan": "c6f48e59ece0123f6a11527ad4d89b21c2d65b87",
"status": "affected",
"version": "c8a17756c42581ba1a567d1dd3b69e8f5619a7d8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/sysfb/ofdrm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sysfb: ofdrm: Fix integer overflow in fb_size calculation\n\nThe framebuffer size calculation `fb_size = linebytes * height` can\noverflow when both values are large (e.g., 46341 * 46341 \u003e INT_MAX).\nSince linebytes and height are both int types, the multiplication is\nperformed as int * int, which results in undefined behavior on overflow.\n\nUse check_mul_overflow() to detect and prevent this overflow, consistent\nwith the approach used in simpledrm.c and corebootdrm.c."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The overflow is in ofdrm_device_create() on the local platform probe path (ofdrm_probe matching Open Firmware compatible=display); it is not reached from network protocols, Bluetooth, USB, or other remote packet handlers.\nAC:L - An attacker who supplies OF width/linebytes/height (e.g. 46341x46341) deterministically overflows the int multiply fb_size=linebytes*height; there is no race, layout luck, or other condition outside attacker control.\nPR:N - ofdrm_probe runs automatically from the platform bus with no capability check; a crafted display node can be supplied without an OS account via netboot/PXE, QEMU/hypervisor Open Firmware, or firmware, so no privileges on the running system are required.\nUI:N - Once a malicious display node is present, framebuffer size is computed during unattended driver probe; no victim mount, file open, or other interactive action is required.\nS:U - The overflow and resulting framebuffer mapping errors affect kernel and MMIO state on the same host; this is a standard in-kernel driver defect, not a VM escape, IOMMU bypass, or other cross-authority impact.\nC:H - A wrapped fb_size ioremaps a too-small aperture while scanout still uses the attacker-chosen pitch and height, enabling out-of-bounds reads of adjacent ioremap/vmalloc memory; memory-corruption OOB access is High confidentiality.\nI:H - The undersized mapping causes out-of-bounds writes through drm_sysfb blit/disable paths and DRM/fbdev clients past the mapped firmware framebuffer, which is an OOB write scored as High integrity impact.\nA:H - Accesses past the ioremap\u0027d region cause kernel page-fault oops or panic during probe-time DRM client setup or later modeset/blit, fully denying availability on affected Open Firmware display systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:48:48.055Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0cec951667a624fafaca2695c46042f45851caec"
},
{
"url": "https://git.kernel.org/stable/c/711fe7949d37656a5586244afee9523b9e5e37e9"
},
{
"url": "https://git.kernel.org/stable/c/ded6ad826fe0fd059333d3a3b3e1742c8e45ff41"
},
{
"url": "https://git.kernel.org/stable/c/d9daf9a6e7a6f82ef338a09386eefc6807100d3f"
},
{
"url": "https://git.kernel.org/stable/c/c6f48e59ece0123f6a11527ad4d89b21c2d65b87"
}
],
"title": "drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89806",
"datePublished": "2026-09-16T10:30:39.548Z",
"dateReserved": "2026-09-11T19:38:34.767Z",
"dateUpdated": "2026-10-21T12:48:48.055Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98337 (GCVE-0-2026-98337)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't start a ROC while scanning
The ROC work can be pending when a scan starts (which requires
ROC list to be empty, but that's possible), and then a new ROC
can be added to the list and the work will pick it up.
Avoid starting that ROC if a scan made it between things, as
otherwise we'll hit a warning later:
WARNING: net/mac80211/offchannel.c:404 at ieee80211_start_next_roc+0x256/0x2d0
Workqueue: events_unbound cfg80211_wiphy_work
Call Trace:
__ieee80211_scan_completed+0x4fd/0xe40 net/mac80211/scan.c:537
ieee80211_scan_work+0x472/0x1ff0 net/mac80211/scan.c:1193
cfg80211_wiphy_work+0x410/0x570 net/wireless/core.c:513
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/offchannel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5dc8ec2f8d1d62914661577c23ec151f5c9734a4",
"status": "affected",
"version": "aaa016ccd5df89d73483d0d51ee1f692978ccc35",
"versionType": "git"
},
{
"lessThan": "81baab8b645ec532bad2b7a8464191c720ef8fd9",
"status": "affected",
"version": "aaa016ccd5df89d73483d0d51ee1f692978ccc35",
"versionType": "git"
},
{
"lessThan": "58b806f699052c572dec6cab2c376f884f27e98f",
"status": "affected",
"version": "aaa016ccd5df89d73483d0d51ee1f692978ccc35",
"versionType": "git"
},
{
"lessThan": "733f0fde95392ed5f61a4e36aee661ea8d0e8581",
"status": "affected",
"version": "aaa016ccd5df89d73483d0d51ee1f692978ccc35",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/offchannel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don\u0027t start a ROC while scanning\n\nThe ROC work can be pending when a scan starts (which requires\nROC list to be empty, but that\u0027s possible), and then a new ROC\ncan be added to the list and the work will pick it up.\n\nAvoid starting that ROC if a scan made it between things, as\notherwise we\u0027ll hit a warning later:\n\n WARNING: net/mac80211/offchannel.c:404 at ieee80211_start_next_roc+0x256/0x2d0\n Workqueue: events_unbound cfg80211_wiphy_work\n Call Trace:\n __ieee80211_scan_completed+0x4fd/0xe40 net/mac80211/scan.c:537\n ieee80211_scan_work+0x472/0x1ff0 net/mac80211/scan.c:1193\n cfg80211_wiphy_work+0x410/0x570 net/wireless/core.c:513"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:48.362Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5dc8ec2f8d1d62914661577c23ec151f5c9734a4"
},
{
"url": "https://git.kernel.org/stable/c/81baab8b645ec532bad2b7a8464191c720ef8fd9"
},
{
"url": "https://git.kernel.org/stable/c/58b806f699052c572dec6cab2c376f884f27e98f"
},
{
"url": "https://git.kernel.org/stable/c/733f0fde95392ed5f61a4e36aee661ea8d0e8581"
}
],
"title": "wifi: mac80211: don\u0027t start a ROC while scanning",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98337",
"datePublished": "2026-10-06T08:46:28.420Z",
"dateReserved": "2026-09-25T10:25:14.342Z",
"dateUpdated": "2026-10-19T09:17:48.362Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98312 (GCVE-0-2026-98312)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: 6fire: fix OOB write from device-reported iso length
usb6fire_pcm_in_urb_handler() sizes each outgoing isochronous packet as
(actual_length - 4) / (in_n_analog << 2) * (out_n_analog << 2) + 4, where
actual_length is the unsigned length the device reported for the matching
IN packet. A packet completed with status 0 and actual_length < 4 wraps
the subtraction to 0x7fffffec; a zero-length isochronous packet is legal
on the bus, and the preceding loop rejects only non-zero status. The sum
reaches memset() on out_urb->buffer, a 4832-byte object from
kcalloc(PCM_MAX_PACKET_SIZE, PCM_N_PACKETS_PER_URB).
Even without the wrap the result is out of bounds: at 88.2/96 kHz the
4-in/6-out scaling turns a full 420-byte IN packet into 628, so eight
packets span 5024 bytes of that buffer. usb_submit_urb() rejects an
over-long descriptor only after the memset() and the
usb6fire_pcm_playback() copy of user PCM data have run.
Guard the subtraction as the sibling usb6fire_pcm_capture() already does,
and limit the frame count to what fits in rt->out_packet_size, the OUT
endpoint's wMaxPacketSize. This bounds total_length by the buffer size
while keeping each packet length aligned to a whole output frame.
BUG: KASAN: out-of-bounds in usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338)
Write of size 18446744073709551456 at addr ffff88802a3d0000 by task vhci_rx/5018
Call Trace:
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200)
__asan_memset (mm/kasan/shadow.c:84)
usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338)
__usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)
usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)
vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107 drivers/usb/usbip/vhci_rx.c:242)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Allocated by task 10:
__kmalloc_cache_noprof (mm/slub.c:5563)
usb6fire_pcm_init (sound/usb/6fire/pcm.c:560 sound/usb/6fire/pcm.c:595)
usb6fire_chip_probe (sound/usb/6fire/chip.c:133)
usb_probe_interface (drivers/usb/core/driver.c:399)
The buggy address belongs to the object at ffff88802a3d0000
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 0 bytes inside of
4832-byte region [ffff88802a3d0000, ffff88802a3d12e0)
Kernel panic - not syncing: Fatal exception in interrupt
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 Version: c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 Version: c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 Version: c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 Version: c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 Version: c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/6fire/pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "61e665fb48e9eee44ec6d610514af383b1802cc1",
"status": "affected",
"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
"versionType": "git"
},
{
"lessThan": "246de677552fe5dede293a1543b632e9853f31e4",
"status": "affected",
"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
"versionType": "git"
},
{
"lessThan": "001ba7c1d9677225a5ecbc3e60d4865c08bb21d8",
"status": "affected",
"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
"versionType": "git"
},
{
"lessThan": "ea11ade10583cc45af515d6b24510dbfa0184ca6",
"status": "affected",
"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
"versionType": "git"
},
{
"lessThan": "cdc31537012bc7a58c95c6750db321b69dd802bb",
"status": "affected",
"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
"versionType": "git"
},
{
"lessThan": "1589afe2d099d3e817873bc474676968d7080410",
"status": "affected",
"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/6fire/pcm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.39"
},
{
"lessThan": "2.6.39",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.39",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix OOB write from device-reported iso length\n\nusb6fire_pcm_in_urb_handler() sizes each outgoing isochronous packet as\n(actual_length - 4) / (in_n_analog \u003c\u003c 2) * (out_n_analog \u003c\u003c 2) + 4, where\nactual_length is the unsigned length the device reported for the matching\nIN packet. A packet completed with status 0 and actual_length \u003c 4 wraps\nthe subtraction to 0x7fffffec; a zero-length isochronous packet is legal\non the bus, and the preceding loop rejects only non-zero status. The sum\nreaches memset() on out_urb-\u003ebuffer, a 4832-byte object from\nkcalloc(PCM_MAX_PACKET_SIZE, PCM_N_PACKETS_PER_URB).\n\nEven without the wrap the result is out of bounds: at 88.2/96 kHz the\n4-in/6-out scaling turns a full 420-byte IN packet into 628, so eight\npackets span 5024 bytes of that buffer. usb_submit_urb() rejects an\nover-long descriptor only after the memset() and the\nusb6fire_pcm_playback() copy of user PCM data have run.\n\nGuard the subtraction as the sibling usb6fire_pcm_capture() already does,\nand limit the frame count to what fits in rt-\u003eout_packet_size, the OUT\nendpoint\u0027s wMaxPacketSize. This bounds total_length by the buffer size\nwhile keeping each packet length aligned to a whole output frame.\n\n BUG: KASAN: out-of-bounds in usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338)\n Write of size 18446744073709551456 at addr ffff88802a3d0000 by task vhci_rx/5018\n Call Trace:\n dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\n print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:595)\n kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200)\n __asan_memset (mm/kasan/shadow.c:84)\n usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338)\n __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)\n usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)\n vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107 drivers/usb/usbip/vhci_rx.c:242)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\n Allocated by task 10:\n __kmalloc_cache_noprof (mm/slub.c:5563)\n usb6fire_pcm_init (sound/usb/6fire/pcm.c:560 sound/usb/6fire/pcm.c:595)\n usb6fire_chip_probe (sound/usb/6fire/chip.c:133)\n usb_probe_interface (drivers/usb/core/driver.c:399)\n\n The buggy address belongs to the object at ffff88802a3d0000\n which belongs to the cache kmalloc-8k of size 8192\n The buggy address is located 0 bytes inside of\n 4832-byte region [ffff88802a3d0000, ffff88802a3d12e0)\n Kernel panic - not syncing: Fatal exception in interrupt"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:22.807Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/61e665fb48e9eee44ec6d610514af383b1802cc1"
},
{
"url": "https://git.kernel.org/stable/c/246de677552fe5dede293a1543b632e9853f31e4"
},
{
"url": "https://git.kernel.org/stable/c/001ba7c1d9677225a5ecbc3e60d4865c08bb21d8"
},
{
"url": "https://git.kernel.org/stable/c/ea11ade10583cc45af515d6b24510dbfa0184ca6"
},
{
"url": "https://git.kernel.org/stable/c/cdc31537012bc7a58c95c6750db321b69dd802bb"
},
{
"url": "https://git.kernel.org/stable/c/1589afe2d099d3e817873bc474676968d7080410"
}
],
"title": "ALSA: 6fire: fix OOB write from device-reported iso length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98312",
"datePublished": "2026-10-06T08:46:08.388Z",
"dateReserved": "2026-09-25T10:25:14.339Z",
"dateUpdated": "2026-10-19T09:17:22.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98251 (GCVE-0-2026-98251)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: avoid reallocating confirmed conntrack labels
ovs_ct_get_conn_labels() adds the labels extension when a conntrack
entry does not have one. Confirmed conntracks can be read locklessly,
so adding an extension may reallocate and free the extension block
while another CPU accesses it.
Only add the extension for unconfirmed conntracks. A confirmed
conntrack without labels now fails the caller's label operation instead
of reallocating its extension storage.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c2ac667358708d7cce64c78f58af6adf4c1e848b Version: c2ac667358708d7cce64c78f58af6adf4c1e848b Version: c2ac667358708d7cce64c78f58af6adf4c1e848b Version: c2ac667358708d7cce64c78f58af6adf4c1e848b Version: c2ac667358708d7cce64c78f58af6adf4c1e848b Version: c2ac667358708d7cce64c78f58af6adf4c1e848b Version: c2ac667358708d7cce64c78f58af6adf4c1e848b Version: c2ac667358708d7cce64c78f58af6adf4c1e848b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/conntrack.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4371d79ea74407fb992c985b1f94391e35bb8289",
"status": "affected",
"version": "c2ac667358708d7cce64c78f58af6adf4c1e848b",
"versionType": "git"
},
{
"lessThan": "7ff688aceada1160331a789385ea146f62fbddf7",
"status": "affected",
"version": "c2ac667358708d7cce64c78f58af6adf4c1e848b",
"versionType": "git"
},
{
"lessThan": "05eab8dced6bf4d3009a6eeee16ddac99047dc83",
"status": "affected",
"version": "c2ac667358708d7cce64c78f58af6adf4c1e848b",
"versionType": "git"
},
{
"lessThan": "579d87ec1e1e85729a6cb2c25961e58beb78640c",
"status": "affected",
"version": "c2ac667358708d7cce64c78f58af6adf4c1e848b",
"versionType": "git"
},
{
"lessThan": "2e6dd889c325abf23821e1459c3ffef59b7f0009",
"status": "affected",
"version": "c2ac667358708d7cce64c78f58af6adf4c1e848b",
"versionType": "git"
},
{
"lessThan": "d16f089bd700f45d720ce989d5495e1dc3be0cf8",
"status": "affected",
"version": "c2ac667358708d7cce64c78f58af6adf4c1e848b",
"versionType": "git"
},
{
"lessThan": "8c9fcc6c33950d3db551af664d1fd3d998bfee56",
"status": "affected",
"version": "c2ac667358708d7cce64c78f58af6adf4c1e848b",
"versionType": "git"
},
{
"lessThan": "3f118c8217c109fd13ca61caa301d72c483897ef",
"status": "affected",
"version": "c2ac667358708d7cce64c78f58af6adf4c1e848b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/conntrack.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: avoid reallocating confirmed conntrack labels\n\novs_ct_get_conn_labels() adds the labels extension when a conntrack\nentry does not have one. Confirmed conntracks can be read locklessly,\nso adding an extension may reallocate and free the extension block\nwhile another CPU accesses it.\n\nOnly add the extension for unconfirmed conntracks. A confirmed\nconntrack without labels now fails the caller\u0027s label operation instead\nof reallocating its extension storage."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bad state is created by local setup over the OVS genetlink datapath/flow commands: a ct(commit,labels) action hits ovs_ct_commit()-\u003eovs_ct_set_labels()-\u003eovs_ct_get_conn_labels() on a confirmed conntrack created before labels_used was raised. Packets only trigger it; the cause is local flow and conntrack ordering.\nAC:L - The attacker creates the unlabelled confirmed conntrack (netfilter traffic before OVS init), installs the label flow, and sends both the triggering packet and the concurrent lockless ct-\u003eext readers on other CPUs, so they control both sides of the krealloc race.\nPR:L - The OVS datapath/flow genl ops use GENL_UNS_ADMIN_PERM, so CAP_NET_ADMIN in a user-owned network namespace (unshare -Urn) is enough; real root is not needed.\nUI:N - No victim action is needed; the attacker sets up the flows and sends all the packets themselves.\nS:U - The corruption is in the kernel\u0027s own conntrack extension memory and the impact stays inside the kernel\u0027s authority; no VM or hardware boundary is crossed.\nC:H - nf_ct_ext_add() on a confirmed ct does krealloc(ct-\u003eext) and frees the old extension block while other CPUs still dereference it locklessly. That is a slab use-after-free which can be reclaimed with attacker-sprayed data to leak kernel memory.\nI:H - Concurrent writers into the freed nf_ct_ext (labels, acct, ecache, helper data) write into reclaimed memory, a use-after-free write primitive that can be groomed to corrupt kernel objects.\nA:H - The use-after-free on ct-\u003eext can oops the kernel, and WARN_ON(nf_ct_is_confirmed(ct)) in nf_ct_ext_add() panics hosts with panic_on_warn set."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:22.619Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4371d79ea74407fb992c985b1f94391e35bb8289"
},
{
"url": "https://git.kernel.org/stable/c/7ff688aceada1160331a789385ea146f62fbddf7"
},
{
"url": "https://git.kernel.org/stable/c/05eab8dced6bf4d3009a6eeee16ddac99047dc83"
},
{
"url": "https://git.kernel.org/stable/c/579d87ec1e1e85729a6cb2c25961e58beb78640c"
},
{
"url": "https://git.kernel.org/stable/c/2e6dd889c325abf23821e1459c3ffef59b7f0009"
},
{
"url": "https://git.kernel.org/stable/c/d16f089bd700f45d720ce989d5495e1dc3be0cf8"
},
{
"url": "https://git.kernel.org/stable/c/8c9fcc6c33950d3db551af664d1fd3d998bfee56"
},
{
"url": "https://git.kernel.org/stable/c/3f118c8217c109fd13ca61caa301d72c483897ef"
}
],
"title": "openvswitch: avoid reallocating confirmed conntrack labels",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98251",
"datePublished": "2026-10-06T08:45:18.707Z",
"dateReserved": "2026-09-25T10:25:14.331Z",
"dateUpdated": "2026-10-19T09:16:22.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97618 (GCVE-0-2026-97618)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-19 09:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/net: don't overconsume buffers when using MSG_TRUNC
When a recv/recvmsg is issued with MSG_TRUNC and the incoming packet is
larger than the provided buffer, the net layer returns the full length
of the packet rather than the number of bytes actually copied into the
buffer. As a result, io_uring advances more of the provided buffer ring
than was actually filled. Use the actual filled region size to consume
the buffer, but still return the full size to preserve MSG_TRUNC
semantics.
Take care with multishot, because that seems to already truncate the
consumption based on the available payload size.
This was reported in https://github.com/axboe/liburing/issues/1619.
[axboe: fold in size_t unsigned fix]
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "41d24d2fb168fa05fcaf9ec4e55478411dbbf8e1",
"status": "affected",
"version": "ae98dbf43d755b4e111fcd086e53939bef3e9a1a",
"versionType": "git"
},
{
"lessThan": "927d96f91c582b319d104ecf50ec935a8dc29193",
"status": "affected",
"version": "ae98dbf43d755b4e111fcd086e53939bef3e9a1a",
"versionType": "git"
},
{
"lessThan": "2e70ea75c7bb38a6dc212975f887310f14f7c043",
"status": "affected",
"version": "ae98dbf43d755b4e111fcd086e53939bef3e9a1a",
"versionType": "git"
},
{
"lessThan": "6028b543884f8735e057ec9eea4908cd61cab230",
"status": "affected",
"version": "ae98dbf43d755b4e111fcd086e53939bef3e9a1a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: don\u0027t overconsume buffers when using MSG_TRUNC\n\nWhen a recv/recvmsg is issued with MSG_TRUNC and the incoming packet is\nlarger than the provided buffer, the net layer returns the full length\nof the packet rather than the number of bytes actually copied into the\nbuffer. As a result, io_uring advances more of the provided buffer ring\nthan was actually filled. Use the actual filled region size to consume\nthe buffer, but still return the full size to preserve MSG_TRUNC\nsemantics.\n\nTake care with multishot, because that seems to already truncate the\nconsumption based on the available payload size.\n\nThis was reported in https://github.com/axboe/liburing/issues/1619.\n\n[axboe: fold in size_t unsigned fix]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:10:21.782Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/41d24d2fb168fa05fcaf9ec4e55478411dbbf8e1"
},
{
"url": "https://git.kernel.org/stable/c/927d96f91c582b319d104ecf50ec935a8dc29193"
},
{
"url": "https://git.kernel.org/stable/c/2e70ea75c7bb38a6dc212975f887310f14f7c043"
},
{
"url": "https://git.kernel.org/stable/c/6028b543884f8735e057ec9eea4908cd61cab230"
}
],
"title": "io_uring/net: don\u0027t overconsume buffers when using MSG_TRUNC",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97618",
"datePublished": "2026-09-25T10:22:25.049Z",
"dateReserved": "2026-09-24T16:01:01.159Z",
"dateUpdated": "2026-10-19T09:10:21.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98271 (GCVE-0-2026-98271)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: do not leave stale header offsets after pskb_carve()
pskb_carve_inside_header() and pskb_carve_inside_nonlinear() remove
the first bytes of a packet and reallocate skb->head.
All the headers that were present before the operation are gone,
but both functions call skb_headers_offset_update(skb, 0), which
is a no-op : skb->mac_header, skb->network_header,
skb->transport_header and skb->csum_start keep their old values and
now describe bytes which are no longer there.
Both helpers size the new head from the old skb_end_offset(), so the
stale offsets still land inside the new allocation. They point past
skb_tail_pointer() though, to bytes that were never initialized.
pskb_carve_inside_nonlinear() is the worst case, because it leaves a
zombie skb with an empty linear part (skb->data ==
skb_tail_pointer(skb), skb_headlen(skb) == 0), while
skb_mac_header_was_set() is still true and skb->mac_header is way
ahead of skb->data.
The only user of pskb_extract() is rds_tcp_data_recv(), and the
carved skb is queued on tinc->ti_skb_list. When the RDS incoming
message is released, rds_tcp_inc_free() calls skb_queue_purge(),
which frees the skbs with SKB_DROP_REASON_QUEUE_PURGE. This is
visible from drop_monitor, which then tries to pull back to the
(bogus) mac header :
skbuff: __skb_pull(len=234)
skb len=6968 data_len=6968 headroom=0 headlen=0 tailroom=0
end-tail=384 mac=(234,14) mac_len=14 net=(248,40) trans=288
shinfo(txflags=0 nr_frags=1 gso(size=1428 type=16 segs=5))
csum(0x100120 start=288 offset=16 ip_summed=3 complete_sw=0 valid=1 level=0)
hash(0x7b446c6c sw=0 l4=1) proto=0x86dd pkttype=0 iif=60
kernel BUG at ./include/linux/skbuff.h:2847!
Add skb_carve_reset_headers() to mark the mac and transport headers
as not set, reset the network header, clear skb->mac_len, and drop
a now meaningless CHECKSUM_PARTIAL (csum_start no longer describes
anything).
Invalidate the inner offsets as well. Unlike mac_header and
transport_header they have no "unset" sentinel, so a leftover
non-zero value still looks like a real header. Zero
skb->inner_mac_header, skb->inner_network_header,
skb->inner_transport_header, skb->inner_protocol and
skb->encapsulation, so that all the header state is invalidated in
one place.
v2: fixed an inaccurate changelog. The stale offsets stay inside the
new skb->head, which is never smaller than the old one, they
simply point past skb_tail_pointer() to bytes that are gone.
Thanks to Xuanqiang Luo for insisting on this.
Also invalidate the inner header state, as suggested by the
netdev AI review :
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260911114922.621937-1-edumazet%40google.com
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "75e4a3e62531738c124c8555a626426fca29d392",
"status": "affected",
"version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
"versionType": "git"
},
{
"lessThan": "bff8a8e53a6d290bc2777bde36d3cb6317b8463d",
"status": "affected",
"version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
"versionType": "git"
},
{
"lessThan": "12929ed66a5166177ef5f06d3da81e4f99993e90",
"status": "affected",
"version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
"versionType": "git"
},
{
"lessThan": "a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309",
"status": "affected",
"version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: do not leave stale header offsets after pskb_carve()\n\npskb_carve_inside_header() and pskb_carve_inside_nonlinear() remove\nthe first bytes of a packet and reallocate skb-\u003ehead.\n\nAll the headers that were present before the operation are gone,\nbut both functions call skb_headers_offset_update(skb, 0), which\nis a no-op : skb-\u003emac_header, skb-\u003enetwork_header,\nskb-\u003etransport_header and skb-\u003ecsum_start keep their old values and\nnow describe bytes which are no longer there.\n\nBoth helpers size the new head from the old skb_end_offset(), so the\nstale offsets still land inside the new allocation. They point past\nskb_tail_pointer() though, to bytes that were never initialized.\n\npskb_carve_inside_nonlinear() is the worst case, because it leaves a\nzombie skb with an empty linear part (skb-\u003edata ==\nskb_tail_pointer(skb), skb_headlen(skb) == 0), while\nskb_mac_header_was_set() is still true and skb-\u003emac_header is way\nahead of skb-\u003edata.\n\nThe only user of pskb_extract() is rds_tcp_data_recv(), and the\ncarved skb is queued on tinc-\u003eti_skb_list. When the RDS incoming\nmessage is released, rds_tcp_inc_free() calls skb_queue_purge(),\nwhich frees the skbs with SKB_DROP_REASON_QUEUE_PURGE. This is\nvisible from drop_monitor, which then tries to pull back to the\n(bogus) mac header :\n\nskbuff: __skb_pull(len=234)\nskb len=6968 data_len=6968 headroom=0 headlen=0 tailroom=0\nend-tail=384 mac=(234,14) mac_len=14 net=(248,40) trans=288\nshinfo(txflags=0 nr_frags=1 gso(size=1428 type=16 segs=5))\ncsum(0x100120 start=288 offset=16 ip_summed=3 complete_sw=0 valid=1 level=0)\nhash(0x7b446c6c sw=0 l4=1) proto=0x86dd pkttype=0 iif=60\nkernel BUG at ./include/linux/skbuff.h:2847!\n\nAdd skb_carve_reset_headers() to mark the mac and transport headers\nas not set, reset the network header, clear skb-\u003emac_len, and drop\na now meaningless CHECKSUM_PARTIAL (csum_start no longer describes\nanything).\n\nInvalidate the inner offsets as well. Unlike mac_header and\ntransport_header they have no \"unset\" sentinel, so a leftover\nnon-zero value still looks like a real header. Zero\nskb-\u003einner_mac_header, skb-\u003einner_network_header,\nskb-\u003einner_transport_header, skb-\u003einner_protocol and\nskb-\u003eencapsulation, so that all the header state is invalidated in\none place.\n\nv2: fixed an inaccurate changelog. The stale offsets stay inside the\n new skb-\u003ehead, which is never smaller than the old one, they\n simply point past skb_tail_pointer() to bytes that are gone.\n Thanks to Xuanqiang Luo for insisting on this.\n Also invalidate the inner header state, as suggested by the\n netdev AI review :\n https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260911114922.621937-1-edumazet%40google.com"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:41.976Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/75e4a3e62531738c124c8555a626426fca29d392"
},
{
"url": "https://git.kernel.org/stable/c/bff8a8e53a6d290bc2777bde36d3cb6317b8463d"
},
{
"url": "https://git.kernel.org/stable/c/12929ed66a5166177ef5f06d3da81e4f99993e90"
},
{
"url": "https://git.kernel.org/stable/c/a5117e1eccac6ee3bd4aed7cacf8ebcb6b3eb309"
}
],
"title": "net: skbuff: do not leave stale header offsets after pskb_carve()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98271",
"datePublished": "2026-10-06T08:45:33.298Z",
"dateReserved": "2026-09-25T10:25:14.333Z",
"dateUpdated": "2026-10-19T09:16:41.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98349 (GCVE-0-2026-98349)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: libipw: reject too-short beacon and probe responses
libipw_process_probe_response() and the libipw_network_init() call it
makes assume the frame contains the full 36-byte beacon and probe
response prefix, but the ipw2100 and ipw2200 receive paths only
establish that a management frame carries the generic 24-byte
three-address header.
libipw_network_init() then computes the information element length as
stats->len - sizeof(*beacon)
stats->len is a u16 and sizeof() has type size_t, so the subtraction is
evaluated as size_t and wraps instead of going negative. Truncating
that to the u16 length parameter of libipw_parse_info_param() yields
65524 for a 24-byte beacon, and the parser then walks the receive
buffer as if it held almost 64 KiB of information elements, reading
past the allocation.
Reject the frame before any fixed field is touched.
Found by an AI-assisted review of length arithmetic in management frame
parsers. Verified with a KUnit case under Generic KASAN on arm64 under
QEMU; I do not have the hardware, so it is not tested on a real device.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b453872c35cfcbdbf5a794737817f7d4e7b1b579 Version: b453872c35cfcbdbf5a794737817f7d4e7b1b579 Version: b453872c35cfcbdbf5a794737817f7d4e7b1b579 Version: b453872c35cfcbdbf5a794737817f7d4e7b1b579 Version: b453872c35cfcbdbf5a794737817f7d4e7b1b579 Version: b453872c35cfcbdbf5a794737817f7d4e7b1b579 Version: b453872c35cfcbdbf5a794737817f7d4e7b1b579 Version: b453872c35cfcbdbf5a794737817f7d4e7b1b579 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/ipw2x00/libipw_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cee6f141b3bebe62eb0363fd147acb52023935f0",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "23afeb5d2bdfd34c8a0a661876291a4fa9978293",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "89959ff00a978f3172726d3d5f861ee6f1aae26d",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "14ae269c1306053ddf1ccf37c4bd66e085a652d1",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "ff756e6647722b7d225d882f7bdb186d8eee318e",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "2c87bbc00dc93149d1dc4f803ad92d92e4ef3758",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "19959fb60228f6dccc40d55507f8b1a751c2dc89",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "5ce5721e8cbe3e80db8f43851cc2a2a92485ef4b",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/ipw2x00/libipw_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"lessThan": "2.6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: reject too-short beacon and probe responses\n\nlibipw_process_probe_response() and the libipw_network_init() call it\nmakes assume the frame contains the full 36-byte beacon and probe\nresponse prefix, but the ipw2100 and ipw2200 receive paths only\nestablish that a management frame carries the generic 24-byte\nthree-address header.\n\nlibipw_network_init() then computes the information element length as\n\n\tstats-\u003elen - sizeof(*beacon)\n\nstats-\u003elen is a u16 and sizeof() has type size_t, so the subtraction is\nevaluated as size_t and wraps instead of going negative. Truncating\nthat to the u16 length parameter of libipw_parse_info_param() yields\n65524 for a 24-byte beacon, and the parser then walks the receive\nbuffer as if it held almost 64 KiB of information elements, reading\npast the allocation.\n\nReject the frame before any fixed field is touched.\n\nFound by an AI-assisted review of length arithmetic in management frame\nparsers. Verified with a KUnit case under Generic KASAN on arm64 under\nQEMU; I do not have the hardware, so it is not tested on a real device."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The malformed input is a beacon or probe response sent over the air. The ipw2100 isr_rx and ipw2200 ipw_rx paths only check for a 24-byte header before libipw_rx_mgt() passes the frame to libipw_process_probe_response(). This is an 802.11 management frame, so the attacker must be within radio range.\nAC:L - Any beacon or probe response shorter than the 36-byte libipw_probe_response prefix triggers the bug every time. In libipw_network_init(), stats-\u003elen - sizeof(*beacon) wraps to about 65524 when truncated to u16. The attacker can send such frames repeatedly, and periodic automatic scans make the driver process probe responses.\nPR:N - Beacons and probe responses are parsed before any association or authentication, so the sender needs no credentials or relationship with the victim station.\nUI:N - The driver processes management frames on its own once the interface is up, and periodic background scans process probe responses. No user action is needed.\nS:U - The out-of-bounds read happens in the kernel\u0027s libipw receive path, and its impact stays within the kernel\u0027s own security authority.\nC:L - libipw_parse_info_param() reads up to about 64 KiB of adjacent heap past the RX skb. It copies only capped pieces (SSID, rates, WPA/RSN IEs) into the stored libipw_network, which shows up in scan results. The remote sender cannot read this back, and the leaked contents are not under its control.\nI:N - This is a read-only overrun. Every copy in libipw_parse_info_param() is bounded by the destination size (min() on ssid_len, rates_len, wpa_ie_len, rsn_ie_len), so no kernel memory is written out of bounds.\nA:H - An unauthenticated sender can repeat the frame, and each one makes the parser read about 64 KiB past a roughly 3 KB RX buffer at a different heap position. That can reach unmapped memory and oops in the RX path, and it fires KASAN or KFENCE reports. Either one takes the system down."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:00.168Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cee6f141b3bebe62eb0363fd147acb52023935f0"
},
{
"url": "https://git.kernel.org/stable/c/23afeb5d2bdfd34c8a0a661876291a4fa9978293"
},
{
"url": "https://git.kernel.org/stable/c/89959ff00a978f3172726d3d5f861ee6f1aae26d"
},
{
"url": "https://git.kernel.org/stable/c/14ae269c1306053ddf1ccf37c4bd66e085a652d1"
},
{
"url": "https://git.kernel.org/stable/c/ff756e6647722b7d225d882f7bdb186d8eee318e"
},
{
"url": "https://git.kernel.org/stable/c/2c87bbc00dc93149d1dc4f803ad92d92e4ef3758"
},
{
"url": "https://git.kernel.org/stable/c/19959fb60228f6dccc40d55507f8b1a751c2dc89"
},
{
"url": "https://git.kernel.org/stable/c/5ce5721e8cbe3e80db8f43851cc2a2a92485ef4b"
}
],
"title": "wifi: libipw: reject too-short beacon and probe responses",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98349",
"datePublished": "2026-10-06T08:46:37.713Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-19T09:18:00.168Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97567 (GCVE-0-2026-97567)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: prevent race between disconnect() and rtx
Sashiko noted that the two event can race, leading to inconsistent
status. Prevent the race using the synchronous timer stop operation.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mptcp/protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "75b3b30ae4ee6aa0572595f6b48544ed4f479eb6",
"status": "affected",
"version": "b29fcfb54cd70caca5b11c80d8d238854938884a",
"versionType": "git"
},
{
"lessThan": "2261f857ef4e0d21eb1a8b47b06640cf7ab16d3e",
"status": "affected",
"version": "b29fcfb54cd70caca5b11c80d8d238854938884a",
"versionType": "git"
},
{
"lessThan": "374da2b9be1280695ce41f108334a8f16e3e54be",
"status": "affected",
"version": "b29fcfb54cd70caca5b11c80d8d238854938884a",
"versionType": "git"
},
{
"lessThan": "69a7b2a912672159dda7dcf325d27752d448dfdf",
"status": "affected",
"version": "b29fcfb54cd70caca5b11c80d8d238854938884a",
"versionType": "git"
},
{
"lessThan": "85c580b0d8590520ae00a15c29e9fb9c99427a3e",
"status": "affected",
"version": "b29fcfb54cd70caca5b11c80d8d238854938884a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mptcp/protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: prevent race between disconnect() and rtx\n\nSashiko noted that the two event can race, leading to inconsistent\nstatus. Prevent the race using the synchronous timer stop operation."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:20.333Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/75b3b30ae4ee6aa0572595f6b48544ed4f479eb6"
},
{
"url": "https://git.kernel.org/stable/c/2261f857ef4e0d21eb1a8b47b06640cf7ab16d3e"
},
{
"url": "https://git.kernel.org/stable/c/374da2b9be1280695ce41f108334a8f16e3e54be"
},
{
"url": "https://git.kernel.org/stable/c/69a7b2a912672159dda7dcf325d27752d448dfdf"
},
{
"url": "https://git.kernel.org/stable/c/85c580b0d8590520ae00a15c29e9fb9c99427a3e"
}
],
"title": "mptcp: prevent race between disconnect() and rtx",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97567",
"datePublished": "2026-09-25T10:21:53.677Z",
"dateReserved": "2026-09-24T16:01:01.155Z",
"dateUpdated": "2026-10-21T12:53:20.333Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98358 (GCVE-0-2026-98358)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/iser: reject a remote invalidation of an unregistered direction
A write command whose data is sent entirely as immediate data is not
registered. iser_reg_mem_fastreg() takes the DMA key path and leaves
rdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has
already set dir[ISER_DIR_OUT].
iser_check_remote_inv() looks at dir[] alone and hands the descriptor to
iser_inv_desc(), which reads desc->sig_protected. A target that answers
such a command with IB_WR_SEND_WITH_INV faults the initiator.
Leaving those commands unregistered is deliberate.
The same function already terminates the connection when a target sends
a remote invalidation the initiator did not ask for. A target that
invalidates a direction that was never registered is in the same class,
so give it the same answer.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: rxe_wq do_work
RIP: 0010:iser_task_rsp+0x6d6/0xec0
Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04
RSP: 0018:ffff88811b008db8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848
RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020
RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0
R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800
R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
<IRQ>
__ib_process_cq+0xe1/0x390
ib_poll_handler+0x6e/0x200
irq_poll_softirq+0x1df/0x480
? clockevents_program_event+0x2ba/0x860
? __pfx_irq_poll_softirq+0x10/0x10
handle_softirqs+0x18e/0x590
? __pfx_handle_softirqs+0x10/0x10
? __hrtimer_rearm_deferred+0x156/0x450
do_softirq+0x3b/0x60
</IRQ>
<TASK>
__local_bh_enable_ip+0x61/0x70
__alloc_skb+0x732/0x890
? _raw_spin_lock_irqsave+0x85/0xe0
? __pfx___alloc_skb+0x10/0x10
? _raw_read_unlock_irqrestore+0x16/0x50
rxe_init_packet+0x16b/0x4f0
prepare_ack_packet+0xb8/0x830
rxe_receiver+0x499/0x9980
? __pfx_rxe_receiver+0x10/0x10
? rxe_completer+0x29e5/0x38c0
? hrtimer_start_range_ns_common+0x75f/0x1730
? hrtimer_start_range_ns+0xa6/0x2c0
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? __pfx_rxe_receiver+0x10/0x10
do_work+0x144/0x470
process_one_work+0x633/0x1030
? assign_work+0x11d/0x370
worker_thread+0x45b/0xd10
? __pfx_worker_thread+0x10/0x10
kthread+0x2c6/0x3b0
? recalc_sigpending+0x15c/0x1e0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x36e/0x5a0
? __pfx_ret_from_fork+0x10/0x10
? __switch_to+0x572/0xdd0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 59caaed7a72a0e3750dfb84636dae6b781559310 Version: 59caaed7a72a0e3750dfb84636dae6b781559310 Version: 59caaed7a72a0e3750dfb84636dae6b781559310 Version: 59caaed7a72a0e3750dfb84636dae6b781559310 Version: 59caaed7a72a0e3750dfb84636dae6b781559310 Version: 59caaed7a72a0e3750dfb84636dae6b781559310 Version: 59caaed7a72a0e3750dfb84636dae6b781559310 Version: 59caaed7a72a0e3750dfb84636dae6b781559310 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/iser/iser_initiator.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "198e4db9add54a50cce60a5d80b8f0ee5456b65a",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "b9e37452915feaa8422af87dea5d0c16a7d1ff13",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "19ddd4af7fce9200e70882f622011e9dd130f427",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "9d145a2d8d6f8f2cc460b80df41870819048f2a0",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "b4d278c91209931199db9c0836dc2e21a7593dad",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "6ed3ebaff3345837f0528d85bd39ce573c7b9a41",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "ceecf3f9c322fc6937a66682942a26ad13a34a07",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "d85f0f0a7c85756fc992c70d869706f19dac9259",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/iser/iser_initiator.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/iser: reject a remote invalidation of an unregistered direction\n\nA write command whose data is sent entirely as immediate data is not\nregistered. iser_reg_mem_fastreg() takes the DMA key path and leaves\nrdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has\nalready set dir[ISER_DIR_OUT].\n\niser_check_remote_inv() looks at dir[] alone and hands the descriptor to\niser_inv_desc(), which reads desc-\u003esig_protected. A target that answers\nsuch a command with IB_WR_SEND_WITH_INV faults the initiator.\nLeaving those commands unregistered is deliberate.\n\nThe same function already terminates the connection when a target sends\na remote invalidation the initiator did not ask for. A target that\ninvalidates a direction that was never registered is in the same class,\nso give it the same answer.\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]\n CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy)\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Workqueue: rxe_wq do_work\n RIP: 0010:iser_task_rsp+0x6d6/0xec0\n Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 \u003c0f\u003e b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04\n RSP: 0018:ffff88811b008db8 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848\n RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020\n RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0\n R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800\n R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000\n FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0\n PKRU: 55555554\n Call Trace:\n \u003cIRQ\u003e\n __ib_process_cq+0xe1/0x390\n ib_poll_handler+0x6e/0x200\n irq_poll_softirq+0x1df/0x480\n ? clockevents_program_event+0x2ba/0x860\n ? __pfx_irq_poll_softirq+0x10/0x10\n handle_softirqs+0x18e/0x590\n ? __pfx_handle_softirqs+0x10/0x10\n ? __hrtimer_rearm_deferred+0x156/0x450\n do_softirq+0x3b/0x60\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0x61/0x70\n __alloc_skb+0x732/0x890\n ? _raw_spin_lock_irqsave+0x85/0xe0\n ? __pfx___alloc_skb+0x10/0x10\n ? _raw_read_unlock_irqrestore+0x16/0x50\n rxe_init_packet+0x16b/0x4f0\n prepare_ack_packet+0xb8/0x830\n rxe_receiver+0x499/0x9980\n ? __pfx_rxe_receiver+0x10/0x10\n ? rxe_completer+0x29e5/0x38c0\n ? hrtimer_start_range_ns_common+0x75f/0x1730\n ? hrtimer_start_range_ns+0xa6/0x2c0\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __pfx_rxe_receiver+0x10/0x10\n do_work+0x144/0x470\n process_one_work+0x633/0x1030\n ? assign_work+0x11d/0x370\n worker_thread+0x45b/0xd10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2c6/0x3b0\n ? recalc_sigpending+0x15c/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x36e/0x5a0\n ? __pfx_ret_from_fork+0x10/0x10\n ? __switch_to+0x572/0xdd0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n Modules linked in:\n ---[ end trace 0000000000000000 ]---"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:08.867Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/198e4db9add54a50cce60a5d80b8f0ee5456b65a"
},
{
"url": "https://git.kernel.org/stable/c/b9e37452915feaa8422af87dea5d0c16a7d1ff13"
},
{
"url": "https://git.kernel.org/stable/c/19ddd4af7fce9200e70882f622011e9dd130f427"
},
{
"url": "https://git.kernel.org/stable/c/9d145a2d8d6f8f2cc460b80df41870819048f2a0"
},
{
"url": "https://git.kernel.org/stable/c/b4d278c91209931199db9c0836dc2e21a7593dad"
},
{
"url": "https://git.kernel.org/stable/c/6ed3ebaff3345837f0528d85bd39ce573c7b9a41"
},
{
"url": "https://git.kernel.org/stable/c/ceecf3f9c322fc6937a66682942a26ad13a34a07"
},
{
"url": "https://git.kernel.org/stable/c/d85f0f0a7c85756fc992c70d869706f19dac9259"
}
],
"title": "IB/iser: reject a remote invalidation of an unregistered direction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98358",
"datePublished": "2026-10-06T08:46:45.128Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:08.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97537 (GCVE-0-2026-97537)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing
bugs exposed on the error path of qla25xx_create_{req,rsp}_que():
1. When dma_alloc_coherent() fails during queue creation, the error
path calls the free function with req->ring / rsp->ring still NULL
(from kzalloc). The unconditional dma_free_coherent() with a NULL
cpu_addr is undefined behavior and can panic.
2. The free functions clear req_qid_map / rsp_qid_map under vport_lock,
but the create functions protect the same bitmaps with mq_lock.
This provides no mutual exclusion. Additionally, the create error
path clears the bit and releases mq_lock before calling the free
function, creating a window where another thread can allocate the
same que_id and have its ha->req_q_map entry clobbered by the
subsequent lockless NULL assignment in the free function.
Fix by:
- Guarding dma_free_coherent() with a NULL check on the ring pointer.
- Using mq_lock (the lock held by all creators) in the free functions
to atomically NULL the map entry and clear the bitmap bit.
- Removing the now-redundant clear_bit blocks from the create error
paths since the free functions handle it atomically.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_mid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2e6f60adf609c77e828f64e0cd371920bef91c12",
"status": "affected",
"version": "73208dfd7ab19f379d73e8a0fbf30f92c203e5e8",
"versionType": "git"
},
{
"lessThan": "56e25d716833604fd5bff388e472f290bfe793aa",
"status": "affected",
"version": "73208dfd7ab19f379d73e8a0fbf30f92c203e5e8",
"versionType": "git"
},
{
"lessThan": "f35cb67f2092b49d7949065dd56895ed47238f22",
"status": "affected",
"version": "73208dfd7ab19f379d73e8a0fbf30f92c203e5e8",
"versionType": "git"
},
{
"lessThan": "94fc0c5b45de2bf3a691619bcfd10b9a49fc647e",
"status": "affected",
"version": "73208dfd7ab19f379d73e8a0fbf30f92c203e5e8",
"versionType": "git"
},
{
"lessThan": "34a40e0dff940ac5eba494a69b553ea571e24873",
"status": "affected",
"version": "73208dfd7ab19f379d73e8a0fbf30f92c203e5e8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_mid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking\n\nqla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing\nbugs exposed on the error path of qla25xx_create_{req,rsp}_que():\n\n 1. When dma_alloc_coherent() fails during queue creation, the error\n path calls the free function with req-\u003ering / rsp-\u003ering still NULL\n (from kzalloc). The unconditional dma_free_coherent() with a NULL\n cpu_addr is undefined behavior and can panic.\n\n 2. The free functions clear req_qid_map / rsp_qid_map under vport_lock,\n but the create functions protect the same bitmaps with mq_lock.\n This provides no mutual exclusion. Additionally, the create error\n path clears the bit and releases mq_lock before calling the free\n function, creating a window where another thread can allocate the\n same que_id and have its ha-\u003ereq_q_map entry clobbered by the\n subsequent lockless NULL assignment in the free function.\n\nFix by:\n\n - Guarding dma_free_coherent() with a NULL check on the ring pointer.\n\n - Using mq_lock (the lock held by all creators) in the free functions\n to atomically NULL the map entry and clear the bitmap bit.\n\n - Removing the now-redundant clear_bit blocks from the create error\n paths since the free functions handle it atomically."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:12.722Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2e6f60adf609c77e828f64e0cd371920bef91c12"
},
{
"url": "https://git.kernel.org/stable/c/56e25d716833604fd5bff388e472f290bfe793aa"
},
{
"url": "https://git.kernel.org/stable/c/f35cb67f2092b49d7949065dd56895ed47238f22"
},
{
"url": "https://git.kernel.org/stable/c/94fc0c5b45de2bf3a691619bcfd10b9a49fc647e"
},
{
"url": "https://git.kernel.org/stable/c/34a40e0dff940ac5eba494a69b553ea571e24873"
}
],
"title": "scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97537",
"datePublished": "2026-09-25T10:21:35.608Z",
"dateReserved": "2026-09-24T16:01:01.153Z",
"dateUpdated": "2026-10-21T12:53:12.722Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98200 (GCVE-0-2026-98200)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
nsensor->current_state is dynamically replaced as the sensor's state
changes. update_numeric_sensor_from_wobj() does this by freeing the
old string and installing a new one:
if (strcmp(trimmed, nsensor->current_state)) {
new_string = hp_wmi_strdup(dev, trimmed);
if (new_string) {
devm_kfree(dev, nsensor->current_state);
nsensor->current_state = new_string;
}
}
This function is only ever called from hp_wmi_update_info() while
state->lock is held, so the free-and-replace itself is properly
serialized against concurrent updates.
fungible_show(), however, reads the same pointer after the lock has
already been dropped:
err = hp_wmi_update_info(state, info);
if (err)
return err;
switch (prop) {
...
case HP_WMI_PROPERTY_CURRENT_STATE:
seq_printf(seqf, "%s\n", nsensor->current_state);
break;
hp_wmi_update_info() takes state->lock internally and releases it
before returning, so by the time fungible_show() dereferences
nsensor->current_state in seq_printf(), no lock is held. Two
processes reading a sensor's current_state debugfs entry at
overlapping times (or one reading it while another read of the same
sensor triggers a refresh) can race: one thread's seq_printf() can
be part-way through printing the string at the moment another
thread's call into update_numeric_sensor_from_wobj() frees it with
devm_kfree() and installs a new pointer, causing a use-after-free
read.
Take state->lock around the read in fungible_show() as well, so it
can never run concurrently with the free-and-replace in
update_numeric_sensor_from_wobj().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/hp-wmi-sensors.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b6b2a638aa36c441b2c8d0b6bd8ed2bb9701e795",
"status": "affected",
"version": "23902f98f8d4811ab84dde6419569a5b374f8122",
"versionType": "git"
},
{
"lessThan": "f59ecfd2c58bace39538f3fff7f43788b3fdb539",
"status": "affected",
"version": "23902f98f8d4811ab84dde6419569a5b374f8122",
"versionType": "git"
},
{
"lessThan": "72c85149794a1ccf8d718ffed1521106b5d31968",
"status": "affected",
"version": "23902f98f8d4811ab84dde6419569a5b374f8122",
"versionType": "git"
},
{
"lessThan": "9c1e65bc79ff104914b11e6ad972139296ec86fe",
"status": "affected",
"version": "23902f98f8d4811ab84dde6419569a5b374f8122",
"versionType": "git"
},
{
"lessThan": "e6cb0b4d4ecb8e71fd2200d907ab2e9663356f69",
"status": "affected",
"version": "23902f98f8d4811ab84dde6419569a5b374f8122",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/hp-wmi-sensors.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()\n\nnsensor-\u003ecurrent_state is dynamically replaced as the sensor\u0027s state\nchanges. update_numeric_sensor_from_wobj() does this by freeing the\nold string and installing a new one:\n\n\tif (strcmp(trimmed, nsensor-\u003ecurrent_state)) {\n\t\tnew_string = hp_wmi_strdup(dev, trimmed);\n\t\tif (new_string) {\n\t\t\tdevm_kfree(dev, nsensor-\u003ecurrent_state);\n\t\t\tnsensor-\u003ecurrent_state = new_string;\n\t\t}\n\t}\n\nThis function is only ever called from hp_wmi_update_info() while\nstate-\u003elock is held, so the free-and-replace itself is properly\nserialized against concurrent updates.\n\nfungible_show(), however, reads the same pointer after the lock has\nalready been dropped:\n\n\terr = hp_wmi_update_info(state, info);\n\tif (err)\n\t\treturn err;\n\n\tswitch (prop) {\n\t...\n\tcase HP_WMI_PROPERTY_CURRENT_STATE:\n\t\tseq_printf(seqf, \"%s\\n\", nsensor-\u003ecurrent_state);\n\t\tbreak;\n\nhp_wmi_update_info() takes state-\u003elock internally and releases it\nbefore returning, so by the time fungible_show() dereferences\nnsensor-\u003ecurrent_state in seq_printf(), no lock is held. Two\nprocesses reading a sensor\u0027s current_state debugfs entry at\noverlapping times (or one reading it while another read of the same\nsensor triggers a refresh) can race: one thread\u0027s seq_printf() can\nbe part-way through printing the string at the moment another\nthread\u0027s call into update_numeric_sensor_from_wobj() frees it with\ndevm_kfree() and installs a new pointer, causing a use-after-free\nread.\n\nTake state-\u003elock around the read in fungible_show() as well, so it\ncan never run concurrently with the free-and-replace in\nupdate_numeric_sensor_from_wobj()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:31.295Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b6b2a638aa36c441b2c8d0b6bd8ed2bb9701e795"
},
{
"url": "https://git.kernel.org/stable/c/f59ecfd2c58bace39538f3fff7f43788b3fdb539"
},
{
"url": "https://git.kernel.org/stable/c/72c85149794a1ccf8d718ffed1521106b5d31968"
},
{
"url": "https://git.kernel.org/stable/c/9c1e65bc79ff104914b11e6ad972139296ec86fe"
},
{
"url": "https://git.kernel.org/stable/c/e6cb0b4d4ecb8e71fd2200d907ab2e9663356f69"
}
],
"title": "hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98200",
"datePublished": "2026-10-06T08:44:38.289Z",
"dateReserved": "2026-09-25T10:25:14.324Z",
"dateUpdated": "2026-10-19T09:15:31.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98413 (GCVE-0-2026-98413)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
selinux: always fill AVC decision in avc_has_perm_noaudit()
avc_has_perm_noaudit() is documented to return a copy of the access
decision in @avd, but its early return for an empty requested permission
set leaves the buffer untouched. All callers pass an uninitialized
stack variable and afterwards feed it to avc_audit(), and the inode hook
even stores it in the per-task decision cache.
Fill in a deny-all, audit-all decision, similar to avd_init(), so every
caller receives a defined value at no cost on the hot path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e6f2f381e4015386a656a369835f949c26000e6b Version: e6f2f381e4015386a656a369835f949c26000e6b Version: e6f2f381e4015386a656a369835f949c26000e6b Version: e6f2f381e4015386a656a369835f949c26000e6b Version: e6f2f381e4015386a656a369835f949c26000e6b Version: e6f2f381e4015386a656a369835f949c26000e6b Version: e6f2f381e4015386a656a369835f949c26000e6b Version: e6f2f381e4015386a656a369835f949c26000e6b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/selinux/avc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c781e737aa0de95289b1774d5fd29388895737a9",
"status": "affected",
"version": "e6f2f381e4015386a656a369835f949c26000e6b",
"versionType": "git"
},
{
"lessThan": "e308c5acfe283a66627fc407065626df4ab753ec",
"status": "affected",
"version": "e6f2f381e4015386a656a369835f949c26000e6b",
"versionType": "git"
},
{
"lessThan": "f9da796fa238f8e4414ee8481e6c979759a3d563",
"status": "affected",
"version": "e6f2f381e4015386a656a369835f949c26000e6b",
"versionType": "git"
},
{
"lessThan": "e77461af13eab5c9a953cc52ec8432cc941d61e2",
"status": "affected",
"version": "e6f2f381e4015386a656a369835f949c26000e6b",
"versionType": "git"
},
{
"lessThan": "5a6f9a872b4ff68877caf998bee352153b7154bc",
"status": "affected",
"version": "e6f2f381e4015386a656a369835f949c26000e6b",
"versionType": "git"
},
{
"lessThan": "24e00850bcff46b984f4c44b92e5499450fcfb5a",
"status": "affected",
"version": "e6f2f381e4015386a656a369835f949c26000e6b",
"versionType": "git"
},
{
"lessThan": "835133337c2ce200db56f62d018c79087dee2603",
"status": "affected",
"version": "e6f2f381e4015386a656a369835f949c26000e6b",
"versionType": "git"
},
{
"lessThan": "8861db305103107199b1426f25fde1fb6d465583",
"status": "affected",
"version": "e6f2f381e4015386a656a369835f949c26000e6b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/selinux/avc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: always fill AVC decision in avc_has_perm_noaudit()\n\navc_has_perm_noaudit() is documented to return a copy of the access\ndecision in @avd, but its early return for an empty requested permission\nset leaves the buffer untouched. All callers pass an uninitialized\nstack variable and afterwards feed it to avc_audit(), and the inode hook\neven stores it in the per-task decision cache.\n\nFill in a deny-all, audit-all decision, similar to avd_init(), so every\ncaller receives a defined value at no cost on the hot path."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:07.242Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c781e737aa0de95289b1774d5fd29388895737a9"
},
{
"url": "https://git.kernel.org/stable/c/e308c5acfe283a66627fc407065626df4ab753ec"
},
{
"url": "https://git.kernel.org/stable/c/f9da796fa238f8e4414ee8481e6c979759a3d563"
},
{
"url": "https://git.kernel.org/stable/c/e77461af13eab5c9a953cc52ec8432cc941d61e2"
},
{
"url": "https://git.kernel.org/stable/c/5a6f9a872b4ff68877caf998bee352153b7154bc"
},
{
"url": "https://git.kernel.org/stable/c/24e00850bcff46b984f4c44b92e5499450fcfb5a"
},
{
"url": "https://git.kernel.org/stable/c/835133337c2ce200db56f62d018c79087dee2603"
},
{
"url": "https://git.kernel.org/stable/c/8861db305103107199b1426f25fde1fb6d465583"
}
],
"title": "selinux: always fill AVC decision in avc_has_perm_noaudit()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98413",
"datePublished": "2026-10-14T13:27:45.404Z",
"dateReserved": "2026-09-25T10:25:14.347Z",
"dateUpdated": "2026-10-19T09:19:07.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98216 (GCVE-0-2026-98216)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/hfi1: Fix the PIO_CRED credit-return mmap
hfi1_file_mmap()'s PIO_CRED case must hand user space the single
credit-return page that holds this context's entry. That page is the
second or third page of the per-node credit-return allocation once the
hardware send context index reaches 64 or 128, so the failure below is
intermittent: when the entry lands on the first page the offset is zero
and everything works.
Two things are wrong.
First, cr_page_offset is a byte offset but .va is a struct
credit_return *, so adding it is pointer arithmetic and scales the offset
by sizeof(struct credit_return) == 64. memvirt then lands 256 KiB or
512 KiB past a 10240-byte allocation. With an IOMMU translating, that
address is inside the vmalloc range but in no vm_area, so
dma_mmap_coherent() -> iommu_dma_mmap() finds no pages, vmalloc_to_pfn()
returns page_to_pfn(NULL), and remap_pfn_range() installs a frame above
MAXPHYADDR. The first user read then takes:
psm2_ep_open_pr: Corrupted page table at address 7a14d007e000
PGD 800000013886a067 P4D 800000013886a067 PUD 13886b067 PMD 13886c067
PTE 800049168e911235
Oops: Bad pagetable: 000d [#1] SMP PTI
Second, and still wrong once the arithmetic is corrected,
dma_mmap_coherent() describes a whole coherent buffer and selects the
page within it with vma->vm_pgoff. Offsetting cpu_addr has no effect:
for a vmap'd allocation iommu_dma_mmap() uses cpu_addr only to locate the
vm_area and then maps pages[vm_pgoff], which hfi1_file_mmap() has just
set to 0. User space therefore always receives the first credit-return
page, every credit read is for the wrong context, and send PIO stalls
forever.
Use the DMA API as intended: pass the base of the allocation with its
full length and select the page with vm_pgoff. A separate length is
needed because memlen must keep describing the VMA for the existing size
check. The dma-direct path stays correct as well, since dma_direct_mmap()
adds the same vm_pgoff to the base pfn.
Tested on a Dell T7610 (Xeon E5-2650 v2, Intel IOMMU in DMA-FQ mode)
against a Threadripper PRO 3995WX peer, both Omni-Path 100. Before this
change psm2_ep_open() Oopses the kernel; with only the arithmetic
corrected psm2_ep_open() succeeds but any transfer that uses send PIO
hangs, PSM2_SDMA=2 (send PIO disabled) completing normally while
PSM2_SDMA=0 (send PIO only) hangs every time. With this change send PIO,
send DMA and the default mixed mode all work.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/hfi1/file_ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "535530bb2ea5254e1e9f55280143d262dd065204",
"status": "affected",
"version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
"versionType": "git"
},
{
"lessThan": "dcebe0b0bb080a25fe08011fd6b6e741f7912f01",
"status": "affected",
"version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
"versionType": "git"
},
{
"lessThan": "180752deb7270ad37394ab6ef7cf4978fad040b3",
"status": "affected",
"version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
"versionType": "git"
},
{
"lessThan": "bafeac9ce5d1ce5256bcf7e5702e831e9aaf419b",
"status": "affected",
"version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
"versionType": "git"
},
{
"lessThan": "62f0f34fbd2b2d5653d33d3b9d42fdcabb1c0101",
"status": "affected",
"version": "1ec82317a1daac78c04b0c15af89018ccf9fa2b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/hfi1/file_ops.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/hfi1: Fix the PIO_CRED credit-return mmap\n\nhfi1_file_mmap()\u0027s PIO_CRED case must hand user space the single\ncredit-return page that holds this context\u0027s entry. That page is the\nsecond or third page of the per-node credit-return allocation once the\nhardware send context index reaches 64 or 128, so the failure below is\nintermittent: when the entry lands on the first page the offset is zero\nand everything works.\n\nTwo things are wrong.\n\nFirst, cr_page_offset is a byte offset but .va is a struct\ncredit_return *, so adding it is pointer arithmetic and scales the offset\nby sizeof(struct credit_return) == 64. memvirt then lands 256 KiB or\n512 KiB past a 10240-byte allocation. With an IOMMU translating, that\naddress is inside the vmalloc range but in no vm_area, so\ndma_mmap_coherent() -\u003e iommu_dma_mmap() finds no pages, vmalloc_to_pfn()\nreturns page_to_pfn(NULL), and remap_pfn_range() installs a frame above\nMAXPHYADDR. The first user read then takes:\n\n psm2_ep_open_pr: Corrupted page table at address 7a14d007e000\n PGD 800000013886a067 P4D 800000013886a067 PUD 13886b067 PMD 13886c067\n PTE 800049168e911235\n Oops: Bad pagetable: 000d [#1] SMP PTI\n\nSecond, and still wrong once the arithmetic is corrected,\ndma_mmap_coherent() describes a whole coherent buffer and selects the\npage within it with vma-\u003evm_pgoff. Offsetting cpu_addr has no effect:\nfor a vmap\u0027d allocation iommu_dma_mmap() uses cpu_addr only to locate the\nvm_area and then maps pages[vm_pgoff], which hfi1_file_mmap() has just\nset to 0. User space therefore always receives the first credit-return\npage, every credit read is for the wrong context, and send PIO stalls\nforever.\n\nUse the DMA API as intended: pass the base of the allocation with its\nfull length and select the page with vm_pgoff. A separate length is\nneeded because memlen must keep describing the VMA for the existing size\ncheck. The dma-direct path stays correct as well, since dma_direct_mmap()\nadds the same vm_pgoff to the base pfn.\n\nTested on a Dell T7610 (Xeon E5-2650 v2, Intel IOMMU in DMA-FQ mode)\nagainst a Threadripper PRO 3995WX peer, both Omni-Path 100. Before this\nchange psm2_ep_open() Oopses the kernel; with only the arithmetic\ncorrected psm2_ep_open() succeeds but any transfer that uses send PIO\nhangs, PSM2_SDMA=2 (send PIO disabled) completing normally while\nPSM2_SDMA=0 (send PIO only) hangs every time. With this change send PIO,\nsend DMA and the default mixed mode all work."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bad mapping is created by hfi1_file_mmap() PIO_CRED case, reached by a local process via open() of the /dev/hfi1_N user cdev, the ASSIGN_CTXT ioctl and mmap() of the PIO_CRED token; no remote peer supplies any data to this path.\nAC:L - With IOMMU DMA translation (common on x86 servers), the pointer-scaled cr_page_offset deterministically sends memvirt 256/512 KiB past the credit-return buffer for send context index \u003e=64, and the attacker can raise the index by opening more contexts; the commit\u0027s reproducer oopses every time.\nPR:L - hfi1_user_devnode() creates the user device node with mode 0666 and hfi1_file_open() has no capability check, so any unprivileged local user on an Omni-Path node (e.g. a shared HPC node) can assign a context and issue the mmap.\nUI:N - The attacker triggers the faulty mapping and the faulting read entirely from their own process; no other user or administrator has to do anything.\nS:U - Both impacts stay within the host kernel\u0027s own authority: a kernel page or bogus PFN is mapped into a local process and the kernel oopses; no VM, IOMMU or sandbox boundary is crossed.\nC:H - If the out-of-range vmalloc address lands in a non-DMA-coherent vm_area, iommu_dma_mmap() falls back to vmalloc_to_pfn() and remap_pfn_range() exposes that kernel page to userspace read-only with no reference held, so the user can read unrelated kernel memory, even after it is freed and reused.\nI:N - The PIO_CRED VMA is read-only: VM_WRITE is rejected with -EPERM and VM_MAYWRITE is cleared, so the mis-mapped page cannot be written from userspace, and the bug gives no kernel write primitive.\nA:H - When the address falls in a vmalloc hole, page_to_pfn(NULL) installs a PTE for a frame above MAXPHYADDR and the first user read causes an \u0027Oops: Bad pagetable\u0027 kernel crash; even with the arithmetic fixed, mapping the wrong page leaves send PIO hung forever."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:47.022Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/535530bb2ea5254e1e9f55280143d262dd065204"
},
{
"url": "https://git.kernel.org/stable/c/dcebe0b0bb080a25fe08011fd6b6e741f7912f01"
},
{
"url": "https://git.kernel.org/stable/c/180752deb7270ad37394ab6ef7cf4978fad040b3"
},
{
"url": "https://git.kernel.org/stable/c/bafeac9ce5d1ce5256bcf7e5702e831e9aaf419b"
},
{
"url": "https://git.kernel.org/stable/c/62f0f34fbd2b2d5653d33d3b9d42fdcabb1c0101"
}
],
"title": "IB/hfi1: Fix the PIO_CRED credit-return mmap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98216",
"datePublished": "2026-10-06T08:44:52.288Z",
"dateReserved": "2026-09-25T10:25:14.326Z",
"dateUpdated": "2026-10-19T09:15:47.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98275 (GCVE-0-2026-98275)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: cortina: Ack RX overrun interrupt correctly
The RX overrun interrupt is reported in interrupt status register 4, but
gmac_irq() acknowledges it using the RX descriptor error bit from status
register 0. For GMAC0 this writes the GMAC1 overrun bit, while for GMAC1
the shift leaves no bit in the 32-bit register.
Acknowledge the same per-port RX overrun bit that was detected.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 Version: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 Version: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 Version: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 Version: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 Version: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 Version: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 Version: 4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cortina/gemini.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1163cc82dcbc145f912bf2106ab668762f53e483",
"status": "affected",
"version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
"versionType": "git"
},
{
"lessThan": "12a0c7bb448c1899ea3d8f97fa47a8740044e16d",
"status": "affected",
"version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
"versionType": "git"
},
{
"lessThan": "d72d87926ca33c6766dc73ace46859d7220a45bb",
"status": "affected",
"version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
"versionType": "git"
},
{
"lessThan": "472493d1d3334d104b9873abc1c2d80ed3b144f3",
"status": "affected",
"version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
"versionType": "git"
},
{
"lessThan": "2f23fa11fef9b4a93335894379d82238f0a28228",
"status": "affected",
"version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
"versionType": "git"
},
{
"lessThan": "4f33e036e827f368cdb10bcb15ad098448aca0f5",
"status": "affected",
"version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
"versionType": "git"
},
{
"lessThan": "d4bd670454390aab72ab9fb7b73bce2966c33fe3",
"status": "affected",
"version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
"versionType": "git"
},
{
"lessThan": "1dd85662fee6e2ac580b1c4f9a0c0a7ae6e31f0e",
"status": "affected",
"version": "4d5ae32f5e1e13f7f36d6439ec3257993b9f5b88",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cortina/gemini.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: cortina: Ack RX overrun interrupt correctly\n\nThe RX overrun interrupt is reported in interrupt status register 4, but\ngmac_irq() acknowledges it using the RX descriptor error bit from status\nregister 0. For GMAC0 this writes the GMAC1 overrun bit, while for GMAC1\nthe shift leaves no bit in the 32-bit register.\n\nAcknowledge the same per-port RX overrun bit that was detected."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:46.876Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1163cc82dcbc145f912bf2106ab668762f53e483"
},
{
"url": "https://git.kernel.org/stable/c/12a0c7bb448c1899ea3d8f97fa47a8740044e16d"
},
{
"url": "https://git.kernel.org/stable/c/d72d87926ca33c6766dc73ace46859d7220a45bb"
},
{
"url": "https://git.kernel.org/stable/c/472493d1d3334d104b9873abc1c2d80ed3b144f3"
},
{
"url": "https://git.kernel.org/stable/c/2f23fa11fef9b4a93335894379d82238f0a28228"
},
{
"url": "https://git.kernel.org/stable/c/4f33e036e827f368cdb10bcb15ad098448aca0f5"
},
{
"url": "https://git.kernel.org/stable/c/d4bd670454390aab72ab9fb7b73bce2966c33fe3"
},
{
"url": "https://git.kernel.org/stable/c/1dd85662fee6e2ac580b1c4f9a0c0a7ae6e31f0e"
}
],
"title": "net: ethernet: cortina: Ack RX overrun interrupt correctly",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98275",
"datePublished": "2026-10-06T08:45:36.081Z",
"dateReserved": "2026-09-25T10:25:14.334Z",
"dateUpdated": "2026-10-19T09:16:46.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93285 (GCVE-0-2026-93285)
Vulnerability from cvelistv5
Published
2026-09-24 16:02
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: embed f2fs_gc_kthread in f2fs_sb_info
Instead of allocating f2fs_gc_kthread dynamically, embed it in
f2fs_sb_info. This simplifies lifetime management and prepares for
fixing race conditions during teardown.
- __sbi_store - remount|shutdown
- f2fs_stop_gc_thread
- access sbi->gc_thread
- sbi->gc_thread = NULL
- access sbi->gc_thread->f2fs_gc_task
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/debug.c",
"fs/f2fs/f2fs.h",
"fs/f2fs/gc.c",
"fs/f2fs/gc.h",
"fs/f2fs/segment.c",
"fs/f2fs/super.c",
"fs/f2fs/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc004a1107e2c44cbdd2f1b1c2c85d32adc8f731",
"status": "affected",
"version": "7950e9ac638e84518fbdd5c930939ad46a1068c5",
"versionType": "git"
},
{
"lessThan": "7ee6be9ee7f9a803e0f539af26ab1154fdde48ba",
"status": "affected",
"version": "7950e9ac638e84518fbdd5c930939ad46a1068c5",
"versionType": "git"
},
{
"lessThan": "23eee01c732ec8c62b05416a05f0f88129df2960",
"status": "affected",
"version": "7950e9ac638e84518fbdd5c930939ad46a1068c5",
"versionType": "git"
},
{
"lessThan": "99d14d61aa8beb6cb9a984b9fcddd45e35b24494",
"status": "affected",
"version": "7950e9ac638e84518fbdd5c930939ad46a1068c5",
"versionType": "git"
},
{
"lessThan": "3d7bca9d583793bb7d0bac0d95a24ddd2e129eed",
"status": "affected",
"version": "7950e9ac638e84518fbdd5c930939ad46a1068c5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/debug.c",
"fs/f2fs/f2fs.h",
"fs/f2fs/gc.c",
"fs/f2fs/gc.h",
"fs/f2fs/segment.c",
"fs/f2fs/super.c",
"fs/f2fs/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: embed f2fs_gc_kthread in f2fs_sb_info\n\nInstead of allocating f2fs_gc_kthread dynamically, embed it in\nf2fs_sb_info. This simplifies lifetime management and prepares for\nfixing race conditions during teardown.\n\n- __sbi_store\t\t\t- remount|shutdown\n\t\t\t\t - f2fs_stop_gc_thread\n - access sbi-\u003egc_thread\n\t\t\t\t - sbi-\u003egc_thread = NULL\n - access sbi-\u003egc_thread-\u003ef2fs_gc_task"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:35.350Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc004a1107e2c44cbdd2f1b1c2c85d32adc8f731"
},
{
"url": "https://git.kernel.org/stable/c/7ee6be9ee7f9a803e0f539af26ab1154fdde48ba"
},
{
"url": "https://git.kernel.org/stable/c/23eee01c732ec8c62b05416a05f0f88129df2960"
},
{
"url": "https://git.kernel.org/stable/c/99d14d61aa8beb6cb9a984b9fcddd45e35b24494"
},
{
"url": "https://git.kernel.org/stable/c/3d7bca9d583793bb7d0bac0d95a24ddd2e129eed"
}
],
"title": "f2fs: embed f2fs_gc_kthread in f2fs_sb_info",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93285",
"datePublished": "2026-09-24T16:02:09.388Z",
"dateReserved": "2026-09-17T16:02:15.099Z",
"dateUpdated": "2026-10-21T12:52:35.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98299 (GCVE-0-2026-98299)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: do not let tcp_rmem be set below 4096
We can hit a division by zero crash in tcp_rcvbuf_grow()
and tcp_rcv_space_adjust():
divide error: 0000 [#1] PREEMPT SMP
RIP: 0010:tcp_rcvbuf_grow+0x187/0x450 net/ipv4/tcp_input.c:939
...
grow = div_u64(((u64)rcvwin << 1) * (newval - oldval), oldval);
The division uses oldval = tp->rcvq_space.space as divisor.
When tp->rcvq_space.space is zero, this leads to a divide-by-zero
exception.
tp->rcvq_space.space is initialized in tcp_init_buffer_space():
tp->rcvq_space.space = min3(tp->rcv_ssthresh, tp->rcv_wnd,
(u32)TCP_INIT_CWND * tp->advmss);
If tcp_rmem[1] is configured to very small values (such as 1),
sk->sk_rcvbuf is initialized to 1. Then tcp_full_space(sk), which
computes (sk->sk_rcvbuf * scaling_ratio) >> 8, truncates to 0.
This sets tp->window_clamp = 0, tp->rcv_ssthresh = 0, and
tp->rcvq_space.space = 0. Later, when data arrives and DRS is invoked,
tcp_rcvbuf_grow() divides by oldval == 0.
Back in 2015, commit b1cb59cf2efe ("net: sysctl_net_core: check SNDBUF
and RCVBUF for min length") ensured that net.core.rmem_default and
net.core.rmem_max cannot be set below SOCK_MIN_RCVBUF. Similarly,
SO_RCVBUF setsockopt enforces max_t(int, val * 2, SOCK_MIN_RCVBUF).
However, net.ipv4.tcp_rmem still had .extra1 = SYSCTL_ONE, allowing
arbitrarily small values.
Because SOCK_MIN_RCVBUF depends on sizeof(struct sk_buff) and cacheline
alignment, its value varies across architectures and configuration options.
Using a fixed constant of 4096 ensures a predictable, architecture-
independent lower bound that is safely above SOCK_MIN_RCVBUF everywhere
and matches the documented 4K default.
Fix this by setting tcp_rmem.extra1 to 4096 and updating the documentation.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"Documentation/networking/ip-sysctl.rst",
"net/ipv4/sysctl_net_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "879907631b9e70eedb62d76461b29afa106ebe7a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8e32532d0fa3191ecf9524b0e6bafa0832e712ba",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "67b83c15bed9eeeb8d1a6dbf88a5f79525970173",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9a4f49bf8d2da4e52e904f60c29cca317bab9b3a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "60df201dbb19a1bf6478b56d100f7ae1fe90e46a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7898bda1ebc198f5559b301a96dd5398edd4d4d3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1c4bb940c3bb4325bb88ac1b7eaf5faaa39e7d63",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "83a945a529d6e002dd7339c532288a931f463dba",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"Documentation/networking/ip-sysctl.rst",
"net/ipv4/sysctl_net_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: do not let tcp_rmem be set below 4096\n\nWe can hit a division by zero crash in tcp_rcvbuf_grow()\nand tcp_rcv_space_adjust():\n\ndivide error: 0000 [#1] PREEMPT SMP\nRIP: 0010:tcp_rcvbuf_grow+0x187/0x450 net/ipv4/tcp_input.c:939\n...\ngrow = div_u64(((u64)rcvwin \u003c\u003c 1) * (newval - oldval), oldval);\n\nThe division uses oldval = tp-\u003ercvq_space.space as divisor.\nWhen tp-\u003ercvq_space.space is zero, this leads to a divide-by-zero\nexception.\n\ntp-\u003ercvq_space.space is initialized in tcp_init_buffer_space():\n tp-\u003ercvq_space.space = min3(tp-\u003ercv_ssthresh, tp-\u003ercv_wnd,\n (u32)TCP_INIT_CWND * tp-\u003eadvmss);\n\nIf tcp_rmem[1] is configured to very small values (such as 1),\nsk-\u003esk_rcvbuf is initialized to 1. Then tcp_full_space(sk), which\ncomputes (sk-\u003esk_rcvbuf * scaling_ratio) \u003e\u003e 8, truncates to 0.\nThis sets tp-\u003ewindow_clamp = 0, tp-\u003ercv_ssthresh = 0, and\ntp-\u003ercvq_space.space = 0. Later, when data arrives and DRS is invoked,\ntcp_rcvbuf_grow() divides by oldval == 0.\n\nBack in 2015, commit b1cb59cf2efe (\"net: sysctl_net_core: check SNDBUF\nand RCVBUF for min length\") ensured that net.core.rmem_default and\nnet.core.rmem_max cannot be set below SOCK_MIN_RCVBUF. Similarly,\nSO_RCVBUF setsockopt enforces max_t(int, val * 2, SOCK_MIN_RCVBUF).\n\nHowever, net.ipv4.tcp_rmem still had .extra1 = SYSCTL_ONE, allowing\narbitrarily small values.\n\nBecause SOCK_MIN_RCVBUF depends on sizeof(struct sk_buff) and cacheline\nalignment, its value varies across architectures and configuration options.\nUsing a fixed constant of 4096 ensures a predictable, architecture-\nindependent lower bound that is safely above SOCK_MIN_RCVBUF everywhere\nand matches the documented 4K default.\n\nFix this by setting tcp_rmem.extra1 to 4096 and updating the documentation."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:10.154Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/879907631b9e70eedb62d76461b29afa106ebe7a"
},
{
"url": "https://git.kernel.org/stable/c/8e32532d0fa3191ecf9524b0e6bafa0832e712ba"
},
{
"url": "https://git.kernel.org/stable/c/67b83c15bed9eeeb8d1a6dbf88a5f79525970173"
},
{
"url": "https://git.kernel.org/stable/c/9a4f49bf8d2da4e52e904f60c29cca317bab9b3a"
},
{
"url": "https://git.kernel.org/stable/c/60df201dbb19a1bf6478b56d100f7ae1fe90e46a"
},
{
"url": "https://git.kernel.org/stable/c/7898bda1ebc198f5559b301a96dd5398edd4d4d3"
},
{
"url": "https://git.kernel.org/stable/c/1c4bb940c3bb4325bb88ac1b7eaf5faaa39e7d63"
},
{
"url": "https://git.kernel.org/stable/c/83a945a529d6e002dd7339c532288a931f463dba"
}
],
"title": "tcp: do not let tcp_rmem be set below 4096",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98299",
"datePublished": "2026-10-06T08:45:57.226Z",
"dateReserved": "2026-09-25T10:25:14.337Z",
"dateUpdated": "2026-10-19T09:17:10.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97603 (GCVE-0-2026-97603)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-19 09:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
idpf: disable DIM work before freeing q_vectors
idpf never drains the Tx/Rx DIM works before freeing the memory they
live in. tx_dim and rx_dim are embedded in struct idpf_q_vector, they
are queued from the NAPI poll via net_dim(), and idpf_vport_intr_rel()
ends with kfree(rsrc->q_vectors). Nothing in the driver cancels them.
idpf_tx_dim_work() and idpf_rx_dim_work() then run on freed memory:
idpf_vport_intr_write_itr() writes the ITR register through
q_vector->intr_reg.tx_itr / rx_itr, void __iomem pointers loaded out of
the freed q_vector. No configuration is needed to get there --
IDPF_ITR_IS_DYNAMIC() is defined as (itr_mode) and idpf_vport_alloc()
initialises both modes to IDPF_ITR_DYNAMIC.
Draining after idpf_vport_intr_napi_dis_all() is not enough on its own.
idpf_net_dim() is called from inside the
"if (napi_complete_done(napi, work_done))" branch of the poll, and
napi_complete_done() has already cleared NAPIF_STATE_SCHED by then.
napi_disable_locked() waits only while (val & (NAPIF_STATE_SCHED |
NAPIF_STATE_NPSVC)), so napi_disable() can return while the poll tail is
still queueing the work, and a plain cancel_work_sync() would be
re-armed behind the drain.
Use disable_work_sync(): schedule_work() on a work with a non-zero
disable count is dropped by clear_pending_if_disabled() before
__queue_work() is reached.
Move idpf_init_dim() to idpf_vport_intr_alloc() so the works are
initialised on every path that can reach the drain -- the three
"goto intr_deinit" sites between idpf_vport_intr_init() and
idpf_vport_intr_ena() get there without the enable side having run.
Nothing re-enables them: rsrc->q_vectors is freed on every exit from
idpf_vport_open() and on every idpf_vport_stop(), so the count dies with
the object.
It is a race, not a deterministic failure -- net_dim() only schedules
once DIM_NEVENTS events have accumulated and the profile index changes.
A KASAN ifup/ifdown loop under load is the way to see it.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_txrx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7d64d4c6bb6bb63b6cdb7de133c3ec48333b27b5",
"status": "affected",
"version": "c2d548cad1508d334517bcbd7cd5c915cc831fc0",
"versionType": "git"
},
{
"lessThan": "7e4312953788244d47074987d40d76702cf929f1",
"status": "affected",
"version": "c2d548cad1508d334517bcbd7cd5c915cc831fc0",
"versionType": "git"
},
{
"lessThan": "cd7a1598645b6917a8676b7e2efe8d97ce68a952",
"status": "affected",
"version": "c2d548cad1508d334517bcbd7cd5c915cc831fc0",
"versionType": "git"
},
{
"lessThan": "7dd4c829bac2916be98a3e34b41daaba7f42b4c4",
"status": "affected",
"version": "c2d548cad1508d334517bcbd7cd5c915cc831fc0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_txrx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: disable DIM work before freeing q_vectors\n\nidpf never drains the Tx/Rx DIM works before freeing the memory they\nlive in. tx_dim and rx_dim are embedded in struct idpf_q_vector, they\nare queued from the NAPI poll via net_dim(), and idpf_vport_intr_rel()\nends with kfree(rsrc-\u003eq_vectors). Nothing in the driver cancels them.\n\nidpf_tx_dim_work() and idpf_rx_dim_work() then run on freed memory:\nidpf_vport_intr_write_itr() writes the ITR register through\nq_vector-\u003eintr_reg.tx_itr / rx_itr, void __iomem pointers loaded out of\nthe freed q_vector. No configuration is needed to get there --\nIDPF_ITR_IS_DYNAMIC() is defined as (itr_mode) and idpf_vport_alloc()\ninitialises both modes to IDPF_ITR_DYNAMIC.\n\nDraining after idpf_vport_intr_napi_dis_all() is not enough on its own.\nidpf_net_dim() is called from inside the\n\"if (napi_complete_done(napi, work_done))\" branch of the poll, and\nnapi_complete_done() has already cleared NAPIF_STATE_SCHED by then.\nnapi_disable_locked() waits only while (val \u0026 (NAPIF_STATE_SCHED |\nNAPIF_STATE_NPSVC)), so napi_disable() can return while the poll tail is\nstill queueing the work, and a plain cancel_work_sync() would be\nre-armed behind the drain.\n\nUse disable_work_sync(): schedule_work() on a work with a non-zero\ndisable count is dropped by clear_pending_if_disabled() before\n__queue_work() is reached.\n\nMove idpf_init_dim() to idpf_vport_intr_alloc() so the works are\ninitialised on every path that can reach the drain -- the three\n\"goto intr_deinit\" sites between idpf_vport_intr_init() and\nidpf_vport_intr_ena() get there without the enable side having run.\nNothing re-enables them: rsrc-\u003eq_vectors is freed on every exit from\nidpf_vport_open() and on every idpf_vport_stop(), so the count dies with\nthe object.\n\nIt is a race, not a deterministic failure -- net_dim() only schedules\nonce DIM_NEVENTS events have accumulated and the profile index changes.\nA KASAN ifup/ifdown loop under load is the way to see it."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:10:07.248Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7d64d4c6bb6bb63b6cdb7de133c3ec48333b27b5"
},
{
"url": "https://git.kernel.org/stable/c/7e4312953788244d47074987d40d76702cf929f1"
},
{
"url": "https://git.kernel.org/stable/c/cd7a1598645b6917a8676b7e2efe8d97ce68a952"
},
{
"url": "https://git.kernel.org/stable/c/7dd4c829bac2916be98a3e34b41daaba7f42b4c4"
}
],
"title": "idpf: disable DIM work before freeing q_vectors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97603",
"datePublished": "2026-09-25T10:22:16.015Z",
"dateReserved": "2026-09-24T16:01:01.158Z",
"dateUpdated": "2026-10-19T09:10:07.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98211 (GCVE-0-2026-98211)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mmc: mmci: Fix use-after-free in busy-timeout work
ux500_busy_complete() can queue ux500_busy_timeout_work for an R1b
command, but mmci_remove() never cancels it. The work can subsequently
dereference the devm-allocated mmci_host after it has been released.
Mask the controller interrupts and disable the delayed work during
removal. This drains any queued instance and stops an IRQ handler that
is still in progress from queueing the work again once it has been
disabled.
This issue was found by an in-house static analysis tool.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/mmci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af6fbf72e899932f330c4e5d0b84d985c922c633",
"status": "affected",
"version": "b1a665932dc23cad0b8af2745cd9713f9e930d63",
"versionType": "git"
},
{
"lessThan": "7fecf79f31568de161be14911db10d1251617b01",
"status": "affected",
"version": "b1a665932dc23cad0b8af2745cd9713f9e930d63",
"versionType": "git"
},
{
"lessThan": "432b98c1f5daecf04a33c8e1688d26e7ac221e23",
"status": "affected",
"version": "b1a665932dc23cad0b8af2745cd9713f9e930d63",
"versionType": "git"
},
{
"lessThan": "2b19cf3e50cddaff07b657dae1a8f30f06032852",
"status": "affected",
"version": "b1a665932dc23cad0b8af2745cd9713f9e930d63",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/mmci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: mmci: Fix use-after-free in busy-timeout work\n\nux500_busy_complete() can queue ux500_busy_timeout_work for an R1b\ncommand, but mmci_remove() never cancels it. The work can subsequently\ndereference the devm-allocated mmci_host after it has been released.\n\nMask the controller interrupts and disable the delayed work during\nremoval. This drains any queued instance and stops an IRQ handler that\nis still in progress from queueing the work again once it has been\ndisabled.\n\nThis issue was found by an in-house static analysis tool."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:42.136Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af6fbf72e899932f330c4e5d0b84d985c922c633"
},
{
"url": "https://git.kernel.org/stable/c/7fecf79f31568de161be14911db10d1251617b01"
},
{
"url": "https://git.kernel.org/stable/c/432b98c1f5daecf04a33c8e1688d26e7ac221e23"
},
{
"url": "https://git.kernel.org/stable/c/2b19cf3e50cddaff07b657dae1a8f30f06032852"
}
],
"title": "mmc: mmci: Fix use-after-free in busy-timeout work",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98211",
"datePublished": "2026-10-06T08:44:47.637Z",
"dateReserved": "2026-09-25T10:25:14.325Z",
"dateUpdated": "2026-10-19T09:15:42.136Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98247 (GCVE-0-2026-98247)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_codec: validate vendor codec count length
The Read Local Supported Codecs parsers consume the variable-sized
standard codec array before parsing the vendor codec count. Although the
initial reply-size check includes a vendor count byte in the fixed layout,
it does not guarantee that the byte remains after the standard codec array.
If a controller reply ends immediately after that array, calculating the
vendor codec array size reads vnd_codecs->num beyond the skb data. Use
skb_pull_data() to validate and consume each codec header before using its
count in both command variants.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 Version: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 Version: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 Version: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 Version: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 Version: 8961987f3f5fa2f2618e72304d013c8dd5e604a6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_codec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9c04b9a4d08b95dee901d24b7607c4cbd65fa0a8",
"status": "affected",
"version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
"versionType": "git"
},
{
"lessThan": "a6da782fefae611e68a1aa79644065fc8ca5abcd",
"status": "affected",
"version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
"versionType": "git"
},
{
"lessThan": "e4cfd3c4299105237458b27958bd7b0aa4c60795",
"status": "affected",
"version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
"versionType": "git"
},
{
"lessThan": "f49a543d76d48f184b34225d9c0e2fc4cbdea8ec",
"status": "affected",
"version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
"versionType": "git"
},
{
"lessThan": "12a82819b0cada6e304790b1097f8f9006eb6123",
"status": "affected",
"version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
"versionType": "git"
},
{
"lessThan": "d0795cfd6f655f4de84868a4f4bb41a03f037b3d",
"status": "affected",
"version": "8961987f3f5fa2f2618e72304d013c8dd5e604a6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_codec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_codec: validate vendor codec count length\n\nThe Read Local Supported Codecs parsers consume the variable-sized\nstandard codec array before parsing the vendor codec count. Although the\ninitial reply-size check includes a vendor count byte in the fixed layout,\nit does not guarantee that the byte remains after the standard codec array.\n\nIf a controller reply ends immediately after that array, calculating the\nvendor codec array size reads vnd_codecs-\u003enum beyond the skb data. Use\nskb_pull_data() to validate and consume each codec header before using its\ncount in both command variants."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:18.761Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9c04b9a4d08b95dee901d24b7607c4cbd65fa0a8"
},
{
"url": "https://git.kernel.org/stable/c/a6da782fefae611e68a1aa79644065fc8ca5abcd"
},
{
"url": "https://git.kernel.org/stable/c/e4cfd3c4299105237458b27958bd7b0aa4c60795"
},
{
"url": "https://git.kernel.org/stable/c/f49a543d76d48f184b34225d9c0e2fc4cbdea8ec"
},
{
"url": "https://git.kernel.org/stable/c/12a82819b0cada6e304790b1097f8f9006eb6123"
},
{
"url": "https://git.kernel.org/stable/c/d0795cfd6f655f4de84868a4f4bb41a03f037b3d"
}
],
"title": "Bluetooth: hci_codec: validate vendor codec count length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98247",
"datePublished": "2026-10-06T08:45:16.048Z",
"dateReserved": "2026-09-25T10:25:14.330Z",
"dateUpdated": "2026-10-19T09:16:18.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98218 (GCVE-0-2026-98218)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: atr: fix dangling adapter pointer on add failure
i2c_atr_add_adapter() stores atr->adapter[chan_id] before
i2c_add_adapter() so that the I2C bus notifier can match child clients
during registration. On failure the channel is freed but the slot was
left pointing at freed memory, which can lead to use-after-free in
i2c_atr_del_adapter() / cleanup and also block reuse with -EEXIST.
Clear the slot on the i2c_add_adapter() error path before freeing chan.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-atr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2f5e42edbd232bf705dc5d3a91e06344237e63bb",
"status": "affected",
"version": "a076a860acae77bbdcbd316541e5552e81fb1772",
"versionType": "git"
},
{
"lessThan": "1093835f6aef58a831298d93e0d93f244fa07b84",
"status": "affected",
"version": "a076a860acae77bbdcbd316541e5552e81fb1772",
"versionType": "git"
},
{
"lessThan": "eabf7a3d33cd9fad106d267d00cc842434de8e02",
"status": "affected",
"version": "a076a860acae77bbdcbd316541e5552e81fb1772",
"versionType": "git"
},
{
"lessThan": "a57d9592714506556e30188af72dd3bdb9f647b5",
"status": "affected",
"version": "a076a860acae77bbdcbd316541e5552e81fb1772",
"versionType": "git"
},
{
"lessThan": "ad34235808b63a70ca4989b7a2852923193d06ef",
"status": "affected",
"version": "a076a860acae77bbdcbd316541e5552e81fb1772",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-atr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: atr: fix dangling adapter pointer on add failure\n\ni2c_atr_add_adapter() stores atr-\u003eadapter[chan_id] before\ni2c_add_adapter() so that the I2C bus notifier can match child clients\nduring registration. On failure the channel is freed but the slot was\nleft pointing at freed memory, which can lead to use-after-free in\ni2c_atr_del_adapter() / cleanup and also block reuse with -EEXIST.\n\nClear the slot on the i2c_add_adapter() error path before freeing chan."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:49.004Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2f5e42edbd232bf705dc5d3a91e06344237e63bb"
},
{
"url": "https://git.kernel.org/stable/c/1093835f6aef58a831298d93e0d93f244fa07b84"
},
{
"url": "https://git.kernel.org/stable/c/eabf7a3d33cd9fad106d267d00cc842434de8e02"
},
{
"url": "https://git.kernel.org/stable/c/a57d9592714506556e30188af72dd3bdb9f647b5"
},
{
"url": "https://git.kernel.org/stable/c/ad34235808b63a70ca4989b7a2852923193d06ef"
}
],
"title": "i2c: atr: fix dangling adapter pointer on add failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98218",
"datePublished": "2026-10-06T08:44:54.034Z",
"dateReserved": "2026-09-25T10:25:14.326Z",
"dateUpdated": "2026-10-19T09:15:49.004Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98266 (GCVE-0-2026-98266)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: core: Fix potential UAF after asynchronous card release
Usually a sound driver releases the resources assigned to the card via
snd_card_free(), and it synchronizes with the whole release procedure.
However, when the card is released asynchronously via
snd_card_free_when_closed() like USB-audio driver, the situation is
slightly different; although the snd_card_disconnect() call at the
disconnection guarantees that any newer accesses will be gated, the
in-flight tasks might be still accessing to the underlying card->dev
device even after the disconnection, which would cause a
use-after-free in the end, as reported by fuzzers.
For addressing the bug above, this patch takes the refcount of
card->dev at initialization of the card object, and releases at its
destructor. This assures the availability of the card->dev in its
whole lifecycle.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c0df40aa577e405c458e44e8d458dd78407f4af",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2dec4642589a663e064e4411d92d6e8fa250d53b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "398b21608955c9712a012355b69a39407367edc9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fd95e68df6fe66344161a1329cbe5e5805e7b704",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: core: Fix potential UAF after asynchronous card release\n\nUsually a sound driver releases the resources assigned to the card via\nsnd_card_free(), and it synchronizes with the whole release procedure.\nHowever, when the card is released asynchronously via\nsnd_card_free_when_closed() like USB-audio driver, the situation is\nslightly different; although the snd_card_disconnect() call at the\ndisconnection guarantees that any newer accesses will be gated, the\nin-flight tasks might be still accessing to the underlying card-\u003edev\ndevice even after the disconnection, which would cause a\nuse-after-free in the end, as reported by fuzzers.\n\nFor addressing the bug above, this patch takes the refcount of\ncard-\u003edev at initialization of the card object, and releases at its\ndestructor. This assures the availability of the card-\u003edev in its\nwhole lifecycle."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:37.189Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c0df40aa577e405c458e44e8d458dd78407f4af"
},
{
"url": "https://git.kernel.org/stable/c/2dec4642589a663e064e4411d92d6e8fa250d53b"
},
{
"url": "https://git.kernel.org/stable/c/398b21608955c9712a012355b69a39407367edc9"
},
{
"url": "https://git.kernel.org/stable/c/fd95e68df6fe66344161a1329cbe5e5805e7b704"
}
],
"title": "ALSA: core: Fix potential UAF after asynchronous card release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98266",
"datePublished": "2026-10-06T08:45:29.236Z",
"dateReserved": "2026-09-25T10:25:14.333Z",
"dateUpdated": "2026-10-19T09:16:37.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98373 (GCVE-0-2026-98373)
Vulnerability from cvelistv5
Published
2026-10-07 13:01
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: preserve mremap address delta when skipping page tables
move_hugetlb_page_tables() optimizes mremap() by advancing to the last
entry in the page table when the source page table does not exist, either
initially or after unsharing a PMD table. The common loop increment then
steps to the first entry in the next page table.
However, the code advances both the source and destination addresses to
the last entries in their respective page tables, which is wrong. The
destination address must be advanced only by the same amount as the source
address.
If the source and destination offsets within their page tables differ, the
destination address can be advanced too far, causing follow-up issues.
Fix this by advancing the destination address by the source advance
distance.
With a reproducer, we were able to trigger a kernel panic on x86-64. With
this fix in place, we can no longer reproduce the issue.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cf73ef2a761df9329af116c905a7a94b317921e4",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "850cc4a84b36a0062dcd0391acd2450e20ab0767",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "480a39b0a12c977ed6e755f3d12a23424c57d11f",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
},
{
"lessThan": "9bdad082d44bdcf93716973dcba6be77e8a06e7b",
"status": "affected",
"version": "e95a9851787bbb3cd4deb40fe8bab03f731852d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/hugetlb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: preserve mremap address delta when skipping page tables\n\nmove_hugetlb_page_tables() optimizes mremap() by advancing to the last\nentry in the page table when the source page table does not exist, either\ninitially or after unsharing a PMD table. The common loop increment then\nsteps to the first entry in the next page table.\n\nHowever, the code advances both the source and destination addresses to\nthe last entries in their respective page tables, which is wrong. The\ndestination address must be advanced only by the same amount as the source\naddress.\n\nIf the source and destination offsets within their page tables differ, the\ndestination address can be advanced too far, causing follow-up issues. \nFix this by advancing the destination address by the source advance\ndistance.\n\nWith a reproducer, we were able to trigger a kernel panic on x86-64. With\nthis fix in place, we can no longer reproduce the issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:58.154Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cf73ef2a761df9329af116c905a7a94b317921e4"
},
{
"url": "https://git.kernel.org/stable/c/7a96b0f657c8d799ea5b8e02fc9ec7cca0e6e7ff"
},
{
"url": "https://git.kernel.org/stable/c/850cc4a84b36a0062dcd0391acd2450e20ab0767"
},
{
"url": "https://git.kernel.org/stable/c/480a39b0a12c977ed6e755f3d12a23424c57d11f"
},
{
"url": "https://git.kernel.org/stable/c/9bdad082d44bdcf93716973dcba6be77e8a06e7b"
}
],
"title": "mm/hugetlb: preserve mremap address delta when skipping page tables",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98373",
"datePublished": "2026-10-07T13:01:47.433Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-21T12:54:58.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98367 (GCVE-0-2026-98367)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
We need to clear cep before release state_lock as siw_qp_llp_close and
siw_qp_modify->siw_qp_llp_close did.
Otherwise if siw_qp_modify() fails in siw_accept(), the QP's state_lock
is released before the error path cleanup. A concurrent ibv_modify_qp()
transitioning the QP to ERROR can race in this window:
siw_accept() ibv_modify_qp(ERROR)
---------------------- ----------------------
siw_qp_modify() fails
up_write(&qp->state_lock)
down_write(&qp->state_lock)
nextstate_from_idle():
if (qp->cep)
siw_cep_put(qp->cep) <- frees cep
qp->cep = NULL
goto error
cep->qp = NULL <- UAF
Clear qp->cep and drop the association reference taken by siw_cep_get(),
all under the write lock held from the initial down_write(&qp->state_lock).
Thread B therefore sees qp->cep == NULL, skips its own put, and cannot free
the cep before siw_accept() is done with it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 Version: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 Version: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 Version: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 Version: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 Version: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 Version: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 Version: 6c52fdc244b5ccc468006fd65a504d4ee33743c7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "e3f039082856adab7e195dea1af45d93dd6a3f1c",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "ad50d19f3d1ce052b3a146143581e930a1efb33e",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "030306bbb9273af80f14d7af20129661964cd9a7",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "df2584750314336edcbcc21fb388e04b260f35b7",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "9dcc0f4e488b70cff81e0e5717a498c929cf5de3",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "bfdc744bf20ae4c3ef2e470298de5237c5c9a13c",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
},
{
"lessThan": "32cd87f54dd1070020e664ccb0312a9f0fea79b4",
"status": "affected",
"version": "6c52fdc244b5ccc468006fd65a504d4ee33743c7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/siw/siw_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept\n\nWe need to clear cep before release state_lock as siw_qp_llp_close and\nsiw_qp_modify-\u003esiw_qp_llp_close did.\n\nOtherwise if siw_qp_modify() fails in siw_accept(), the QP\u0027s state_lock\nis released before the error path cleanup. A concurrent ibv_modify_qp()\ntransitioning the QP to ERROR can race in this window:\n\n siw_accept() ibv_modify_qp(ERROR)\n ---------------------- ----------------------\n siw_qp_modify() fails\n up_write(\u0026qp-\u003estate_lock)\n down_write(\u0026qp-\u003estate_lock)\n nextstate_from_idle():\n\t\t\t\t if (qp-\u003ecep)\n siw_cep_put(qp-\u003ecep) \u003c- frees cep\n qp-\u003ecep = NULL\n goto error\n cep-\u003eqp = NULL \u003c- UAF\n\nClear qp-\u003ecep and drop the association reference taken by siw_cep_get(),\nall under the write lock held from the initial down_write(\u0026qp-\u003estate_lock).\nThread B therefore sees qp-\u003ecep == NULL, skips its own put, and cannot free\nthe cep before siw_accept() is done with it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - siw_accept() is called through the ops.iw_accept hook from iw_cm_accept(), which a local process reaches with the RDMA_USER_CM_CMD_ACCEPT command on /dev/infiniband/rdma_cm. The racing side is the uverbs MODIFY_QP command (ibv_modify_qp to ERROR), also local. No wire message carries data that causes the siw_qp_modify() failure, so the attack is local.\nAC:L - The attacker does control both racing threads, since it owns the QP and issues the accept and modify_qp calls itself. Even so, AC is High: in siw_accept the only way siw_qp_modify() can fail is siw_qp_readq_init() hitting a vcalloc() ENOMEM, and IRD/ORD are capped at 128, so the allocations are small. That failure depends on system-wide memory exhaustion, which the attacker cannot produce on demand.\nPR:L - Running rdma_accept and ibv_modify_qp on a QP the user created on an existing siw device needs only ordinary access to the rdma_cm and uverbs device nodes. Creating the siw link through RDMA_NLDEV_CMD_NEWLINK is admin-only, but no privilege is needed to use a device that already exists.\nUI:N - The attacker drives both siw_accept() and the concurrent ibv_modify_qp(ERROR) through their own rdma_cm and verbs calls, and the connecting peer can be the attacker over loopback. No other user has to do anything.\nS:U - The freed siw_cep and the writes into it both stay inside the kernel\u0027s own security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:H - siw_qp_nextstate_from_idle() frees the siw_cep by calling siw_cep_put(qp-\u003ecep). The error path in siw_accept() then keeps using that freed object: it writes cep-\u003eqp = NULL, runs siw_free_cm_id, and calls siw_cep_set_free_and_put. A reclaimed object in that slot gives the attacker a use-after-free primitive that can be built into a kernel memory leak.\nI:H - After the free, the error path writes cep-\u003eqp = NULL and does kref and lock operations on the dead siw_cep. That corrupts whatever object has taken over the slot, and this kind of UAF write can be used to corrupt kernel data or hijack control flow.\nA:H - A kref_put or lock operation on the freed siw_cep in siw_cep_set_free_and_put can corrupt the slab or oops the kernel, and that crashes the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:19.262Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078"
},
{
"url": "https://git.kernel.org/stable/c/e3f039082856adab7e195dea1af45d93dd6a3f1c"
},
{
"url": "https://git.kernel.org/stable/c/ad50d19f3d1ce052b3a146143581e930a1efb33e"
},
{
"url": "https://git.kernel.org/stable/c/030306bbb9273af80f14d7af20129661964cd9a7"
},
{
"url": "https://git.kernel.org/stable/c/df2584750314336edcbcc21fb388e04b260f35b7"
},
{
"url": "https://git.kernel.org/stable/c/9dcc0f4e488b70cff81e0e5717a498c929cf5de3"
},
{
"url": "https://git.kernel.org/stable/c/bfdc744bf20ae4c3ef2e470298de5237c5c9a13c"
},
{
"url": "https://git.kernel.org/stable/c/32cd87f54dd1070020e664ccb0312a9f0fea79b4"
}
],
"title": "RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98367",
"datePublished": "2026-10-06T08:46:52.452Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:19.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97934 (GCVE-0-2026-97934)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix memory corruption from a "STACKTRACE" histogram key
"cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined
with an offset and a size of zero so that the filter code can match them
by name. parse_field() maps them onto their common_* equivalents for
backward compatibility, but unlike the common_* names it hands the
placeholder back to the caller instead of NULL.
create_hist_field() takes a non-NULL field as a promise that the record
carries a stacktrace and picks HIST_FIELD_FN_STACK, so the __data_loc
word is read from offset 0, that is from common_type, and its low 16
bits are followed as an offset into the record. What is found there
becomes the length of an unbounded memcpy. Pick an event whose id is
small enough that the offset stays inside its own record and the length
is a kernel text address:
# cd /sys/kernel/tracing
# echo 'hist:keys=STACKTRACE' > events/ftrace/print/trigger
# echo hello > trace_marker
Oops: general protection fault, probably for non-canonical address
RIP: 0010:rb_next+0x23/0x60
</IRQ>
RIP: 0010:memcpy+0xc/0x30
event_hist_trigger+0x2e7/0x12c0
Kernel panic - not syncing: Fatal exception in interrupt
Leave the field NULL, which is what the comment above the branch says
the code does and what common_stacktrace already does. FILTER_CPU and
FILTER_COMM are left alone, their create_hist_field() branches never
look at the field.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c94985e4fd77eb8634f44fb42e551563c68c55b3",
"status": "affected",
"version": "4b512860bdbdddcf41467ebd394f27cb8dfb528c",
"versionType": "git"
},
{
"lessThan": "b6cc6ec5f032ea6fd5cce94fb83baab4d1c02e33",
"status": "affected",
"version": "4b512860bdbdddcf41467ebd394f27cb8dfb528c",
"versionType": "git"
},
{
"lessThan": "9e026a91fe79966e2baabd4345c6e3a26975c729",
"status": "affected",
"version": "4b512860bdbdddcf41467ebd394f27cb8dfb528c",
"versionType": "git"
},
{
"lessThan": "c27f8b68c05808bb4f2bcde0e6d1c954a4b65f8a",
"status": "affected",
"version": "4b512860bdbdddcf41467ebd394f27cb8dfb528c",
"versionType": "git"
},
{
"lessThan": "7f711e62355bb3123a2ca2f97a2facbfebc678c6",
"status": "affected",
"version": "4b512860bdbdddcf41467ebd394f27cb8dfb528c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix memory corruption from a \"STACKTRACE\" histogram key\n\n\"cpu\", \"CPU\", \"stacktrace\" and \"STACKTRACE\" are generic fields, defined\nwith an offset and a size of zero so that the filter code can match them\nby name. parse_field() maps them onto their common_* equivalents for\nbackward compatibility, but unlike the common_* names it hands the\nplaceholder back to the caller instead of NULL.\n\ncreate_hist_field() takes a non-NULL field as a promise that the record\ncarries a stacktrace and picks HIST_FIELD_FN_STACK, so the __data_loc\nword is read from offset 0, that is from common_type, and its low 16\nbits are followed as an offset into the record. What is found there\nbecomes the length of an unbounded memcpy. Pick an event whose id is\nsmall enough that the offset stays inside its own record and the length\nis a kernel text address:\n\n # cd /sys/kernel/tracing\n # echo \u0027hist:keys=STACKTRACE\u0027 \u003e events/ftrace/print/trigger\n # echo hello \u003e trace_marker\n\n Oops: general protection fault, probably for non-canonical address\n RIP: 0010:rb_next+0x23/0x60\n \u003c/IRQ\u003e\n RIP: 0010:memcpy+0xc/0x30\n event_hist_trigger+0x2e7/0x12c0\n Kernel panic - not syncing: Fatal exception in interrupt\n\nLeave the field NULL, which is what the comment above the branch says\nthe code does and what common_stacktrace already does. FILTER_CPU and\nFILTER_COMM are left alone, their create_hist_field() branches never\nlook at the field."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:43.241Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c94985e4fd77eb8634f44fb42e551563c68c55b3"
},
{
"url": "https://git.kernel.org/stable/c/b6cc6ec5f032ea6fd5cce94fb83baab4d1c02e33"
},
{
"url": "https://git.kernel.org/stable/c/9e026a91fe79966e2baabd4345c6e3a26975c729"
},
{
"url": "https://git.kernel.org/stable/c/c27f8b68c05808bb4f2bcde0e6d1c954a4b65f8a"
},
{
"url": "https://git.kernel.org/stable/c/7f711e62355bb3123a2ca2f97a2facbfebc678c6"
}
],
"title": "tracing: Fix memory corruption from a \"STACKTRACE\" histogram key",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97934",
"datePublished": "2026-09-25T10:22:49.212Z",
"dateReserved": "2026-09-25T10:18:58.203Z",
"dateUpdated": "2026-10-21T12:53:43.241Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98174 (GCVE-0-2026-98174)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix rlist race and missing initialization
TCP_Server_Info.rlist is allocated via kzalloc which zeros both ->next
and ->prev to NULL instead of pointing to itself, making list_empty()
always return false and list_add() dereference a NULL ->prev pointer.
Also, cifs_signal_cifsd_for_reconnect() can be called concurrently
from multiple cifsd threads, allowing the same server's rlist node to
be added twice into the local list, corrupting it.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 0 ≤ Version: 0 ≤ Version: 0 ≤ Version: 0 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/connect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b5f924ffbfa976e4b97f17e8132c595b97482c2d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5a8f82f9c5839389cf4036029dd75a9911049e83",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "04082b1833856cb9ed87e0d3d5f04cbf836cf7da",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5f270f091256da1338c3631083e15d7f83cc05e1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6.6.158",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "6.18.54",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "7.2.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/connect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix rlist race and missing initialization\n\nTCP_Server_Info.rlist is allocated via kzalloc which zeros both -\u003enext\nand -\u003eprev to NULL instead of pointing to itself, making list_empty()\nalways return false and list_add() dereference a NULL -\u003eprev pointer.\n\nAlso, cifs_signal_cifsd_for_reconnect() can be called concurrently\nfrom multiple cifsd threads, allowing the same server\u0027s rlist node to\nbe added twice into the local list, corrupting it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The trigger is SMB transport data sent by the server: an unexpected RFC1002 frame type, or a framing or decrypt error, on two channels makes is_smb_response()/smb2ops call cifs_reconnect(server, true). That leads to __cifs_reconnect() -\u003e cifs_signal_cifsd_for_reconnect(all_channels=true) in two cifsd threads at once. The server\u0027s TCP traffic is routable.\nAC:H - The attacker must get the two channels\u0027 list_add(\u0026nserver-\u003erlist, \u0026reco) calls inside the short window after one thread drops cifs_tcp_ses_lock and before it finishes walking its on-stack reco list. Timing that from frames sent over the network is unreliable. The bug also needs a multichannel session (chan_count \u003e 1), and that is not the default.\nPR:N - A malicious SMB server, or an on-path attacker on the client\u0027s SMB connections, needs no account on the victim host. The reconnect is triggered by RFC1002 frames that cifsd parses before any check on the server\u0027s authenticity.\nUI:R - A victim has to mount a share from the attacker\u0027s server with the non-default multichannel or max_channels\u003e1 option. Otherwise ses-\u003echan_count stays 1 and the loop over chans[1..] in cifs_signal_cifsd_for_reconnect() never adds anything to reco.\nS:U - The corruption is in the CIFS client\u0027s TCP_Server_Info list linkage and other kernel stack frames, inside the same kernel security authority. No guest/host, IOMMU or sandbox boundary is crossed.\nC:H - One TCP_Server_Info.rlist node ends up linked into two cifsd threads\u0027 on-stack reco lists. list_for_each_entry_safe() can then follow a pointer into another thread\u0027s stack, which may already be dead, and treat it as a TCP_Server_Info. That is kernel memory corruption that can be steered into reads of controlled memory.\nI:H - The bogus entry is passed to set_need_reco() (spin_lock and a tcpStatus write) and to cifs_put_tcp_session() (srv_count decrement and possible teardown and free). Those are kernel writes through a corrupted list pointer, the same class as list-corruption write primitives.\nA:H - With CONFIG_LIST_HARDENED/DEBUG_LIST, the first list_del_init() on the doubly linked rlist BUGs. Without it, the walk faults or loops on the corrupted reco list. The server can resend bad frames after every reconnect, so it can keep retrying until the client host crashes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:05.758Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b5f924ffbfa976e4b97f17e8132c595b97482c2d"
},
{
"url": "https://git.kernel.org/stable/c/5a8f82f9c5839389cf4036029dd75a9911049e83"
},
{
"url": "https://git.kernel.org/stable/c/04082b1833856cb9ed87e0d3d5f04cbf836cf7da"
},
{
"url": "https://git.kernel.org/stable/c/c037d6bde3dd5fa00b017b6b98a5389ec0ebc02f"
},
{
"url": "https://git.kernel.org/stable/c/5f270f091256da1338c3631083e15d7f83cc05e1"
}
],
"title": "smb: client: fix rlist race and missing initialization",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98174",
"datePublished": "2026-10-06T08:44:18.350Z",
"dateReserved": "2026-09-25T10:25:14.322Z",
"dateUpdated": "2026-10-19T09:15:05.758Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98237 (GCVE-0-2026-98237)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
The NDP traversal in mhi_mbim_rx() only stops when wNextNdpIndex is
zero. Nothing requires the offsets to advance, so a modem that
points an NDP at itself, or at an earlier NDP, keeps the loop
spinning forever on one CPU.
Break out when the next NDP offset is not larger than the current
one.
Verified in a QEMU guest with a fault injector feeding the driver's
receive callback an NTB whose single NDP points at itself: the
unpatched driver spins in mhi_mbim_rx() with one CPU pinned at 100%
and the thread never returns. With this check the loop terminates
within one iteration.
Changes in v2: move the non-increasing check to the wNextNdpIndex
retrieval site, as suggested by Loic Poulain, instead of tracking
the previous offset in a separate variable.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c Version: aa730a9905b7b079ef2fffdab7f15dbb842f5c7c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wwan/mhi_wwan_mbim.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3ed36ee1b29b028f6bc2ebe100152f61a33df05a",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
},
{
"lessThan": "e4b2c7b50d4f4aa1ddfff731b136d65f65b2b526",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
},
{
"lessThan": "19b5e8dd884a530d04482e1a8e547f43cad17ed7",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
},
{
"lessThan": "24ade82d6d993274e99c2c6998848751c35292e7",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
},
{
"lessThan": "8dad70ff7e25cbcfbcb5101fdbf36d98003eb653",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
},
{
"lessThan": "829fec45122da58d77a55a3b7ca514dafab98e77",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
},
{
"lessThan": "5d063822ac5184939c1ed377a339a01d8ae814e8",
"status": "affected",
"version": "aa730a9905b7b079ef2fffdab7f15dbb842f5c7c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wwan/mhi_wwan_mbim.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain\n\nThe NDP traversal in mhi_mbim_rx() only stops when wNextNdpIndex is\nzero. Nothing requires the offsets to advance, so a modem that\npoints an NDP at itself, or at an earlier NDP, keeps the loop\nspinning forever on one CPU.\n\nBreak out when the next NDP offset is not larger than the current\none.\n\n\nVerified in a QEMU guest with a fault injector feeding the driver\u0027s\nreceive callback an NTB whose single NDP points at itself: the\nunpatched driver spins in mhi_mbim_rx() with one CPU pinned at 100%\nand the thread never returns. With this check the loop terminates\nwithin one iteration.\n\nChanges in v2: move the non-increasing check to the wNextNdpIndex\nretrieval site, as suggested by Loic Poulain, instead of tracking\nthe previous offset in a separate variable."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:08.988Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3ed36ee1b29b028f6bc2ebe100152f61a33df05a"
},
{
"url": "https://git.kernel.org/stable/c/e4b2c7b50d4f4aa1ddfff731b136d65f65b2b526"
},
{
"url": "https://git.kernel.org/stable/c/19b5e8dd884a530d04482e1a8e547f43cad17ed7"
},
{
"url": "https://git.kernel.org/stable/c/24ade82d6d993274e99c2c6998848751c35292e7"
},
{
"url": "https://git.kernel.org/stable/c/8dad70ff7e25cbcfbcb5101fdbf36d98003eb653"
},
{
"url": "https://git.kernel.org/stable/c/829fec45122da58d77a55a3b7ca514dafab98e77"
},
{
"url": "https://git.kernel.org/stable/c/5d063822ac5184939c1ed377a339a01d8ae814e8"
}
],
"title": "net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98237",
"datePublished": "2026-10-06T08:45:09.277Z",
"dateReserved": "2026-09-25T10:25:14.329Z",
"dateUpdated": "2026-10-19T09:16:08.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93200 (GCVE-0-2026-93200)
Vulnerability from cvelistv5
Published
2026-09-17 16:12
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: Fix use-after-free of master->this
sysfs attribute callbacks for the master controller device dereference
master->this. However, master->this is freed in
i3c_master_detach_free_devs() before the master device itself is
released.
As a result, sysfs accesses can dereference a freed master->this
pointer, leading to a use-after-free.
Keep master->this alive until i3c_masterdev_release(), which is called
after the master device and its sysfs state are being torn down. Do not
free master->this as part of the normal device detach path.
On the error path in i3c_master_set_info(), reset master->this and
bus.cur_master to NULL before freeing the allocated device.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "027679d613ea73b8a00831369ec34eea804ce1bd",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "23a1c4288a60e253a05a882bd8928ed61beb4a48",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "4f3145db05fede36b35f8249b8acde5bd5d54864",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "50034d8d0f797c3a7a599f750a7d3e792e80dea5",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "feb0ed76601f3c2f91f08688c5a7d8b9d382f720",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: Fix use-after-free of master-\u003ethis\n\nsysfs attribute callbacks for the master controller device dereference\nmaster-\u003ethis. However, master-\u003ethis is freed in\ni3c_master_detach_free_devs() before the master device itself is\nreleased.\n\nAs a result, sysfs accesses can dereference a freed master-\u003ethis\npointer, leading to a use-after-free.\n\nKeep master-\u003ethis alive until i3c_masterdev_release(), which is called\nafter the master device and its sysfs state are being torn down. Do not\nfree master-\u003ethis as part of the normal device detach path.\n\nOn the error path in i3c_master_set_info(), reset master-\u003ethis and\nbus.cur_master to NULL before freeing the allocated device."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:18.438Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/027679d613ea73b8a00831369ec34eea804ce1bd"
},
{
"url": "https://git.kernel.org/stable/c/23a1c4288a60e253a05a882bd8928ed61beb4a48"
},
{
"url": "https://git.kernel.org/stable/c/4f3145db05fede36b35f8249b8acde5bd5d54864"
},
{
"url": "https://git.kernel.org/stable/c/50034d8d0f797c3a7a599f750a7d3e792e80dea5"
},
{
"url": "https://git.kernel.org/stable/c/feb0ed76601f3c2f91f08688c5a7d8b9d382f720"
}
],
"title": "i3c: master: Fix use-after-free of master-\u003ethis",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93200",
"datePublished": "2026-09-17T16:12:21.751Z",
"dateReserved": "2026-09-17T16:02:15.092Z",
"dateUpdated": "2026-10-21T12:52:18.438Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98345 (GCVE-0-2026-98345)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: check IP header size in cfg80211_classify8021d()
A frame that looks like IP can be transmitted, but be too short, so
the DS field is read incorrectly:
BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027
cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027
ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180
__ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304
ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538
...
packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108
Use skb_header_pointer() like the MPLS case.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 Version: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 Version: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 Version: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 Version: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 Version: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 Version: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 Version: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18d5547327c202cda33ad2bbd203220c2c62c8a7",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "12c0abd4d1c1b04a7663d04ba85268bc9ad9c017",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "f33ad4e2f846e55cf4637419268f093ac9f1a765",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "a2cdb4a675ca04c4ac8cc962848082d8ce065008",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "65893c8d28f239c7ddad5a83683be193a9133e9b",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "48b2c5c628b09cf36cbeca53e0432fc2a7518be7",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: check IP header size in cfg80211_classify8021d()\n\nA frame that looks like IP can be transmitted, but be too short, so\nthe DS field is read incorrectly:\n\n BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027\n cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027\n ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180\n __ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304\n ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538\n ...\n packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108\n\nUse skb_header_pointer() like the MPLS case."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:56.221Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18d5547327c202cda33ad2bbd203220c2c62c8a7"
},
{
"url": "https://git.kernel.org/stable/c/3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734"
},
{
"url": "https://git.kernel.org/stable/c/c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7"
},
{
"url": "https://git.kernel.org/stable/c/12c0abd4d1c1b04a7663d04ba85268bc9ad9c017"
},
{
"url": "https://git.kernel.org/stable/c/f33ad4e2f846e55cf4637419268f093ac9f1a765"
},
{
"url": "https://git.kernel.org/stable/c/a2cdb4a675ca04c4ac8cc962848082d8ce065008"
},
{
"url": "https://git.kernel.org/stable/c/65893c8d28f239c7ddad5a83683be193a9133e9b"
},
{
"url": "https://git.kernel.org/stable/c/48b2c5c628b09cf36cbeca53e0432fc2a7518be7"
}
],
"title": "wifi: cfg80211: check IP header size in cfg80211_classify8021d()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98345",
"datePublished": "2026-10-06T08:46:34.719Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-19T09:17:56.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98221 (GCVE-0-2026-98221)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KEYS: trusted: Fix tpm2_load_cmd() boundary check
tpm2_load_cmd() does boundary checks against the ASN.1 size i.e.,
payload->blob_len. Address this by passing the decoded blob size to
tpm2_load_cmd(), and use it for the boundary checks.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f2219745250f388edacabe6cca73654131c67d0a Version: f2219745250f388edacabe6cca73654131c67d0a Version: f2219745250f388edacabe6cca73654131c67d0a Version: f2219745250f388edacabe6cca73654131c67d0a Version: f2219745250f388edacabe6cca73654131c67d0a Version: f2219745250f388edacabe6cca73654131c67d0a Version: f2219745250f388edacabe6cca73654131c67d0a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/keys/trusted-keys/trusted_tpm2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc86227fea28aed86c1fb52a884560b4440da198",
"status": "affected",
"version": "f2219745250f388edacabe6cca73654131c67d0a",
"versionType": "git"
},
{
"lessThan": "b020b447338872440142fe8a57350a483da86b7a",
"status": "affected",
"version": "f2219745250f388edacabe6cca73654131c67d0a",
"versionType": "git"
},
{
"lessThan": "3fd487c69ad3161e358c33c170bab0cf02a071b7",
"status": "affected",
"version": "f2219745250f388edacabe6cca73654131c67d0a",
"versionType": "git"
},
{
"lessThan": "5afa57ea91481c6c49f194b0f5a5c4d96a4d7348",
"status": "affected",
"version": "f2219745250f388edacabe6cca73654131c67d0a",
"versionType": "git"
},
{
"lessThan": "9ddbc5f4bb498aff8096a5231574858a4bffee4f",
"status": "affected",
"version": "f2219745250f388edacabe6cca73654131c67d0a",
"versionType": "git"
},
{
"lessThan": "134825dfc971fbf2b1d0f58f0b3bce8332ad0afb",
"status": "affected",
"version": "f2219745250f388edacabe6cca73654131c67d0a",
"versionType": "git"
},
{
"lessThan": "114f00d738f15dd8c7318369edcdc53dd6d08763",
"status": "affected",
"version": "f2219745250f388edacabe6cca73654131c67d0a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/keys/trusted-keys/trusted_tpm2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: Fix tpm2_load_cmd() boundary check\n\ntpm2_load_cmd() does boundary checks against the ASN.1 size i.e.,\npayload-\u003eblob_len. Address this by passing the decoded blob size to\ntpm2_load_cmd(), and use it for the boundary checks."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:53.271Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc86227fea28aed86c1fb52a884560b4440da198"
},
{
"url": "https://git.kernel.org/stable/c/b020b447338872440142fe8a57350a483da86b7a"
},
{
"url": "https://git.kernel.org/stable/c/3fd487c69ad3161e358c33c170bab0cf02a071b7"
},
{
"url": "https://git.kernel.org/stable/c/5afa57ea91481c6c49f194b0f5a5c4d96a4d7348"
},
{
"url": "https://git.kernel.org/stable/c/9ddbc5f4bb498aff8096a5231574858a4bffee4f"
},
{
"url": "https://git.kernel.org/stable/c/134825dfc971fbf2b1d0f58f0b3bce8332ad0afb"
},
{
"url": "https://git.kernel.org/stable/c/114f00d738f15dd8c7318369edcdc53dd6d08763"
}
],
"title": "KEYS: trusted: Fix tpm2_load_cmd() boundary check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98221",
"datePublished": "2026-10-06T08:44:56.728Z",
"dateReserved": "2026-09-25T10:25:14.327Z",
"dateUpdated": "2026-10-19T09:15:53.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98300 (GCVE-0-2026-98300)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
tcp_v6_do_rcv() no longer calls skb_clone_and_charge_r() for
TCP_LISTEN since commit 073d89808c06 ("net: fix data-races around
sk->sk_forward_alloc").
However, there is still a small race window between tcp_v6_rcv()
and tcp_v6_do_rcv(), where concurrent close() changes TCP_LISTEN
to TCP_CLOSE, causing skb_clone_and_charge_r() to be called
locklessly and resulting in the splat below. [0]
Let's avoid calling skb_clone_and_charge_r() for TCP_CLOSE as well.
This is fine for non-listeners because tcp_rcv_state_process()
drops skb for TCP_CLOSE and opt_skb was freed immediately anyway.
[0]:
sk->sk_forward_alloc
WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162, CPU#1: ksoftirqd/1/28
Modules linked in:
CPU: 1 UID: 0 PID: 28 Comm: ksoftirqd/1 Not tainted 7.2.0 #17 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
RIP: 0010:inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162
Code: 3d 49 ff e9 06 fd ff ff e8 d0 5b 83 f8 90 0f 0b 90 e9 35 fe ff ff e8 c2 5b 83 f8 90 0f 0b 90 e9 c5 fe ff ff e8 b4 5b 83 f8 90 <0f> 0b 90 e9 04 ff ff ff e8 a6 5b 83 f8 90 0f 0b 90 e9 65 fe ff ff
RSP: 0018:ffffc90000677bb8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880117bde80 RCX: ffffffff8957eb41
RDX: ffff88801dad5d00 RSI: ffffffff8957ec3c RDI: 0000000000000005
RBP: 00000000fffff000 R08: ffffffff8957eb41 R09: 00000000fffff000
R10: 0000000000000005 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff8880117bdf10 R14: ffffffff81c08eb7 R15: 0000000000000003
FS: 0000000000000000(0000) GS:ffff8880d7ae5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f93a1021138 CR3: 00000000207a9000 CR4: 0000000000350ef0
Call Trace:
<TASK>
__sk_destruct+0x82/0xae0 net/core/sock.c:2356
rcu_do_batch kernel/rcu/tree.c:2645 [inline]
rcu_core+0x59c/0x1100 kernel/rcu/tree.c:2897
handle_softirqs+0x1e4/0x9b0 kernel/softirq.c:622
run_ksoftirqd kernel/softirq.c:1076 [inline]
run_ksoftirqd+0x38/0x60 kernel/softirq.c:1068
smpboot_thread_fn+0x458/0xc80 kernel/smpboot.c:160
kthread+0x396/0x4a0 kernel/kthread.c:436
ret_from_fork+0x8e0/0xe40 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e994b2f0fb9229aeff5eea9541320bd7b2ca8714 Version: e994b2f0fb9229aeff5eea9541320bd7b2ca8714 Version: e994b2f0fb9229aeff5eea9541320bd7b2ca8714 Version: e994b2f0fb9229aeff5eea9541320bd7b2ca8714 Version: e994b2f0fb9229aeff5eea9541320bd7b2ca8714 Version: e994b2f0fb9229aeff5eea9541320bd7b2ca8714 Version: e994b2f0fb9229aeff5eea9541320bd7b2ca8714 Version: e994b2f0fb9229aeff5eea9541320bd7b2ca8714 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/tcp_ipv6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a23a3bc5004df6434de05797e0b6b2ecf864b86a",
"status": "affected",
"version": "e994b2f0fb9229aeff5eea9541320bd7b2ca8714",
"versionType": "git"
},
{
"lessThan": "1cb7f292a337fdc72a8219bcd9d40a9cf5e86db5",
"status": "affected",
"version": "e994b2f0fb9229aeff5eea9541320bd7b2ca8714",
"versionType": "git"
},
{
"lessThan": "7d94602e77a4525611afebb23149145ac242afd7",
"status": "affected",
"version": "e994b2f0fb9229aeff5eea9541320bd7b2ca8714",
"versionType": "git"
},
{
"lessThan": "b727e3d58cb906f1506c1334dfba71fbb1338339",
"status": "affected",
"version": "e994b2f0fb9229aeff5eea9541320bd7b2ca8714",
"versionType": "git"
},
{
"lessThan": "3e3394a13b603cc79b6a35480b8e20df6c716944",
"status": "affected",
"version": "e994b2f0fb9229aeff5eea9541320bd7b2ca8714",
"versionType": "git"
},
{
"lessThan": "619bfbaacbff6a9822923f69f6af29d7f66a870c",
"status": "affected",
"version": "e994b2f0fb9229aeff5eea9541320bd7b2ca8714",
"versionType": "git"
},
{
"lessThan": "56d38839ef0bff6526d9bd73b6811bd00316b21c",
"status": "affected",
"version": "e994b2f0fb9229aeff5eea9541320bd7b2ca8714",
"versionType": "git"
},
{
"lessThan": "8e759cd1f6444a946bd1fd2b2b29eea582eea1d5",
"status": "affected",
"version": "e994b2f0fb9229aeff5eea9541320bd7b2ca8714",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/tcp_ipv6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Don\u0027t call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().\n\ntcp_v6_do_rcv() no longer calls skb_clone_and_charge_r() for\nTCP_LISTEN since commit 073d89808c06 (\"net: fix data-races around\nsk-\u003esk_forward_alloc\").\n\nHowever, there is still a small race window between tcp_v6_rcv()\nand tcp_v6_do_rcv(), where concurrent close() changes TCP_LISTEN\nto TCP_CLOSE, causing skb_clone_and_charge_r() to be called\nlocklessly and resulting in the splat below. [0]\n\nLet\u0027s avoid calling skb_clone_and_charge_r() for TCP_CLOSE as well.\n\nThis is fine for non-listeners because tcp_rcv_state_process()\ndrops skb for TCP_CLOSE and opt_skb was freed immediately anyway.\n\n[0]:\nsk-\u003esk_forward_alloc\nWARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162, CPU#1: ksoftirqd/1/28\nModules linked in:\nCPU: 1 UID: 0 PID: 28 Comm: ksoftirqd/1 Not tainted 7.2.0 #17 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\nRIP: 0010:inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162\nCode: 3d 49 ff e9 06 fd ff ff e8 d0 5b 83 f8 90 0f 0b 90 e9 35 fe ff ff e8 c2 5b 83 f8 90 0f 0b 90 e9 c5 fe ff ff e8 b4 5b 83 f8 90 \u003c0f\u003e 0b 90 e9 04 ff ff ff e8 a6 5b 83 f8 90 0f 0b 90 e9 65 fe ff ff\nRSP: 0018:ffffc90000677bb8 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff8880117bde80 RCX: ffffffff8957eb41\nRDX: ffff88801dad5d00 RSI: ffffffff8957ec3c RDI: 0000000000000005\nRBP: 00000000fffff000 R08: ffffffff8957eb41 R09: 00000000fffff000\nR10: 0000000000000005 R11: 0000000000000000 R12: dffffc0000000000\nR13: ffff8880117bdf10 R14: ffffffff81c08eb7 R15: 0000000000000003\nFS: 0000000000000000(0000) GS:ffff8880d7ae5000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f93a1021138 CR3: 00000000207a9000 CR4: 0000000000350ef0\nCall Trace:\n \u003cTASK\u003e\n __sk_destruct+0x82/0xae0 net/core/sock.c:2356\n rcu_do_batch kernel/rcu/tree.c:2645 [inline]\n rcu_core+0x59c/0x1100 kernel/rcu/tree.c:2897\n handle_softirqs+0x1e4/0x9b0 kernel/softirq.c:622\n run_ksoftirqd kernel/softirq.c:1076 [inline]\n run_ksoftirqd+0x38/0x60 kernel/softirq.c:1068\n smpboot_thread_fn+0x458/0xc80 kernel/smpboot.c:160\n kthread+0x396/0x4a0 kernel/kthread.c:436\n ret_from_fork+0x8e0/0xe40 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:11.164Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a23a3bc5004df6434de05797e0b6b2ecf864b86a"
},
{
"url": "https://git.kernel.org/stable/c/1cb7f292a337fdc72a8219bcd9d40a9cf5e86db5"
},
{
"url": "https://git.kernel.org/stable/c/7d94602e77a4525611afebb23149145ac242afd7"
},
{
"url": "https://git.kernel.org/stable/c/b727e3d58cb906f1506c1334dfba71fbb1338339"
},
{
"url": "https://git.kernel.org/stable/c/3e3394a13b603cc79b6a35480b8e20df6c716944"
},
{
"url": "https://git.kernel.org/stable/c/619bfbaacbff6a9822923f69f6af29d7f66a870c"
},
{
"url": "https://git.kernel.org/stable/c/56d38839ef0bff6526d9bd73b6811bd00316b21c"
},
{
"url": "https://git.kernel.org/stable/c/8e759cd1f6444a946bd1fd2b2b29eea582eea1d5"
}
],
"title": "tcp: Don\u0027t call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98300",
"datePublished": "2026-10-06T08:45:58.091Z",
"dateReserved": "2026-09-25T10:25:14.337Z",
"dateUpdated": "2026-10-19T09:17:11.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90016 (GCVE-0-2026-90016)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
rtw_restruct_wmm_ie() scans in_ie for a WMM IE with:
while (i < in_len) {
...
if (i + 5 < in_len && in_ie[i] == 0xDD && ...) {
...
break;
}
i += (in_ie[i + 1] + 2); /* to the next IE element */
}
When the "i + 5 < in_len" match check fails simply because i is
within 5 bytes of the end of the buffer (i.e. no WMM IE was found
near the tail of in_ie), execution falls through to
"i += (in_ie[i + 1] + 2)", which reads in_ie[i + 1]. If i == in_len
- 1 at that point, this is a 1-byte out-of-bounds read of an
attacker-influenced IE buffer built from association/scan data.
Commit a75281626fc8f ("staging: rtl8723bs: fix potential
out-of-bounds read in rtw_restruct_wmm_ie") added the "i + 5 <
in_len" guard to the match condition itself, but did not add an
equivalent guard before the fallthrough advance, so the same class
of OOB read remained reachable through the non-matching path.
Add an explicit bounds check before advancing to the next IE.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "716850842d2f103f915fe7c857ff1a0a036491b4",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "e63b72c5d7336981dfc05e5cb92becff29dfea00",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "4420cc71841b50e31a7868ef7acb011c0e08d294",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "fd19b8895f8a91087e8a62f1e27b128025dabb95",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "28a289beaf226b30b1e6e7d7b1a2946fe2d6e852",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()\n\nrtw_restruct_wmm_ie() scans in_ie for a WMM IE with:\n\n\twhile (i \u003c in_len) {\n\t\t...\n\t\tif (i + 5 \u003c in_len \u0026\u0026 in_ie[i] == 0xDD \u0026\u0026 ...) {\n\t\t\t...\n\t\t\tbreak;\n\t\t}\n\t\ti += (in_ie[i + 1] + 2); /* to the next IE element */\n\t}\n\nWhen the \"i + 5 \u003c in_len\" match check fails simply because i is\nwithin 5 bytes of the end of the buffer (i.e. no WMM IE was found\nnear the tail of in_ie), execution falls through to\n\"i += (in_ie[i + 1] + 2)\", which reads in_ie[i + 1]. If i == in_len\n- 1 at that point, this is a 1-byte out-of-bounds read of an\nattacker-influenced IE buffer built from association/scan data.\n\nCommit a75281626fc8f (\"staging: rtl8723bs: fix potential\nout-of-bounds read in rtw_restruct_wmm_ie\") added the \"i + 5 \u003c\nin_len\" guard to the match condition itself, but did not add an\nequivalent guard before the fallthrough advance, so the same class\nof OOB read remained reachable through the non-matching path.\n\nAdd an explicit bounds check before advancing to the next IE."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - rtw_restruct_wmm_ie() walks WMM IEs from scanned BSS candidates filled by collect_bss_info() from over-the-air beacon and probe-response frames (OnBeacon/OnProbeRsp). The attacker must be in WiFi radio range; kernel guidance maps WiFi frame injection to Adjacent.\nAC:L - The attacker fully controls beacon/probe IE layout and can place a truncated tail IE so the walker lands at in_len-1, making the unguarded in_ie[i+1] read deterministic. wmm_enable defaults to 1, and no race or attacker-uncontrollable memory layout is required.\nPR:N - Scan and join/roam consume attacker beacon IEs before any authentication with the rogue BSS. No local account, capability, or user-namespace privilege is required.\nUI:N - RTW_ROAM_ON_EXPIRED is enabled by default, so association expiry or an attacker-driven reconnect automatically calls rtw_select_and_join_from_scanned_queue() without a new victim click. An evil-twin BSS matching the desired SSID is selected by RSSI during normal WiFi operation.\nS:U - The out-of-bounds read and any resulting kernel impact remain inside the rtl8723bs driver on the host. This is not a VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:L - The fallthrough path reads exactly one byte past the declared IE length (in_ie[i+1] when i==in_len-1). Kernel guidance scores a strictly bounded few-byte out-of-bounds read as Low confidentiality rather than an arbitrary-read primitive.\nI:N - The bug only reads in_ie[i+1] to compute the next IE offset and then exits the loop. It does not write out of bounds or provide a data-modification or control-flow hijack primitive.\nA:H - An out-of-bounds kernel read can oops or panic on hardened, KASAN, or redzone kernels, and an adjacent attacker can retrigger the join/roam path with further crafted management frames to deny availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:26.409Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/716850842d2f103f915fe7c857ff1a0a036491b4"
},
{
"url": "https://git.kernel.org/stable/c/e63b72c5d7336981dfc05e5cb92becff29dfea00"
},
{
"url": "https://git.kernel.org/stable/c/4420cc71841b50e31a7868ef7acb011c0e08d294"
},
{
"url": "https://git.kernel.org/stable/c/fd19b8895f8a91087e8a62f1e27b128025dabb95"
},
{
"url": "https://git.kernel.org/stable/c/28a289beaf226b30b1e6e7d7b1a2946fe2d6e852"
}
],
"title": "staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90016",
"datePublished": "2026-09-16T10:33:22.148Z",
"dateReserved": "2026-09-11T19:38:34.781Z",
"dateUpdated": "2026-10-21T12:49:26.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98339 (GCVE-0-2026-98339)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: don't filter by BSS type when removing stale entries
When an assoc AP switches to a channel that already has a BSS entry,
cfg80211_update_assoc_bss_entry() removes that entry before rehashing
the real one, since the two would otherwise collide in the BSS rbtree.
The lookup for that entry also required it to match the connection's BSS
type, so an entry advertising e.g. the IBSS capability bit was left in
place, and the following cfg80211_rehash_bss() then ran into it:
WARN_ON(!cmp)
Changing the type shouldn't really happen, but can be triggered by a
rogue AP/device, so drop the check and remove any entries matching
the comparison.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f Version: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6ef87a853327434ae1cd9c5a2c27a557fb4047fc",
"status": "affected",
"version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
"versionType": "git"
},
{
"lessThan": "1380ee3a202dbb9f8e8b3c3b87eb410450d57799",
"status": "affected",
"version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
"versionType": "git"
},
{
"lessThan": "fb445ec7480da5d2b82bf681e3b4313603722729",
"status": "affected",
"version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
"versionType": "git"
},
{
"lessThan": "65fdb973bd905bc3f5cb045a04c1828f2d2a7e24",
"status": "affected",
"version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
"versionType": "git"
},
{
"lessThan": "64e23a36d8f04811372365b44cfca325f8e0f4bb",
"status": "affected",
"version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
"versionType": "git"
},
{
"lessThan": "6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25",
"status": "affected",
"version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
"versionType": "git"
},
{
"lessThan": "0aa44982125c86b47961be5ac1c82eddab8080f3",
"status": "affected",
"version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
"versionType": "git"
},
{
"lessThan": "b377e1000d963e7182a987082b4b06580bd7ac84",
"status": "affected",
"version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: don\u0027t filter by BSS type when removing stale entries\n\nWhen an assoc AP switches to a channel that already has a BSS entry,\ncfg80211_update_assoc_bss_entry() removes that entry before rehashing\nthe real one, since the two would otherwise collide in the BSS rbtree.\n\nThe lookup for that entry also required it to match the connection\u0027s BSS\ntype, so an entry advertising e.g. the IBSS capability bit was left in\nplace, and the following cfg80211_rehash_bss() then ran into it:\n\n WARN_ON(!cmp)\n\nChanging the type shouldn\u0027t really happen, but can be triggered by a\nrogue AP/device, so drop the check and remove any entries matching\nthe comparison."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bad state comes from received 802.11 frames: a beacon/probe response carrying the associated AP\u0027s BSSID+SSID with the IBSS capability bit on another channel, then a CSA beacon that leads to cfg80211_ch_switch_notify() -\u003e cfg80211_update_assoc_bss_entry(). The attacker must be in WiFi radio range.\nAC:L - The attacker produces every step: injecting the colliding scan entry, sending the CSA (beacons are unprotected without beacon protection), then a second CSA or going silent so connection loss calls cfg80211_unlink_bss(). cmp_bss() ignores capability, so the rb_insert_bss() collision always happens.\nPR:N - No credentials are needed. A rogue AP, or an attacker spoofing management beacons of the victim\u0027s AP, triggers mac80211 channel-switch processing and scan-entry creation before any authenticated data exchange.\nUI:N - The victim station only needs to be in its normal associated state. Beacon/CSA processing and the later beacon-loss unlink happen automatically, with no user action.\nS:U - The corruption is confined to cfg80211\u0027s BSS list and rbtree within the same kernel. There is no hypervisor or other security-authority boundary crossed.\nC:H - After the failed rehash the connected BSS has stale rbn pointers. A second CSA makes cfg80211_rehash_bss() rb_erase() that non-member node, rewriting live parent/child links so bss_tree can reference entries later freed on expiry. That is a use-after-free on every rb lookup triggered by a received beacon.\nI:H - The double rb_erase() of the stale cbss-\u003erbn and the list_del() leaving poisoned pointers on a still-referenced BSS corrupt kernel heap metadata (tree links, bss_entries). The resulting use-after-free of cfg80211_internal_bss objects is a write-capable memory-corruption primitive.\nA:H - After cfg80211_rehash_bss() list_del()s the connected BSS, beacon-loss handling calls cfg80211_unlink_bss() -\u003e __cfg80211_unlink_bss() -\u003e list_del_init() on LIST_POISON pointers and faults (oops/panic). WARN_ON(!cmp) also panics with panic_on_warn."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:50.299Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6ef87a853327434ae1cd9c5a2c27a557fb4047fc"
},
{
"url": "https://git.kernel.org/stable/c/1380ee3a202dbb9f8e8b3c3b87eb410450d57799"
},
{
"url": "https://git.kernel.org/stable/c/fb445ec7480da5d2b82bf681e3b4313603722729"
},
{
"url": "https://git.kernel.org/stable/c/65fdb973bd905bc3f5cb045a04c1828f2d2a7e24"
},
{
"url": "https://git.kernel.org/stable/c/64e23a36d8f04811372365b44cfca325f8e0f4bb"
},
{
"url": "https://git.kernel.org/stable/c/6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25"
},
{
"url": "https://git.kernel.org/stable/c/0aa44982125c86b47961be5ac1c82eddab8080f3"
},
{
"url": "https://git.kernel.org/stable/c/b377e1000d963e7182a987082b4b06580bd7ac84"
}
],
"title": "wifi: cfg80211: don\u0027t filter by BSS type when removing stale entries",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98339",
"datePublished": "2026-10-06T08:46:29.998Z",
"dateReserved": "2026-09-25T10:25:14.342Z",
"dateUpdated": "2026-10-19T09:17:50.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98368 (GCVE-0-2026-98368)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
esp: downgrade zerocopy managed frags before mutating skb frags
On the out-of-place output path (esp->inplace == false) ESP rewrites the
skb frag array: esp_output_head() appends a trailer frag and
esp_output_tail() replaces the frags with a destination page, both
referenced with get_page().
When the skb carries zerocopy managed frags (SKBFL_MANAGED_FRAG_REFS) the
payload frags are owned by the ubuf and must not be referenced or
unreferenced individually, but ESP mutates the frag array without ever
downgrading the skb. This breaks the managed-frag invariant two ways:
- esp_ssg_unref() walks the source scatterlist and drops a page
reference for every frag, including the ubuf-owned payload frags,
pushing their refcount below the GUP pin bias while the pages are
still pinned, i.e. a use-after-free of the zerocopy pages;
- esp_output_tail() installs its destination page as frag 0 with
get_page() but leaves SKBFL_MANAGED_FRAG_REFS set, so
skb_release_data() takes the skip_unref branch and never drops that
reference, leaking the x->xfrag page at packet rate.
Fix this the way every other frag-mutating site does (__ip_append_data(),
__ip6_append_data(), tcp_sendmsg_locked()) and call
skb_zcopy_downgrade_managed() before ESP touches the frag array: it takes
a real reference on each existing frag and clears SKBFL_MANAGED_FRAG_REFS,
so the per-frag unref in esp_ssg_unref() and the frag release in
skb_release_data() are both balanced and no mixed-ownership frag array is
left behind.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 753f1ca4e1e50248a1b760c9774d6d6b354562cc Version: 753f1ca4e1e50248a1b760c9774d6d6b354562cc Version: 753f1ca4e1e50248a1b760c9774d6d6b354562cc Version: 753f1ca4e1e50248a1b760c9774d6d6b354562cc Version: 753f1ca4e1e50248a1b760c9774d6d6b354562cc Version: 753f1ca4e1e50248a1b760c9774d6d6b354562cc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/esp4.c",
"net/ipv6/esp6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2359264f377cdbdef2d95868cc8fb572949e48d3",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "69a768c12398cada8528080332c822623fa7064d",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "6508304ac2c8cdafca2f4ab915df8c707893e134",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "6cab554f2c0f28773f712ed3a5479103f42ce844",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "0d0845ee61c5df47cc68bc446501f48f71e8dcc6",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
},
{
"lessThan": "f89416eb3db151170a6f3c6dfc5239d26cdce4d2",
"status": "affected",
"version": "753f1ca4e1e50248a1b760c9774d6d6b354562cc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/esp4.c",
"net/ipv6/esp6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nesp: downgrade zerocopy managed frags before mutating skb frags\n\nOn the out-of-place output path (esp-\u003einplace == false) ESP rewrites the\nskb frag array: esp_output_head() appends a trailer frag and\nesp_output_tail() replaces the frags with a destination page, both\nreferenced with get_page().\n\nWhen the skb carries zerocopy managed frags (SKBFL_MANAGED_FRAG_REFS) the\npayload frags are owned by the ubuf and must not be referenced or\nunreferenced individually, but ESP mutates the frag array without ever\ndowngrading the skb. This breaks the managed-frag invariant two ways:\n\n - esp_ssg_unref() walks the source scatterlist and drops a page\n reference for every frag, including the ubuf-owned payload frags,\n pushing their refcount below the GUP pin bias while the pages are\n still pinned, i.e. a use-after-free of the zerocopy pages;\n\n - esp_output_tail() installs its destination page as frag 0 with\n get_page() but leaves SKBFL_MANAGED_FRAG_REFS set, so\n skb_release_data() takes the skip_unref branch and never drops that\n reference, leaking the x-\u003exfrag page at packet rate.\n\nFix this the way every other frag-mutating site does (__ip_append_data(),\n__ip6_append_data(), tcp_sendmsg_locked()) and call\nskb_zcopy_downgrade_managed() before ESP touches the frag array: it takes\na real reference on each existing frag and clears SKBFL_MANAGED_FRAG_REFS,\nso the per-frag unref in esp_ssg_unref() and the frag release in\nskb_release_data() are both balanced and no mixed-ownership frag array is\nleft behind."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Managed frags are set only by io_uring\u0027s io_sg_from_iter() for IORING_OP_SEND_ZC/SENDMSG_ZC with IORING_RECVSEND_FIXED_BUF, so a local process must submit the zerocopy send that esp_output_head()/esp6_output_head() then mutates; a remote peer cannot produce a SKBFL_MANAGED_FRAG_REFS skb.\nAC:L - The attacker picks every input: an uncloned UDP skb whose data_len+tailen fits in a page and lacks tailroom reliably takes the esp-\u003einplace=false branch, then esp_ssg_unref() drops refs on the ubuf-owned frags. No race or outside state is needed.\nPR:L - io_uring zerocopy send needs no privilege. The ESP SA/policy can be added inside an unprivileged user+net namespace because xfrm_user_rcv_msg only checks netlink_net_capable(CAP_NET_ADMIN); on a host with IPsec already set up, any local user\u0027s traffic hits it.\nUI:N - The attacker does everything with their own io_uring ring, registered buffer, socket and (namespaced) xfrm state; no other user has to act.\nS:U - The page refcount underflow and the freed page stay inside the kernel\u0027s own authority, so this is a normal local privilege escalation with no VM or sandbox boundary crossed.\nC:H - esp_ssg_unref() pushes the pinned registered-buffer pages\u0027 refcount below the GUP pin bias, so the page is freed while io_uring still has it mapped; once reallocated (e.g. as page tables or slab) the attacker can read kernel memory through the stale buffer.\nI:H - Writing through the still-registered fixed buffer into the freed and reallocated page is a page-level use-after-free write primitive (Dirty-Pagetable style), enough for arbitrary kernel memory corruption and privilege escalation.\nA:H - The page UAF leads to bad-page/refcount oopses, and the missing put_page on the x-\u003exfrag page installed by esp_output_tail() leaks memory at packet rate; both can take the system down."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:20.253Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2359264f377cdbdef2d95868cc8fb572949e48d3"
},
{
"url": "https://git.kernel.org/stable/c/69a768c12398cada8528080332c822623fa7064d"
},
{
"url": "https://git.kernel.org/stable/c/6508304ac2c8cdafca2f4ab915df8c707893e134"
},
{
"url": "https://git.kernel.org/stable/c/6cab554f2c0f28773f712ed3a5479103f42ce844"
},
{
"url": "https://git.kernel.org/stable/c/0d0845ee61c5df47cc68bc446501f48f71e8dcc6"
},
{
"url": "https://git.kernel.org/stable/c/f89416eb3db151170a6f3c6dfc5239d26cdce4d2"
}
],
"title": "esp: downgrade zerocopy managed frags before mutating skb frags",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98368",
"datePublished": "2026-10-06T08:46:53.292Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:20.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98261 (GCVE-0-2026-98261)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
When a secondary channel is no longer supported by the server,
cifs_chan_skip_or_disable() drops the channel reference with
cifs_put_tcp_session() and then continues to use the server pointer by
calling cifs_signal_cifsd_for_reconnect() on it and reading its
primary_server pointer. cifs_put_tcp_session() can drop the last
reference of the channel and tear it down, so both the channel and the
primary server (whose reference is also dropped by
cifs_put_tcp_session()) can be freed before they are signaled for
reconnect.
Signal the channel and the primary server and capture the primary
server pointer before dropping the channel reference with
cifs_put_tcp_session().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 50e8363ecc85da49764781da90ebffe1a657b370 Version: f591062bdbf4742b7f1622173017f19e927057b0 Version: f591062bdbf4742b7f1622173017f19e927057b0 Version: f591062bdbf4742b7f1622173017f19e927057b0 Version: f591062bdbf4742b7f1622173017f19e927057b0 Version: d61ba1d71ea6039eca7ada870bf3f0c3c8fc12e4 Version: 6.6.15 ≤ Version: 6.7.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0338489960ddad6368bce55e8adbc176c523093d",
"status": "affected",
"version": "50e8363ecc85da49764781da90ebffe1a657b370",
"versionType": "git"
},
{
"lessThan": "edd52eae5fcfb8433b6bb0e7cd98db438fe01227",
"status": "affected",
"version": "f591062bdbf4742b7f1622173017f19e927057b0",
"versionType": "git"
},
{
"lessThan": "fcc0a935bb6e37ecbf7e4335061309f896f35780",
"status": "affected",
"version": "f591062bdbf4742b7f1622173017f19e927057b0",
"versionType": "git"
},
{
"lessThan": "7a1b27780b113583a94256d58dabfe7c0d9286e7",
"status": "affected",
"version": "f591062bdbf4742b7f1622173017f19e927057b0",
"versionType": "git"
},
{
"lessThan": "717e0a25036b6c92cecace30913b2d874a4c22b8",
"status": "affected",
"version": "f591062bdbf4742b7f1622173017f19e927057b0",
"versionType": "git"
},
{
"status": "affected",
"version": "d61ba1d71ea6039eca7ada870bf3f0c3c8fc12e4",
"versionType": "git"
},
{
"lessThan": "6.6.158",
"status": "affected",
"version": "6.6.15",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix server use-after-free in cifs_chan_skip_or_disable()\n\nWhen a secondary channel is no longer supported by the server,\ncifs_chan_skip_or_disable() drops the channel reference with\ncifs_put_tcp_session() and then continues to use the server pointer by\ncalling cifs_signal_cifsd_for_reconnect() on it and reading its\nprimary_server pointer. cifs_put_tcp_session() can drop the last\nreference of the channel and tear it down, so both the channel and the\nprimary server (whose reference is also dropped by\ncifs_put_tcp_session()) can be freed before they are signaled for\nreconnect.\n\nSignal the channel and the primary server and capture the primary\nserver pointer before dropping the channel reference with\ncifs_put_tcp_session()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The trigger is the SMB2 NEGOTIATE response a remote server sends while a secondary channel reconnects. If it omits SMB2_GLOBAL_CAP_MULTI_CHANNEL with chan_count\u003e1, smb2_reconnect() calls smb3_update_ses_channels(disable_mchan=true) and then cifs_chan_skip_or_disable(). That function drops the channel\u0027s last reference and then uses the server.\nAC:H - cifs_put_tcp_session() only SIGKILLs the channel\u0027s cifsd thread. clean_demultiplex_info() sleeps at least 125 ms before kfree_sensitive(server), and the freed accesses (set_need_reco, server-\u003eprimary_server) run a few instructions after the put. The reconnecting thread must be descheduled across that window, which the remote attacker cannot control. The attacker must also be the server or on-path.\nPR:N - The attacker acts as the SMB server or an on-path party and needs no account or privilege on the client. The capability check runs in smb2_reconnect() right after cifs_negotiate_protocol(), before cifs_setup_session() authenticates anything.\nUI:N - An on-path attacker can force a reconnect of an existing multichannel mount and forge the unsigned NEGOTIATE response, so the victim takes no action. Signing and the 3.1.1 preauth hash are checked only after the bug fires.\nS:U - The freed TCP_Server_Info and the code using it are both in the client kernel, so this is a kernel memory-safety issue within the same security authority.\nC:H - After the freed channel TCP_Server_Info is reused, cifs_chan_skip_or_disable() reads server-\u003eprimary_server out of it and dereferences that pointer. An attacker who controls the reallocated object controls that pointer.\nI:H - cifs_signal_cifsd_for_reconnect() spin-locks and writes tcpStatus first in the freed channel and then through the primary_server pointer read from it. With the memory reallocated, that is a lock and write at an attacker-influenced address.\nA:H - Taking srv_lock and writing tcpStatus in a freed TCP_Server_Info, or following a stale primary_server pointer, can corrupt the slab or oops the client kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:32.334Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0338489960ddad6368bce55e8adbc176c523093d"
},
{
"url": "https://git.kernel.org/stable/c/edd52eae5fcfb8433b6bb0e7cd98db438fe01227"
},
{
"url": "https://git.kernel.org/stable/c/fcc0a935bb6e37ecbf7e4335061309f896f35780"
},
{
"url": "https://git.kernel.org/stable/c/7a1b27780b113583a94256d58dabfe7c0d9286e7"
},
{
"url": "https://git.kernel.org/stable/c/717e0a25036b6c92cecace30913b2d874a4c22b8"
}
],
"title": "cifs: Fix server use-after-free in cifs_chan_skip_or_disable()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98261",
"datePublished": "2026-10-06T08:45:25.361Z",
"dateReserved": "2026-09-25T10:25:14.332Z",
"dateUpdated": "2026-10-19T09:16:32.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90023 (GCVE-0-2026-90023)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
Previously fsg_num_buffers_validate() was removed as it was not
necessary due to Kconfig setting the limits for n from 2 to 256 with
default as 2. However, setting the page content in such a way that
kstrtou8() reflects n value as either 0 or 1 bypasses these
restrictions leading to a null pointer dereference if n is 0. Fix
this by adding a check for n < 2 and returning -EINVAL if n is
either 0 or 1 consistent with Kconfig logic.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_mass_storage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f4f0fe3ab47ed57ee4974fdd3e9dccb7839a7ebf",
"status": "affected",
"version": "fe5a6c48fd954489f51aab151d5dad9254c76419",
"versionType": "git"
},
{
"lessThan": "51cc9af4f2d3f0b765266aced66b9b532b423b13",
"status": "affected",
"version": "fe5a6c48fd954489f51aab151d5dad9254c76419",
"versionType": "git"
},
{
"lessThan": "9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957",
"status": "affected",
"version": "fe5a6c48fd954489f51aab151d5dad9254c76419",
"versionType": "git"
},
{
"lessThan": "b9b5b5df5b8dd3c1572ed267200276a44cc67d8e",
"status": "affected",
"version": "fe5a6c48fd954489f51aab151d5dad9254c76419",
"versionType": "git"
},
{
"lessThan": "2c0f5ca48674a5b5f9fa4a9c3325aa48053af0bc",
"status": "affected",
"version": "fe5a6c48fd954489f51aab151d5dad9254c76419",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_mass_storage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()\n\nPreviously fsg_num_buffers_validate() was removed as it was not\nnecessary due to Kconfig setting the limits for n from 2 to 256 with\ndefault as 2. However, setting the page content in such a way that\nkstrtou8() reflects n value as either 0 or 1 bypasses these\nrestrictions leading to a null pointer dereference if n is 0. Fix\nthis by adding a check for n \u003c 2 and returning -EINVAL if n is\neither 0 or 1 consistent with Kconfig logic."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:28.767Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f4f0fe3ab47ed57ee4974fdd3e9dccb7839a7ebf"
},
{
"url": "https://git.kernel.org/stable/c/51cc9af4f2d3f0b765266aced66b9b532b423b13"
},
{
"url": "https://git.kernel.org/stable/c/9e8dd2a7a8ccbb756771ad985b0ad3387ed3c957"
},
{
"url": "https://git.kernel.org/stable/c/b9b5b5df5b8dd3c1572ed267200276a44cc67d8e"
},
{
"url": "https://git.kernel.org/stable/c/2c0f5ca48674a5b5f9fa4a9c3325aa48053af0bc"
}
],
"title": "usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90023",
"datePublished": "2026-09-16T10:33:26.905Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-10-21T12:49:28.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97574 (GCVE-0-2026-97574)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-19 09:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Don't free the live ring's TPA state on queue restart failure
bnxt_queue_mem_alloc() shallow copies the live RX ring into the clone:
memcpy(clone, rxr, sizeof(*rxr));
the code currently clears pointers that the clone owns (such as
rx_agg_bmap), but rx_tpa and rx_tpa_idx_map are left pointing at memory
of the live ring that was cloned.
If an allocation failure happens later and the err_free_tpa_info label
is taken, the live ring's memory can be freed while still in use.
Fix this by initializing the clone's pointers to NULL to prevent live
ring state from being freed inadvertently.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e42287b4d38d653f7d4a47f6c29b0c01288bb050",
"status": "affected",
"version": "0997443906b96a051011f220a61e6dce4602ec54",
"versionType": "git"
},
{
"lessThan": "8ade95619cbfd1fc57f0f1a9a5ebdca2345a8d27",
"status": "affected",
"version": "bd649c5cc958169b8a8a3e77ea926d92d472b02a",
"versionType": "git"
},
{
"lessThan": "0596a7caa6fc283e142716739099c038d8714082",
"status": "affected",
"version": "bd649c5cc958169b8a8a3e77ea926d92d472b02a",
"versionType": "git"
},
{
"lessThan": "5ce7f36c334d723954855ac769ede2fe0e8f89c8",
"status": "affected",
"version": "bd649c5cc958169b8a8a3e77ea926d92d472b02a",
"versionType": "git"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "6.12.20",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Don\u0027t free the live ring\u0027s TPA state on queue restart failure\n\nbnxt_queue_mem_alloc() shallow copies the live RX ring into the clone:\n\n memcpy(clone, rxr, sizeof(*rxr));\n\nthe code currently clears pointers that the clone owns (such as\nrx_agg_bmap), but rx_tpa and rx_tpa_idx_map are left pointing at memory\nof the live ring that was cloned.\n\nIf an allocation failure happens later and the err_free_tpa_info label\nis taken, the live ring\u0027s memory can be freed while still in use.\n\nFix this by initializing the clone\u0027s pointers to NULL to prevent live\nring state from being freed inadvertently."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:09:36.867Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e42287b4d38d653f7d4a47f6c29b0c01288bb050"
},
{
"url": "https://git.kernel.org/stable/c/8ade95619cbfd1fc57f0f1a9a5ebdca2345a8d27"
},
{
"url": "https://git.kernel.org/stable/c/0596a7caa6fc283e142716739099c038d8714082"
},
{
"url": "https://git.kernel.org/stable/c/5ce7f36c334d723954855ac769ede2fe0e8f89c8"
}
],
"title": "bnxt_en: Don\u0027t free the live ring\u0027s TPA state on queue restart failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97574",
"datePublished": "2026-09-25T10:21:58.062Z",
"dateReserved": "2026-09-24T16:01:01.156Z",
"dateUpdated": "2026-10-19T09:09:36.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98379 (GCVE-0-2026-98379)
Vulnerability from cvelistv5
Published
2026-10-09 07:34
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_rpfilter: reject routes without inet6_dev
ip6_route_lookup() can return an error-free route whose rt6i_idev is
NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears
down its inet6_dev while fib6_ifdown() leaves routes using nexthop objects
in the FIB. An unprivileged user can construct this state with rtnetlink
in a private user and network namespace, then trigger a NULL dereference
through an IPv6 rpfilter lookup:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)
Call Trace:
ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)
nf_hook_slow (net/netfilter/core.c:619)
ipv6_rcv (net/ipv6/ip6_input.c:351)
__netif_receive_skb_one_core (net/core/dev.c:6216)
process_backlog (net/core/dev.c:6680)
__napi_poll (net/core/dev.c:7739)
net_rx_action (net/core/dev.c:7959)
handle_softirqs (kernel/softirq.c:622)
do_softirq.part.0 (kernel/softirq.c:523)
__local_bh_enable_ip (kernel/softirq.c:450)
__dev_queue_xmit (net/core/dev.c:4913)
packet_sendmsg (net/packet/af_packet.c:3139)
__sys_sendto (net/socket.c:2252)
__x64_sys_sendto (net/socket.c:2259)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Reject routes without an inet6_dev immediately after lookup. Such routes
are not eligible for reverse-path filtering, and the check protects all
later rt6i_idev dereferences.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e26f9a480fb6c1b614660e824d69a74e2ce990f3 Version: e26f9a480fb6c1b614660e824d69a74e2ce990f3 Version: e26f9a480fb6c1b614660e824d69a74e2ce990f3 Version: e26f9a480fb6c1b614660e824d69a74e2ce990f3 Version: e26f9a480fb6c1b614660e824d69a74e2ce990f3 Version: e26f9a480fb6c1b614660e824d69a74e2ce990f3 Version: e26f9a480fb6c1b614660e824d69a74e2ce990f3 Version: e26f9a480fb6c1b614660e824d69a74e2ce990f3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_rpfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f4de78756b0fddbd125b2b1b77c74f2eccc8e977",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "1681ab6dd1271f2f36047490793b78b1848bbcc9",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "65487e9e99431ffcf05024a817f51ee4e3bd9b47",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "f49da48bd679cfee646d6a40dd02b1933de577d1",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "eafe081ea77d25b5c8e601680671b4ecb4520e7d",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "3a7384bc2e66217c9a01a392281334f4423740a0",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
},
{
"lessThan": "1b9b5323725e458906c7620a3bc10398b51ad954",
"status": "affected",
"version": "e26f9a480fb6c1b614660e824d69a74e2ce990f3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_rpfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rpfilter: reject routes without inet6_dev\n\nip6_route_lookup() can return an error-free route whose rt6i_idev is\nNULL. Lowering an external nexthop device\u0027s MTU below IPV6_MIN_MTU tears\ndown its inet6_dev while fib6_ifdown() leaves routes using nexthop objects\nin the FIB. An unprivileged user can construct this state with rtnetlink\nin a private user and network namespace, then trigger a NULL dereference\nthrough an IPv6 rpfilter lookup:\n\n Oops: general protection fault, probably for non-canonical address\n 0xdffffc0000000000\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)\n Call Trace:\n ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)\n nf_hook_slow (net/netfilter/core.c:619)\n ipv6_rcv (net/ipv6/ip6_input.c:351)\n __netif_receive_skb_one_core (net/core/dev.c:6216)\n process_backlog (net/core/dev.c:6680)\n __napi_poll (net/core/dev.c:7739)\n net_rx_action (net/core/dev.c:7959)\n handle_softirqs (kernel/softirq.c:622)\n do_softirq.part.0 (kernel/softirq.c:523)\n __local_bh_enable_ip (kernel/softirq.c:450)\n __dev_queue_xmit (net/core/dev.c:4913)\n packet_sendmsg (net/packet/af_packet.c:3139)\n __sys_sendto (net/socket.c:2252)\n __x64_sys_sendto (net/socket.c:2259)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n Kernel panic - not syncing: Fatal exception in interrupt\n\nReject routes without an inet6_dev immediately after lookup. Such routes\nare not eligible for reverse-path filtering, and the check protects all\nlater rt6i_idev dereferences."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:30.044Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f4de78756b0fddbd125b2b1b77c74f2eccc8e977"
},
{
"url": "https://git.kernel.org/stable/c/1681ab6dd1271f2f36047490793b78b1848bbcc9"
},
{
"url": "https://git.kernel.org/stable/c/65487e9e99431ffcf05024a817f51ee4e3bd9b47"
},
{
"url": "https://git.kernel.org/stable/c/f49da48bd679cfee646d6a40dd02b1933de577d1"
},
{
"url": "https://git.kernel.org/stable/c/290c96e5d9471d1ded9ab1e8ffbb04f6ee7b0f40"
},
{
"url": "https://git.kernel.org/stable/c/eafe081ea77d25b5c8e601680671b4ecb4520e7d"
},
{
"url": "https://git.kernel.org/stable/c/3a7384bc2e66217c9a01a392281334f4423740a0"
},
{
"url": "https://git.kernel.org/stable/c/1b9b5323725e458906c7620a3bc10398b51ad954"
}
],
"title": "netfilter: ip6t_rpfilter: reject routes without inet6_dev",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98379",
"datePublished": "2026-10-09T07:34:19.425Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-19T09:18:30.044Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98204 (GCVE-0-2026-98204)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
When chunking writes into SMBus blocks in rmi_smb_write_block(), the
loop calculates block_len using the original total length (len) instead
of the remaining length (cur_len).
If len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32
for every iteration, even on the final partial chunk where fewer than 32
bytes remain. This causes smb_block_write() to read 32 bytes from the
advanced data buffer pointer, reading past the end of the input buffer.
Fix this by calculating block_len using cur_len and advancing the buffer
and address pointers by block_len.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 82264d0cf7aef2247563c031ff2ab96579d5d0cc Version: 82264d0cf7aef2247563c031ff2ab96579d5d0cc Version: 82264d0cf7aef2247563c031ff2ab96579d5d0cc Version: 82264d0cf7aef2247563c031ff2ab96579d5d0cc Version: 82264d0cf7aef2247563c031ff2ab96579d5d0cc Version: 82264d0cf7aef2247563c031ff2ab96579d5d0cc Version: 82264d0cf7aef2247563c031ff2ab96579d5d0cc Version: 82264d0cf7aef2247563c031ff2ab96579d5d0cc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_smbus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d01337c0892d1509500c727edf81380777c2dd0f",
"status": "affected",
"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc",
"versionType": "git"
},
{
"lessThan": "7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8",
"status": "affected",
"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc",
"versionType": "git"
},
{
"lessThan": "29fbcf5834f0a7f74bfd017c07da2411b35a4e2a",
"status": "affected",
"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc",
"versionType": "git"
},
{
"lessThan": "50dd585bee7669eb165e5defcc35d17f3822cfbb",
"status": "affected",
"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc",
"versionType": "git"
},
{
"lessThan": "e022538e13dd1c82af5ec25ac28f12ca0ab26160",
"status": "affected",
"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc",
"versionType": "git"
},
{
"lessThan": "dc05ec97b8299e48e31367a9bc412c7e9c0e2b42",
"status": "affected",
"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc",
"versionType": "git"
},
{
"lessThan": "9f0ce5e162eed8b68345abe839c59768bc60f99a",
"status": "affected",
"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc",
"versionType": "git"
},
{
"lessThan": "51cfe54f815ae175c7d1126b983d4d7c89715004",
"status": "affected",
"version": "82264d0cf7aef2247563c031ff2ab96579d5d0cc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/rmi4/rmi_smbus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()\n\nWhen chunking writes into SMBus blocks in rmi_smb_write_block(), the\nloop calculates block_len using the original total length (len) instead\nof the remaining length (cur_len).\n\nIf len is greater than 32 bytes (SMB_MAX_COUNT), block_len remains 32\nfor every iteration, even on the final partial chunk where fewer than 32\nbytes remain. This causes smb_block_write() to read 32 bytes from the\nadvanced data buffer pointer, reading past the end of the input buffer.\n\nFix this by calculating block_len using cur_len and advancing the buffer\nand address pointers by block_len."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:35.168Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d01337c0892d1509500c727edf81380777c2dd0f"
},
{
"url": "https://git.kernel.org/stable/c/7c800af1c6030a5f27d46ce7d6d5d75f9c1efaf8"
},
{
"url": "https://git.kernel.org/stable/c/29fbcf5834f0a7f74bfd017c07da2411b35a4e2a"
},
{
"url": "https://git.kernel.org/stable/c/50dd585bee7669eb165e5defcc35d17f3822cfbb"
},
{
"url": "https://git.kernel.org/stable/c/e022538e13dd1c82af5ec25ac28f12ca0ab26160"
},
{
"url": "https://git.kernel.org/stable/c/dc05ec97b8299e48e31367a9bc412c7e9c0e2b42"
},
{
"url": "https://git.kernel.org/stable/c/9f0ce5e162eed8b68345abe839c59768bc60f99a"
},
{
"url": "https://git.kernel.org/stable/c/51cfe54f815ae175c7d1126b983d4d7c89715004"
}
],
"title": "Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98204",
"datePublished": "2026-10-06T08:44:41.712Z",
"dateReserved": "2026-09-25T10:25:14.325Z",
"dateUpdated": "2026-10-19T09:15:35.168Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93244 (GCVE-0-2026-93244)
Vulnerability from cvelistv5
Published
2026-09-24 15:40
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/sysfb: simpledrm: Improve stride validation
Validate the computed stride against the maximum value INT_MAX.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/sysfb/simpledrm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "110dd054fd4af97fc3f47d7df9a016b07122cc04",
"status": "affected",
"version": "7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1",
"versionType": "git"
},
{
"lessThan": "b09d27caf49ff584dbafdba3bb95487a75cb8824",
"status": "affected",
"version": "7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1",
"versionType": "git"
},
{
"lessThan": "6892f0a2f6b5990b9572ba043dd14dd4df6bb3f0",
"status": "affected",
"version": "7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1",
"versionType": "git"
},
{
"lessThan": "bbdc6761c55662fb9ddf5ab580acb616131998fe",
"status": "affected",
"version": "7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1",
"versionType": "git"
},
{
"lessThan": "df6533f11688aa30be3bb883c7637f4ffdbb7cbd",
"status": "affected",
"version": "7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/sysfb/simpledrm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sysfb: simpledrm: Improve stride validation\n\nValidate the computed stride against the maximum value INT_MAX."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:29.500Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/110dd054fd4af97fc3f47d7df9a016b07122cc04"
},
{
"url": "https://git.kernel.org/stable/c/b09d27caf49ff584dbafdba3bb95487a75cb8824"
},
{
"url": "https://git.kernel.org/stable/c/6892f0a2f6b5990b9572ba043dd14dd4df6bb3f0"
},
{
"url": "https://git.kernel.org/stable/c/bbdc6761c55662fb9ddf5ab580acb616131998fe"
},
{
"url": "https://git.kernel.org/stable/c/df6533f11688aa30be3bb883c7637f4ffdbb7cbd"
}
],
"title": "drm/sysfb: simpledrm: Improve stride validation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93244",
"datePublished": "2026-09-24T15:40:29.560Z",
"dateReserved": "2026-09-17T16:02:15.096Z",
"dateUpdated": "2026-10-21T12:52:29.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98362 (GCVE-0-2026-98362)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
dvfs_get_idx() may return an out-of-range index if the SCP firmware is
buggy or returns a stale value. Only negative indexes were rejected, so a
large index walked past info->opps and could treat garbage as a clock rate
(KASAN OOB / wrong frequency to consumers). The missing upper bound dates
back to the original SCPI clock driver.
Treat indexes >= opp count as invalid and return 0, same as idx < 0.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cd52c2a4b5c43631e429d06dce12e08b0cab477f Version: cd52c2a4b5c43631e429d06dce12e08b0cab477f Version: cd52c2a4b5c43631e429d06dce12e08b0cab477f Version: cd52c2a4b5c43631e429d06dce12e08b0cab477f Version: cd52c2a4b5c43631e429d06dce12e08b0cab477f Version: cd52c2a4b5c43631e429d06dce12e08b0cab477f Version: cd52c2a4b5c43631e429d06dce12e08b0cab477f Version: cd52c2a4b5c43631e429d06dce12e08b0cab477f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clk/clk-scpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6e3b55823da8ef0d99621efb422cc29f50d7f280",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "7204095917aeaac89db7377c29a457351a19b076",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "56b7a9d89c67932bf11b71e3b6d17941fc24a393",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "a82b274697d0876b478594ca78ad1e6cb062467b",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "e1188332a9110cf3635fe286481ee38305b3c2b6",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "108c46e8dacc4a0e472a74f98171115d49cbc079",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
},
{
"lessThan": "70f4b78d560e592cbf3325b162424737d032fc1d",
"status": "affected",
"version": "cd52c2a4b5c43631e429d06dce12e08b0cab477f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clk/clk-scpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate\n\ndvfs_get_idx() may return an out-of-range index if the SCP firmware is\nbuggy or returns a stale value. Only negative indexes were rejected, so a\nlarge index walked past info-\u003eopps and could treat garbage as a clock rate\n(KASAN OOB / wrong frequency to consumers). The missing upper bound dates\nback to the original SCPI clock driver.\n\nTreat indexes \u003e= opp count as invalid and return 0, same as idx \u003c 0."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:13.818Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6e3b55823da8ef0d99621efb422cc29f50d7f280"
},
{
"url": "https://git.kernel.org/stable/c/7204095917aeaac89db7377c29a457351a19b076"
},
{
"url": "https://git.kernel.org/stable/c/0f89e2ac0e945da2ce798f6a61aebf9d291c2e0a"
},
{
"url": "https://git.kernel.org/stable/c/56b7a9d89c67932bf11b71e3b6d17941fc24a393"
},
{
"url": "https://git.kernel.org/stable/c/a82b274697d0876b478594ca78ad1e6cb062467b"
},
{
"url": "https://git.kernel.org/stable/c/e1188332a9110cf3635fe286481ee38305b3c2b6"
},
{
"url": "https://git.kernel.org/stable/c/108c46e8dacc4a0e472a74f98171115d49cbc079"
},
{
"url": "https://git.kernel.org/stable/c/70f4b78d560e592cbf3325b162424737d032fc1d"
}
],
"title": "clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98362",
"datePublished": "2026-10-06T08:46:48.426Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:13.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98421 (GCVE-0-2026-98421)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-19 09:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: require a peer station for TDLS setup confirm
It's nonsense for the setup confirm to go to station that
doesn't even exist, and it hits a warning when building
the frame:
WARN_ON_ONCE(!sta || !ap_sta)
Only accept WLAN_TDLS_SETUP_CONFIRM when the station is
already there as a TDLS station. Need to copy the call
to ieee80211_tdls_prep_mgmt_packet() since the existing
WLAN_TDLS_DISCOVERY_REQUEST already falls through to it.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6f7eaa47e1de30159277f91f1145a6687f13ffd9 Version: 6f7eaa47e1de30159277f91f1145a6687f13ffd9 Version: 6f7eaa47e1de30159277f91f1145a6687f13ffd9 Version: 6f7eaa47e1de30159277f91f1145a6687f13ffd9 Version: 6f7eaa47e1de30159277f91f1145a6687f13ffd9 Version: 6f7eaa47e1de30159277f91f1145a6687f13ffd9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/tdls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6bae6ef511a29ef12ab969adeea691067d4d5d74",
"status": "affected",
"version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9",
"versionType": "git"
},
{
"lessThan": "d0afa5395c46d73ad2090aa50209886e84f179bd",
"status": "affected",
"version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9",
"versionType": "git"
},
{
"lessThan": "742c762bee59c973684f70dfed7de4945d3141e2",
"status": "affected",
"version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9",
"versionType": "git"
},
{
"lessThan": "fce36d242a18ddf64731d816a37564103172da11",
"status": "affected",
"version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9",
"versionType": "git"
},
{
"lessThan": "1c0a5c96473b9e7a5f4c453ef6a13dc0f5589a4b",
"status": "affected",
"version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9",
"versionType": "git"
},
{
"lessThan": "038e1d126304fd25d507fd4e671232df57bd1799",
"status": "affected",
"version": "6f7eaa47e1de30159277f91f1145a6687f13ffd9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/tdls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: require a peer station for TDLS setup confirm\n\nIt\u0027s nonsense for the setup confirm to go to station that\ndoesn\u0027t even exist, and it hits a warning when building\nthe frame:\n\n WARN_ON_ONCE(!sta || !ap_sta)\n\nOnly accept WLAN_TDLS_SETUP_CONFIRM when the station is\nalready there as a TDLS station. Need to copy the call\nto ieee80211_tdls_prep_mgmt_packet() since the existing\nWLAN_TDLS_DISCOVERY_REQUEST already falls through to it."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:19:14.905Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6bae6ef511a29ef12ab969adeea691067d4d5d74"
},
{
"url": "https://git.kernel.org/stable/c/d0afa5395c46d73ad2090aa50209886e84f179bd"
},
{
"url": "https://git.kernel.org/stable/c/742c762bee59c973684f70dfed7de4945d3141e2"
},
{
"url": "https://git.kernel.org/stable/c/fce36d242a18ddf64731d816a37564103172da11"
},
{
"url": "https://git.kernel.org/stable/c/1c0a5c96473b9e7a5f4c453ef6a13dc0f5589a4b"
},
{
"url": "https://git.kernel.org/stable/c/038e1d126304fd25d507fd4e671232df57bd1799"
}
],
"title": "wifi: mac80211: require a peer station for TDLS setup confirm",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98421",
"datePublished": "2026-10-14T13:27:50.200Z",
"dateReserved": "2026-09-25T10:25:14.348Z",
"dateUpdated": "2026-10-19T09:19:14.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98238 (GCVE-0-2026-98238)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
The netif index carried in the DPMAIF PIT header is five bits wide,
but ccmni_inst[] only has room for NIC_DEV_MAX (21) entries.
t7xx_ccmni_recv_skb() indexes the array without a bounds check, so
indexes 21 to 31 read past it. The out-of-bounds value lands in the
callback table that follows the array, which is never NULL, so the
existing !ccmni check does not catch it and the driver dereferences
whatever sits there as a struct t7xx_ccmni.
Drop the skb when the index is out of range.
Verified in a QEMU guest with a fault injector setting the netif
index to 25: the unpatched driver reads a value past ccmni_inst[],
which lands in the callback table, and dereferences it far enough to
queue the skb. With this check the packet is dropped. Well-formed
traffic on index 0 is unaffected.
Changes in v2: none.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 05d19bf500f8281f574713479b04679fa226d0a3 Version: 05d19bf500f8281f574713479b04679fa226d0a3 Version: 05d19bf500f8281f574713479b04679fa226d0a3 Version: 05d19bf500f8281f574713479b04679fa226d0a3 Version: 05d19bf500f8281f574713479b04679fa226d0a3 Version: 05d19bf500f8281f574713479b04679fa226d0a3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wwan/t7xx/t7xx_netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7c2fe308bda5a7e6222d7f0c3c311991372baab4",
"status": "affected",
"version": "05d19bf500f8281f574713479b04679fa226d0a3",
"versionType": "git"
},
{
"lessThan": "fba45070e25abdae08bcaebfadeef050dc39e208",
"status": "affected",
"version": "05d19bf500f8281f574713479b04679fa226d0a3",
"versionType": "git"
},
{
"lessThan": "e1b0609b1a40da03e385be290853a604eb4c3fb9",
"status": "affected",
"version": "05d19bf500f8281f574713479b04679fa226d0a3",
"versionType": "git"
},
{
"lessThan": "9dbf13de4edff6fbc1f7ad9c4040326b6ed599ad",
"status": "affected",
"version": "05d19bf500f8281f574713479b04679fa226d0a3",
"versionType": "git"
},
{
"lessThan": "d28aa2de9654e8024922775520a2665e00c04ad5",
"status": "affected",
"version": "05d19bf500f8281f574713479b04679fa226d0a3",
"versionType": "git"
},
{
"lessThan": "c7ead9704249d57d4693a04697e3bbd285138fa9",
"status": "affected",
"version": "05d19bf500f8281f574713479b04679fa226d0a3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wwan/t7xx/t7xx_netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()\n\nThe netif index carried in the DPMAIF PIT header is five bits wide,\nbut ccmni_inst[] only has room for NIC_DEV_MAX (21) entries.\nt7xx_ccmni_recv_skb() indexes the array without a bounds check, so\nindexes 21 to 31 read past it. The out-of-bounds value lands in the\ncallback table that follows the array, which is never NULL, so the\nexisting !ccmni check does not catch it and the driver dereferences\nwhatever sits there as a struct t7xx_ccmni.\n\nDrop the skb when the index is out of range.\n\n\nVerified in a QEMU guest with a fault injector setting the netif\nindex to 25: the unpatched driver reads a value past ccmni_inst[],\nwhich lands in the callback table, and dereferences it far enough to\nqueue the skb. With this check the packet is dropped. Well-formed\ntraffic on index 0 is unaffected.\n\nChanges in v2: none."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:09.924Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7c2fe308bda5a7e6222d7f0c3c311991372baab4"
},
{
"url": "https://git.kernel.org/stable/c/fba45070e25abdae08bcaebfadeef050dc39e208"
},
{
"url": "https://git.kernel.org/stable/c/e1b0609b1a40da03e385be290853a604eb4c3fb9"
},
{
"url": "https://git.kernel.org/stable/c/9dbf13de4edff6fbc1f7ad9c4040326b6ed599ad"
},
{
"url": "https://git.kernel.org/stable/c/d28aa2de9654e8024922775520a2665e00c04ad5"
},
{
"url": "https://git.kernel.org/stable/c/c7ead9704249d57d4693a04697e3bbd285138fa9"
}
],
"title": "net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98238",
"datePublished": "2026-10-06T08:45:09.953Z",
"dateReserved": "2026-09-25T10:25:14.329Z",
"dateUpdated": "2026-10-19T09:16:09.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98293 (GCVE-0-2026-98293)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
iso_get_sock() returns the parent socket with a reference held, which is
dropped by sock_put() once the child socket has been set up. The error
path taken when iso_sock_alloc() fails only calls release_sock() and
returns, leaking the reference and thus the parent socket itself.
Drop the reference on that path as well.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 11dc486ed5d4626e6b92a23b67ed76cb6c48bfc9 Version: fa224d0c094a458e9ebf5ea9b1c696136b7af427 Version: fa224d0c094a458e9ebf5ea9b1c696136b7af427 Version: fa224d0c094a458e9ebf5ea9b1c696136b7af427 Version: fa224d0c094a458e9ebf5ea9b1c696136b7af427 Version: 6.6.67 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea8a262662be62c095789924c11722ecbf40a4de",
"status": "affected",
"version": "11dc486ed5d4626e6b92a23b67ed76cb6c48bfc9",
"versionType": "git"
},
{
"lessThan": "9228f87365e68a6cae191f57f456e89a6d2167cf",
"status": "affected",
"version": "fa224d0c094a458e9ebf5ea9b1c696136b7af427",
"versionType": "git"
},
{
"lessThan": "e2b156a8d25966be49c1f809b654a2c4bb16564d",
"status": "affected",
"version": "fa224d0c094a458e9ebf5ea9b1c696136b7af427",
"versionType": "git"
},
{
"lessThan": "f016daabd4fec4e9b8563f8b6f42eabce0ca66b0",
"status": "affected",
"version": "fa224d0c094a458e9ebf5ea9b1c696136b7af427",
"versionType": "git"
},
{
"lessThan": "ca18ee413a7cb6f09885778039225e58bae0d607",
"status": "affected",
"version": "fa224d0c094a458e9ebf5ea9b1c696136b7af427",
"versionType": "git"
},
{
"lessThan": "6.6.158",
"status": "affected",
"version": "6.6.67",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/iso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.6.67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: Fix parent socket leak in iso_conn_ready()\n\niso_get_sock() returns the parent socket with a reference held, which is\ndropped by sock_put() once the child socket has been set up. The error\npath taken when iso_sock_alloc() fails only calls release_sock() and\nreturns, leaking the reference and thus the parent socket itself.\n\nDrop the reference on that path as well."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:04.348Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea8a262662be62c095789924c11722ecbf40a4de"
},
{
"url": "https://git.kernel.org/stable/c/9228f87365e68a6cae191f57f456e89a6d2167cf"
},
{
"url": "https://git.kernel.org/stable/c/e2b156a8d25966be49c1f809b654a2c4bb16564d"
},
{
"url": "https://git.kernel.org/stable/c/f016daabd4fec4e9b8563f8b6f42eabce0ca66b0"
},
{
"url": "https://git.kernel.org/stable/c/ca18ee413a7cb6f09885778039225e58bae0d607"
}
],
"title": "Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98293",
"datePublished": "2026-10-06T08:45:52.558Z",
"dateReserved": "2026-09-25T10:25:14.336Z",
"dateUpdated": "2026-10-19T09:17:04.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98360 (GCVE-0-2026-98360)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
rxe_get_mcg() publishes a newly allocated multicast group in
rxe->mcg_tree before programming the backing Ethernet multicast address
with rxe_mcast_add(), which runs outside mcg_lock. A local userspace
RDMA client reaches this path with ATTACH_MCAST on a UD QP; if
rxe_mcast_add() then returns an error (for example -ENODEV when the
backing netdev has been removed, or a propagated dev_mc_add() error),
the unwind frees the published group without removing it from the tree.
A later lookup of the same MGID dereferences the freed struct rxe_mcg
from __rxe_lookup_mcg().
Fix this by keeping the new mcg private until rxe_mcast_add() succeeds.
Split the tree publication into __rxe_publish_mcg(), call rxe_mcast_add()
before taking the tree reference, and free the still-private mcg on
failure. Because the group is never visible in mcg_tree until the
multicast address is programmed, no concurrent caller can look it up or
attach a QP to a group that is about to be torn down, so the error path
needs no conditional unwind. If another caller publishes the same MGID
while the address is being programmed, the post-add re-check under
mcg_lock finds the winner; this caller then drops its private object and
balances its own rxe_mcast_add() with rxe_mcast_del() before returning
the winner.
Reproduced by forcing the rxe_mcast_add() error return under KASAN:
without the change the next attach to the same MGID reports a
slab-use-after-free in __rxe_lookup_mcg(); with it the forced failure
returns cleanly. A no-injection attach/detach regression, including a
two-QP shared join/leave and re-attach, stays KASAN- and leak-clean.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a926a903b7dc39a8a949150258c09290998dd812 Version: a926a903b7dc39a8a949150258c09290998dd812 Version: a926a903b7dc39a8a949150258c09290998dd812 Version: a926a903b7dc39a8a949150258c09290998dd812 Version: a926a903b7dc39a8a949150258c09290998dd812 Version: a926a903b7dc39a8a949150258c09290998dd812 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mcast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ddb43ac0926d4a931bc9b7744b93627f627457e5",
"status": "affected",
"version": "a926a903b7dc39a8a949150258c09290998dd812",
"versionType": "git"
},
{
"lessThan": "c79a789aa15180a1543b5db49c343d12e3ec214d",
"status": "affected",
"version": "a926a903b7dc39a8a949150258c09290998dd812",
"versionType": "git"
},
{
"lessThan": "faae1fb4ccf8205806a8802c008798dabeb0205b",
"status": "affected",
"version": "a926a903b7dc39a8a949150258c09290998dd812",
"versionType": "git"
},
{
"lessThan": "02c0a2fa69c16248a7432af8a6d64ab2a73a5283",
"status": "affected",
"version": "a926a903b7dc39a8a949150258c09290998dd812",
"versionType": "git"
},
{
"lessThan": "d4fc4e37f8a143b0fe83b42c8fb48cf542154fee",
"status": "affected",
"version": "a926a903b7dc39a8a949150258c09290998dd812",
"versionType": "git"
},
{
"lessThan": "1caceeb2d74bbe88223aea55eb8626b4c5f076fd",
"status": "affected",
"version": "a926a903b7dc39a8a949150258c09290998dd812",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mcast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds\n\nrxe_get_mcg() publishes a newly allocated multicast group in\nrxe-\u003emcg_tree before programming the backing Ethernet multicast address\nwith rxe_mcast_add(), which runs outside mcg_lock. A local userspace\nRDMA client reaches this path with ATTACH_MCAST on a UD QP; if\nrxe_mcast_add() then returns an error (for example -ENODEV when the\nbacking netdev has been removed, or a propagated dev_mc_add() error),\nthe unwind frees the published group without removing it from the tree.\nA later lookup of the same MGID dereferences the freed struct rxe_mcg\nfrom __rxe_lookup_mcg().\n\nFix this by keeping the new mcg private until rxe_mcast_add() succeeds.\nSplit the tree publication into __rxe_publish_mcg(), call rxe_mcast_add()\nbefore taking the tree reference, and free the still-private mcg on\nfailure. Because the group is never visible in mcg_tree until the\nmulticast address is programmed, no concurrent caller can look it up or\nattach a QP to a group that is about to be torn down, so the error path\nneeds no conditional unwind. If another caller publishes the same MGID\nwhile the address is being programmed, the post-add re-check under\nmcg_lock finds the winner; this caller then drops its private object and\nbalances its own rxe_mcast_add() with rxe_mcast_del() before returning\nthe winner.\n\nReproduced by forcing the rxe_mcast_add() error return under KASAN:\nwithout the change the next attach to the same MGID reports a\nslab-use-after-free in __rxe_lookup_mcg(); with it the forced failure\nreturns cleanly. A no-injection attach/detach regression, including a\ntwo-QP shared join/leave and re-attach, stays KASAN- and leak-clean."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The faulty publish-then-free sequence is in rxe_get_mcg(), reached from the uverbs ATTACH_MCAST command (ib_uverbs_attach_mcast -\u003e ib_attach_mcast -\u003e rxe_attach_mcast) on a local UD QP. A remote RoCEv2 multicast packet (rxe_rcv_mcast_pkt -\u003e rxe_lookup_mcg) can only hit the stale node after a local caller has already caused the failure.\nAC:H - The dangling mcg is only left behind when rxe_mcast_add() fails after the group is published. That needs ib_device_get_netdev() to return NULL while the rxe netdev is being unregistered (an admin or hardware event), or a GFP_ATOMIC failure in __hw_addr_create(). An unprivileged user cannot produce either on demand.\nPR:L - ib_uverbs_attach_mcast() and rxe_attach_mcast() have no capability check, so any user who can open the rxe uverbs device and create a UD QP can drive rxe_get_mcg(). Creating the rxe link itself (RDMA_NL_ADMIN_PERM, checked with netlink_capable against the init namespace) is admin setup the attacker does not perform.\nUI:N - The attacker issues ATTACH_MCAST for the failing MGID and then the follow-up attach/detach/lookup themselves; no other user has to act.\nS:U - The freed rxe_mcg is kernel heap memory in the same kernel security authority; there is no VM, IOMMU or sandbox boundary crossed.\nC:H - The freed struct rxe_mcg stays linked in rxe-\u003emcg_tree. __rxe_lookup_mcg() walks its rb_node and mgid, and later code follows its qp_list, so reallocating that slab slot with attacker-chosen data gives a heap read primitive.\nI:H - After the free, __rxe_lookup_mcg() does kref_get() on the stale object, and rxe_attach_mcg() list_add()s an mca into its qp_list and updates qp_num. These are writes into reallocated memory, and the rb-tree insert/erase relinks through the freed node.\nA:H - The next ATTACH_MCAST, detach, or received multicast lookup for that MGID dereferences the freed rxe_mcg (KASAN slab-use-after-free in __rxe_lookup_mcg()), corrupting the rb-tree and crashing the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:11.284Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ddb43ac0926d4a931bc9b7744b93627f627457e5"
},
{
"url": "https://git.kernel.org/stable/c/c79a789aa15180a1543b5db49c343d12e3ec214d"
},
{
"url": "https://git.kernel.org/stable/c/faae1fb4ccf8205806a8802c008798dabeb0205b"
},
{
"url": "https://git.kernel.org/stable/c/02c0a2fa69c16248a7432af8a6d64ab2a73a5283"
},
{
"url": "https://git.kernel.org/stable/c/d4fc4e37f8a143b0fe83b42c8fb48cf542154fee"
},
{
"url": "https://git.kernel.org/stable/c/1caceeb2d74bbe88223aea55eb8626b4c5f076fd"
}
],
"title": "RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98360",
"datePublished": "2026-10-06T08:46:46.743Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:11.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93243 (GCVE-0-2026-93243)
Vulnerability from cvelistv5
Published
2026-09-24 15:40
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/secretmem: properly account locked pages
secretmem accounts folios by treating memory as if it were mlock()'d and
thus limited by the RLIMIT_MEMLOCK limit.
However the folios are unevictable and remain so until the inode is
evicted, eliminating usual mlock() semantics - mapping folios then
unmapping them does not clear their unevictable state, since it depends on
AS_UNEVICTABLE, not PG_mlocked.
A user can therefore easily work around the RLIMIT_MEMLOCK limit - simply
map then unmap and VmLck no longer counts the secretmem range. Worse,
folios are not accounted in the process's RSS, meaning the OOM killer
won't know to kill the process.
Repeatedly mapping/unmapping (or forking) can then result in the
consumption of all available system memory with unevictable folios and
cause system instability.
A secretmem fd can be passed between processes and over fork so a
per-process limit simply does not make sense, so follow the precedent set
by io_uring, perf, skbuff, iommufd and xdp by tracking the number of
locked pages in user_struct->locked_vm.
Since the scope tracked is actually inode lifetime, the RLIMIT_MEMLOCK
applies per-user not per-process, so it doesn't make sense to bypass for
users with CAP_IPC_LOCK, therefore remove this bypass.
There is simply no reason to carry on marking the mapping as mlock()'d
since it's misleading and the lifecycle is now correctly handled, so
remove this too.
Note that secretmem does not support any form of truncation (including
hole punching) and the folios are unreclaimable, so the folios need only
be accounted on fault and unaccounted on inode destruction.
__secretmem_account_pages() is more or less a duplicate of the code that
io_uring etc. use, but since this is a bug fix that needs backporting,
defer any de-duplication efforts to a follow-up.
test_mlock_limit() asserts mlock_future_ok() on mmap(), however this has
been removed, so remove the test altogether for the fix. A new test will
be sent separately for upstream.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/sched/user.h",
"mm/secretmem.c",
"tools/testing/selftests/mm/memfd_secret.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "51fba083e454f901947d6a335eeff671171d4714",
"status": "affected",
"version": "1507f51255c9ff07d75909a84e7c0d7f3c4b2f49",
"versionType": "git"
},
{
"lessThan": "a41c95ac90f285cbe473b9606428b14518896ea4",
"status": "affected",
"version": "1507f51255c9ff07d75909a84e7c0d7f3c4b2f49",
"versionType": "git"
},
{
"lessThan": "853043cb129473ff2fa0090602be944d96b9d5c9",
"status": "affected",
"version": "1507f51255c9ff07d75909a84e7c0d7f3c4b2f49",
"versionType": "git"
},
{
"lessThan": "3b4f72bdddff69819d665395376329ef21f37a06",
"status": "affected",
"version": "1507f51255c9ff07d75909a84e7c0d7f3c4b2f49",
"versionType": "git"
},
{
"lessThan": "97d34aa65c29cca85e3e9050f4c936389b38a054",
"status": "affected",
"version": "1507f51255c9ff07d75909a84e7c0d7f3c4b2f49",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/sched/user.h",
"mm/secretmem.c",
"tools/testing/selftests/mm/memfd_secret.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/secretmem: properly account locked pages\n\nsecretmem accounts folios by treating memory as if it were mlock()\u0027d and\nthus limited by the RLIMIT_MEMLOCK limit.\n\nHowever the folios are unevictable and remain so until the inode is\nevicted, eliminating usual mlock() semantics - mapping folios then\nunmapping them does not clear their unevictable state, since it depends on\nAS_UNEVICTABLE, not PG_mlocked.\n\nA user can therefore easily work around the RLIMIT_MEMLOCK limit - simply\nmap then unmap and VmLck no longer counts the secretmem range. Worse,\nfolios are not accounted in the process\u0027s RSS, meaning the OOM killer\nwon\u0027t know to kill the process.\n\nRepeatedly mapping/unmapping (or forking) can then result in the\nconsumption of all available system memory with unevictable folios and\ncause system instability.\n\nA secretmem fd can be passed between processes and over fork so a\nper-process limit simply does not make sense, so follow the precedent set\nby io_uring, perf, skbuff, iommufd and xdp by tracking the number of\nlocked pages in user_struct-\u003elocked_vm.\n\nSince the scope tracked is actually inode lifetime, the RLIMIT_MEMLOCK\napplies per-user not per-process, so it doesn\u0027t make sense to bypass for\nusers with CAP_IPC_LOCK, therefore remove this bypass.\n\nThere is simply no reason to carry on marking the mapping as mlock()\u0027d\nsince it\u0027s misleading and the lifecycle is now correctly handled, so\nremove this too.\n\nNote that secretmem does not support any form of truncation (including\nhole punching) and the folios are unreclaimable, so the folios need only\nbe accounted on fault and unaccounted on inode destruction.\n\n__secretmem_account_pages() is more or less a duplicate of the code that\nio_uring etc. use, but since this is a bug fix that needs backporting,\ndefer any de-duplication efforts to a follow-up.\n\ntest_mlock_limit() asserts mlock_future_ok() on mmap(), however this has\nbeen removed, so remove the test altogether for the fix. A new test will\nbe sent separately for upstream."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:28.399Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/51fba083e454f901947d6a335eeff671171d4714"
},
{
"url": "https://git.kernel.org/stable/c/a41c95ac90f285cbe473b9606428b14518896ea4"
},
{
"url": "https://git.kernel.org/stable/c/853043cb129473ff2fa0090602be944d96b9d5c9"
},
{
"url": "https://git.kernel.org/stable/c/3b4f72bdddff69819d665395376329ef21f37a06"
},
{
"url": "https://git.kernel.org/stable/c/97d34aa65c29cca85e3e9050f4c936389b38a054"
}
],
"title": "mm/secretmem: properly account locked pages",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93243",
"datePublished": "2026-09-24T15:40:27.606Z",
"dateReserved": "2026-09-17T16:02:15.095Z",
"dateUpdated": "2026-10-21T12:52:28.399Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89437 (GCVE-0-2026-89437)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: int1092: Fix potential memory leak in sar_probe()
The memory allocated for device_mode_info in parse_package() called by
sar_get_data() is not freed in some of the error paths in sar_probe().
Fix that by converting to use device managed allocations.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/intel/int1092/intel_sar.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d680ce2b39f9a635365746d0ada3d6a6d861789b",
"status": "affected",
"version": "dcfbd31ef4bcf6ceb373911faa4a5299e0547702",
"versionType": "git"
},
{
"lessThan": "4bdbb7f1045820aa8fd87d84db6b26c01049a005",
"status": "affected",
"version": "dcfbd31ef4bcf6ceb373911faa4a5299e0547702",
"versionType": "git"
},
{
"lessThan": "08dab7065f9369dd0a0aa740071bcd884c4848b0",
"status": "affected",
"version": "dcfbd31ef4bcf6ceb373911faa4a5299e0547702",
"versionType": "git"
},
{
"lessThan": "582b82e573a059be9319bb16b84c45d0ef66f471",
"status": "affected",
"version": "dcfbd31ef4bcf6ceb373911faa4a5299e0547702",
"versionType": "git"
},
{
"lessThan": "30c906cff490c3601ee9ff110fe8115fabe75fd4",
"status": "affected",
"version": "dcfbd31ef4bcf6ceb373911faa4a5299e0547702",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/intel/int1092/intel_sar.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: int1092: Fix potential memory leak in sar_probe()\n\nThe memory allocated for device_mode_info in parse_package() called by\nsar_get_data() is not freed in some of the error paths in sar_probe().\nFix that by converting to use device managed allocations."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:25.687Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d680ce2b39f9a635365746d0ada3d6a6d861789b"
},
{
"url": "https://git.kernel.org/stable/c/4bdbb7f1045820aa8fd87d84db6b26c01049a005"
},
{
"url": "https://git.kernel.org/stable/c/08dab7065f9369dd0a0aa740071bcd884c4848b0"
},
{
"url": "https://git.kernel.org/stable/c/582b82e573a059be9319bb16b84c45d0ef66f471"
},
{
"url": "https://git.kernel.org/stable/c/30c906cff490c3601ee9ff110fe8115fabe75fd4"
}
],
"title": "platform/x86: int1092: Fix potential memory leak in sar_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89437",
"datePublished": "2026-09-11T19:43:07.377Z",
"dateReserved": "2026-09-11T19:38:34.703Z",
"dateUpdated": "2026-10-21T12:47:25.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72315 (GCVE-0-2026-72315)
Vulnerability from cvelistv5
Published
2026-08-15 05:55
Modified
2026-10-03 10:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix busy dentry warning on unmount after DIO
Commit c68337442f03 ("cifs: Fix busy dentry used after unmounting") fixed
the issue in cifs where deferred close of a file led to a dentry reference
count not being released in umount, by flushing deferredclose_wq in
cifs_kill_sb() to solve it.
However, the cifs DIO path suffers from the same busy-dentry problem caused
by a delayed dentry reference-count release:
[dio] [cifsd] [close + umount]
netfs_unbuffered_write_iter_locked
...
cifs_demultiplex_thread
netfs_unbuffered_write
cifs_issue_write
netfs_wait_for_in_progress_stream [1]
...
netfs_write_subrequest_terminated
netfs_subreq_clear_in_progress
netfs_wake_collector // wake [1]
netfs_put_subrequest
netfs_put_request
queue_work(system_dfl_wq, xxx) [2]
// dio write return cifs_close
_cifsFileInfo_put
// cfile->count 2->1
--cfile->count [3]
// umount
cifs_kill_sb
kill_anon_super
// warning triggered!
shrink_dcache_for_umount [4]
[system_dfl_wq] [5]
netfs_free_request
...
_cifsFileInfo_put
// cfile->count 1->0
--cfile->count
queue_work(fileinfo_put_wq, xxx)
[fileinfo_put_wq] [6]
cifsFileInfo_put_work
cifsFileInfo_put_final
dput
If the umount path is triggered before [5], it results warning:
BUG: Dentry 00000000eab1f070{i=9a917b66ae404fec,n=test} still in use (1)
[unmount of cifs cifs]
The existing per-inode ictx->io_count wait in cifs_evict_inode() does not
help: it lives in the inode eviction path, which runs after
shrink_dcache_for_umount() has already warned about the busy dentries.
Fix it by adding a per-superblock outstanding-rreq counter that is
incremented in cifs_init_request() and decremented in cifs_free_request().
In cifs_kill_sb(), before kill_anon_super(), wait for this counter to reach
0 - which guarantees that all cleanup_work for this sb have run and thus
all relevant cfile puts are queued on fileinfo_put_wq or serverclose_wq.
Then drain the workqueue so the dentry refs are dropped.
This is a targeted wait, not a flush of the system-wide system_dfl_wq.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0e4b8faaaebe3137bec5723ef2b3cb0437fb38fd Version: f655467a9973f964b267871e5fef533ad5014494 Version: 340cea84f691c5206561bb2e0147158fe02070be Version: 340cea84f691c5206561bb2e0147158fe02070be Version: 708c276f516d27beaded7f372ac8111cee43926c Version: 0629a1a187e424373364d681b42b101894bdb548 Version: 30afc6ea72cc6cf7c8d579e79b64232801c38d08 Version: 6.12.78 ≤ Version: 6.18.20 ≤ Version: 6.1.167 ≤ Version: 6.6.130 ≤ Version: 6.19.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifs_fs_sb.h",
"fs/smb/client/cifsfs.c",
"fs/smb/client/connect.c",
"fs/smb/client/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f7748b551010c021d92f0125e37f32ac0c376d8a",
"status": "affected",
"version": "0e4b8faaaebe3137bec5723ef2b3cb0437fb38fd",
"versionType": "git"
},
{
"lessThan": "9fc87899276af941ecf3045798887db7deb85605",
"status": "affected",
"version": "f655467a9973f964b267871e5fef533ad5014494",
"versionType": "git"
},
{
"lessThan": "f0eac9c3c3711f24efc2aaf12b8ec3e54a38c214",
"status": "affected",
"version": "340cea84f691c5206561bb2e0147158fe02070be",
"versionType": "git"
},
{
"lessThan": "75f5c412fa867efa0bf9b646bffe0d912109e84a",
"status": "affected",
"version": "340cea84f691c5206561bb2e0147158fe02070be",
"versionType": "git"
},
{
"status": "affected",
"version": "708c276f516d27beaded7f372ac8111cee43926c",
"versionType": "git"
},
{
"status": "affected",
"version": "0629a1a187e424373364d681b42b101894bdb548",
"versionType": "git"
},
{
"status": "affected",
"version": "30afc6ea72cc6cf7c8d579e79b64232801c38d08",
"versionType": "git"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThan": "6.18.54",
"status": "affected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifs_fs_sb.h",
"fs/smb/client/cifsfs.c",
"fs/smb/client/connect.c",
"fs/smb/client/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12.78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.18.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix busy dentry warning on unmount after DIO\n\nCommit c68337442f03 (\"cifs: Fix busy dentry used after unmounting\") fixed\nthe issue in cifs where deferred close of a file led to a dentry reference\ncount not being released in umount, by flushing deferredclose_wq in\ncifs_kill_sb() to solve it.\n\nHowever, the cifs DIO path suffers from the same busy-dentry problem caused\nby a delayed dentry reference-count release:\n\n\t[dio]\t\t\t[cifsd]\t\t\t[close + umount]\nnetfs_unbuffered_write_iter_locked\n...\n\t\t\t\tcifs_demultiplex_thread\n netfs_unbuffered_write\n cifs_issue_write\n netfs_wait_for_in_progress_stream [1]\n\t\t\t\t...\n\t\t\t\t netfs_write_subrequest_terminated\n\t\t\t\t netfs_subreq_clear_in_progress\n\t\t\t\t netfs_wake_collector // wake [1]\n\t\t\t\t netfs_put_subrequest\n netfs_put_request\n queue_work(system_dfl_wq, xxx) [2]\n // dio write return\t\t\t\t\tcifs_close\n\t\t\t\t\t\t\t _cifsFileInfo_put\n\t\t\t\t\t\t\t // cfile-\u003ecount 2-\u003e1\n\t\t\t\t\t\t\t --cfile-\u003ecount [3]\n\n\t\t\t\t\t\t\t// umount\n\t\t\t\t\t\t\tcifs_kill_sb\n\t\t\t\t\t\t\t kill_anon_super\n\t\t\t\t\t\t\t // warning triggered!\n\t\t\t\t\t\t\t shrink_dcache_for_umount [4]\n[system_dfl_wq] [5]\nnetfs_free_request\n ...\n _cifsFileInfo_put\n // cfile-\u003ecount 1-\u003e0\n --cfile-\u003ecount\n queue_work(fileinfo_put_wq, xxx)\n\n[fileinfo_put_wq] [6]\ncifsFileInfo_put_work\n cifsFileInfo_put_final\n dput\n\nIf the umount path is triggered before [5], it results warning:\nBUG: Dentry 00000000eab1f070{i=9a917b66ae404fec,n=test} still in use (1)\n[unmount of cifs cifs]\n\nThe existing per-inode ictx-\u003eio_count wait in cifs_evict_inode() does not\nhelp: it lives in the inode eviction path, which runs after\nshrink_dcache_for_umount() has already warned about the busy dentries.\n\nFix it by adding a per-superblock outstanding-rreq counter that is\nincremented in cifs_init_request() and decremented in cifs_free_request().\nIn cifs_kill_sb(), before kill_anon_super(), wait for this counter to reach\n0 - which guarantees that all cleanup_work for this sb have run and thus\nall relevant cfile puts are queued on fileinfo_put_wq or serverclose_wq.\nThen drain the workqueue so the dentry refs are dropped.\n\nThis is a targeted wait, not a flush of the system-wide system_dfl_wq."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached through local VFS syscalls (open with O_DIRECT, pwrite, close, umount) on the in-kernel CIFS/SMB3 client mount teardown path, not via remote SMB packet handling or ksmbd server code.\nAC:L - The attacker controls both sides of the race by issuing concurrent O_DIRECT writes and close/umount from separate threads, can flood system_dfl_wq to widen the cleanup delay window, and can retry until the post-pwrite/pre-cleanup_work window is hit.\nPR:L - Exploitation requires only a local user with write access to files on an already-mounted CIFS/SMB3 share; mount/umount can be performed by the same attacker with namespace capabilities or triggered by autofs lazy-unmount on shared enterprise home-directory mounts.\nUI:N - No victim interaction is required; the attacker directly drives the open/pwrite/close/umount syscall sequence in a tight loop without relying on another user to open files or perform any action.\nS:U - Impact is confined to kernel heap corruption and privilege escalation within the same host; this is not a VM escape, sandbox escape, or cross-security-authority boundary flaw.\nC:H - Delayed netfs cleanup causes cifsFileInfo_put_final() to dereference dentry, inode, and cifsInodeInfo structures after superblock teardown has begun, constituting a use-after-free that can be leveraged for arbitrary kernel memory read.\nI:H - Post-unmount cifsFileInfo_put_final() performs lock operations and list manipulation on freed kernel objects via fileinfo_put_wq, enabling heap metadata corruption and control-flow hijacking for arbitrary write or code execution.\nA:H - The race triggers WARN in shrink_dcache_for_umount during umount, and subsequent use-after-free in the deferred dentry put worker can cause kernel oops, panic, or hang."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T10:55:48.520Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f7748b551010c021d92f0125e37f32ac0c376d8a"
},
{
"url": "https://git.kernel.org/stable/c/9fc87899276af941ecf3045798887db7deb85605"
},
{
"url": "https://git.kernel.org/stable/c/f0eac9c3c3711f24efc2aaf12b8ec3e54a38c214"
},
{
"url": "https://git.kernel.org/stable/c/75f5c412fa867efa0bf9b646bffe0d912109e84a"
}
],
"title": "smb: client: fix busy dentry warning on unmount after DIO",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-72315",
"datePublished": "2026-08-15T05:55:29.761Z",
"dateReserved": "2026-08-09T03:40:39.919Z",
"dateUpdated": "2026-10-03T10:55:48.520Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89912 (GCVE-0-2026-89912)
Vulnerability from cvelistv5
Published
2026-09-16 10:32
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save
MAPC with V=0 drops ite->collection but leaves the ITE on the device's
ITT list, and vgic_its_save_ite() dereferences it unconditionally. A
guest that issues MAPD, MAPTI and then MAPC(V=0) therefore oopses the
host when the VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES to migrate it.
That sequence is UNPREDICTABLE per the architecture, but KVM already
handles the resulting state in the translate, MOVI and DISCARD paths.
Save a zeroed entry, which vgic_its_restore_ite() reads back as
invalid. Skipping the ITE instead would leave the ITT slot holding
whatever is in guest memory, and restore rejects an entry naming a
collection the restored collection table does not have.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89912",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:26:39.091827Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:36:59.904Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic-its.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dd0c3e6c03e3bb3fd7c0fa422230020674c5c25e",
"status": "affected",
"version": "eff484e0298da5a4d18ca82f5454c557fd942af5",
"versionType": "git"
},
{
"lessThan": "2c3a87ad3d3935c43d465cd2465db9020f9e898f",
"status": "affected",
"version": "eff484e0298da5a4d18ca82f5454c557fd942af5",
"versionType": "git"
},
{
"lessThan": "3d4c26b16a04a084fe0bde08ccdd8086570f8bbe",
"status": "affected",
"version": "eff484e0298da5a4d18ca82f5454c557fd942af5",
"versionType": "git"
},
{
"lessThan": "36df368861d2664291298feeb37dfef43fcae670",
"status": "affected",
"version": "eff484e0298da5a4d18ca82f5454c557fd942af5",
"versionType": "git"
},
{
"lessThan": "c6c156d931c33b92362383cf76f6d6e1291dcbfe",
"status": "affected",
"version": "eff484e0298da5a4d18ca82f5454c557fd942af5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic-its.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: vgic-its: Don\u0027t dereference a NULL collection on ITT save\n\nMAPC with V=0 drops ite-\u003ecollection but leaves the ITE on the device\u0027s\nITT list, and vgic_its_save_ite() dereferences it unconditionally. A\nguest that issues MAPD, MAPTI and then MAPC(V=0) therefore oopses the\nhost when the VMM issues KVM_DEV_ARM_ITS_SAVE_TABLES to migrate it.\nThat sequence is UNPREDICTABLE per the architecture, but KVM already\nhandles the resulting state in the translate, MOVI and DISCARD paths.\n\nSave a zeroed entry, which vgic_its_restore_ite() reads back as\ninvalid. Skipping the ITE instead would leave the ITT slot holding\nwhatever is in guest memory, and restore rejects an entry naming a\ncollection the restored collection table does not have."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The NULL dereference is reached only via the local KVM ioctl KVM_SET_DEVICE_ATTR(KVM_DEV_ARM_ITS_SAVE_TABLES) after the guest programs in-kernel GICv3 ITS MMIO (MAPD/MAPTI/MAPC or GITS_BASER); it is not triggered by network packets, adjacent-radio frames, or a physical device.\nAC:L - A guest can deterministically issue MAPD, MAPTI, then MAPC with V=0, or clear GITS_BASER collection Valid, leaving ITEs on the ITT with a NULL collection; SAVE_TABLES then always dereferences it with no race or attacker-uncontrollable host layout.\nPR:N - The highest-impact case is a cloud VM tenant who needs no host privileges: they program the ITS from guest EL1 and the host oopses when the hypervisor saves ITS tables during automated live migration, without host root, capabilities, or tenant access to /dev/kvm.\nUI:N - No extra victim action is required beyond normal hypervisor operations such as automated live migration or snapshot save that invoke SAVE_TABLES; a local VMM can also issue that ioctl itself.\nS:C - The fault runs in host KVM while saving guest-controlled ITS state, so a host oops/panic takes down the hypervisor and co-resident VMs, crossing the KVM guest-to-host security boundary.\nC:N - vgic_its_save_ite() only loads collection_id through a NULL ite-\u003ecollection pointer; this is a pure NULL dereference with no out-of-bounds read, use-after-free, or other host disclosure primitive.\nI:N - The NULL collection is read and not written, and the bug does not corrupt host kernel memory, provide an arbitrary write, or hijack host control flow beyond the faulting load.\nA:H - Dereferencing the NULL collection in vgic_its_save_ite() oopses or panics the host kernel during ITS table save, denying service to the hypervisor and every co-located VM."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:07.366Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dd0c3e6c03e3bb3fd7c0fa422230020674c5c25e"
},
{
"url": "https://git.kernel.org/stable/c/2c3a87ad3d3935c43d465cd2465db9020f9e898f"
},
{
"url": "https://git.kernel.org/stable/c/3d4c26b16a04a084fe0bde08ccdd8086570f8bbe"
},
{
"url": "https://git.kernel.org/stable/c/36df368861d2664291298feeb37dfef43fcae670"
},
{
"url": "https://git.kernel.org/stable/c/c6c156d931c33b92362383cf76f6d6e1291dcbfe"
}
],
"title": "KVM: arm64: vgic-its: Don\u0027t dereference a NULL collection on ITT save",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89912",
"datePublished": "2026-09-16T10:32:09.272Z",
"dateReserved": "2026-09-11T19:38:34.774Z",
"dateUpdated": "2026-10-21T12:49:07.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90030 (GCVE-0-2026-90030)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: clear forceRM when issuing EndTransfer
The forceRM bit of the DEPCMD register controls the behavior of the
EndTransfer command used to stop an active transfer. Older DWC3
programming guide revisions recommended setting forceRM=1 when
issuing EndTransfer. Newer programming guide revisions recommend
issuing EndTransfer with forceRM cleared.
With forceRM=1 on DWC_usb31 v2.00a and v2.10a controllers, a transfer
aborted through the ep_dequeue path was observed to remain active
after EndTransfer completion. A subsequent StartTransfer issued on the
same endpoint triggered writes associated with the aborted transfer.
This resulted in an SMMU fault because the transfer buffer had already
been unmapped during EndTransfer command-completion cleanup.
Using forceRM=0 eliminates the issue. Although older DWC3 programming
guide revisions recommended setting forceRM=1, no issues are known
from using forceRM=0. Clear forceRM when issuing EndTransfer to provide
consistent EndTransfer behavior and align with newer programming guide
recommendations.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ab99c4be945724b032cc55e05c6738fe1d84bf70 Version: 1e43c86d84fb0503e82a143e017f35421498fc1a Version: 1e43c86d84fb0503e82a143e017f35421498fc1a Version: 1e43c86d84fb0503e82a143e017f35421498fc1a Version: 1e43c86d84fb0503e82a143e017f35421498fc1a Version: 6.6.37 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/dwc3/ep0.c",
"drivers/usb/dwc3/gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7a50e138fa28e5ba76b11af66ed41cc300c0f2be",
"status": "affected",
"version": "ab99c4be945724b032cc55e05c6738fe1d84bf70",
"versionType": "git"
},
{
"lessThan": "9f1e57c484f9edeaaa5a27a03ed985e98496e81d",
"status": "affected",
"version": "1e43c86d84fb0503e82a143e017f35421498fc1a",
"versionType": "git"
},
{
"lessThan": "0afe5c31612de3d18cc6d16e616da4a48ba1e5a2",
"status": "affected",
"version": "1e43c86d84fb0503e82a143e017f35421498fc1a",
"versionType": "git"
},
{
"lessThan": "e01408ee52fe5cb2d0b43f47f359336af2b6c316",
"status": "affected",
"version": "1e43c86d84fb0503e82a143e017f35421498fc1a",
"versionType": "git"
},
{
"lessThan": "b58e6200450d350314db0ecda7d6d1bde3281e80",
"status": "affected",
"version": "1e43c86d84fb0503e82a143e017f35421498fc1a",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.37",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/dwc3/ep0.c",
"drivers/usb/dwc3/gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: clear forceRM when issuing EndTransfer\n\nThe forceRM bit of the DEPCMD register controls the behavior of the\nEndTransfer command used to stop an active transfer. Older DWC3\nprogramming guide revisions recommended setting forceRM=1 when\nissuing EndTransfer. Newer programming guide revisions recommend\nissuing EndTransfer with forceRM cleared.\n\nWith forceRM=1 on DWC_usb31 v2.00a and v2.10a controllers, a transfer\naborted through the ep_dequeue path was observed to remain active\nafter EndTransfer completion. A subsequent StartTransfer issued on the\nsame endpoint triggered writes associated with the aborted transfer.\nThis resulted in an SMMU fault because the transfer buffer had already\nbeen unmapped during EndTransfer command-completion cleanup.\n\nUsing forceRM=0 eliminates the issue. Although older DWC3 programming\nguide revisions recommended setting forceRM=1, no issues are known\nfrom using forceRM=0. Clear forceRM when issuing EndTransfer to provide\nconsistent EndTransfer behavior and align with newer programming guide\nrecommendations."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The documented trigger is dwc3_gadget_ep_dequeue(), reached from FunctionFS via usb_ep_dequeue() on ordinary local syscalls (interrupted read, aio_cancel, close, FUNCTIONFS_DMABUF_DETACH) rather than USB host packet parsing; this matches AV:L used for other f_fs/dwc3 EndXfer bugs (CVE-2024-36977, CVE-2024-36894).\nAC:L - On affected DWC_usb31 controllers the attacker deterministically queues a request, dequeues it so EndTransfer runs with forceRM=1, then queues again so StartTransfer replays DMA to the already-unmapped buffer; no uncontrolled race is involved, and v2.00a/v2.10a hardware is common on Qualcomm phones and embedded boards.\nPR:L - FunctionFS endpoint nodes are routinely delegated to unprivileged gadget daemons (adbd/shell, MTP) via uid=/gid=/fmode=; queue, cancel, and re-queue are ordinary file operations and the dequeue path performs no capability check.\nUI:N - The attacking process performs the queue, dequeue, and re-queue itself; a USB cable being attached is an ambient condition of phones, kiosks, and embedded gadgets, not a separate victim action the attacker must induce.\nS:U - Stale controller DMA targets the transfer buffer the gadget had already mapped in the same kernel; this is not a VM escape or IOMMU-domain bypass, and an SMMU, when present, faults the access rather than being circumvented.\nC:H - The same EndTransfer forceRM mishandling applies to IN endpoints, so after unmap the still-active transfer can DMA-read reused pages onto the USB bus; per kernel UAF guidance this memory-corruption primitive also yields kernel disclosure once backing pages are reallocated.\nI:H - The issue was reproduced as stale DMA writes on an OUT bulk endpoint into a buffer already unmapped during EndTransfer completion cleanup, so leftover or host-supplied data is written into reallocated kernel pages, a DMA use-after-free write primitive suitable for control-flow hijacking.\nA:H - The commit reports an SMMU fault when the controller accesses the already-unmapped transfer buffer, which panics or wedges the USB/IOMMU path; without an IOMMU the same DMA use-after-free likewise oopses or panics the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:31.009Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7a50e138fa28e5ba76b11af66ed41cc300c0f2be"
},
{
"url": "https://git.kernel.org/stable/c/9f1e57c484f9edeaaa5a27a03ed985e98496e81d"
},
{
"url": "https://git.kernel.org/stable/c/0afe5c31612de3d18cc6d16e616da4a48ba1e5a2"
},
{
"url": "https://git.kernel.org/stable/c/e01408ee52fe5cb2d0b43f47f359336af2b6c316"
},
{
"url": "https://git.kernel.org/stable/c/b58e6200450d350314db0ecda7d6d1bde3281e80"
}
],
"title": "usb: dwc3: clear forceRM when issuing EndTransfer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90030",
"datePublished": "2026-09-16T10:33:31.801Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-10-21T12:49:31.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98185 (GCVE-0-2026-98185)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: validate scan response extents
mwifiex_ret_802_11_scan() subtracts the fixed response fields and the
firmware-provided BSS length from resp->size without first proving that
either extent fits. A short response or oversized BSS length can
therefore underflow tlv_buf_size and make the TLV parser walk beyond the
command response.
Compute the fixed extent from the selected normal or background scan
response. Validate that the fixed fields and BSS data fit before deriving
the TLV extent and entering the parser.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e Version: 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "25217c5f6ce0bf3004f80c129464cd35fe9a420f",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "48312f0085aa1577d6d41af2a079b34de17c1a57",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "dccf5ecaad4d8d43c545921f20328e8f91af8698",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "c4943323fda22ef27bb6479b9d328ae48c63f64c",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "9cff2f39ed38a32070b08364c4c9346e85b8f9ec",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "7106ad8b74f50cca1ef36131f327d2c78f556daa",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
},
{
"lessThan": "3687d7d48070838cc2953431b3a27717cab0aaf6",
"status": "affected",
"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: validate scan response extents\n\nmwifiex_ret_802_11_scan() subtracts the fixed response fields and the\nfirmware-provided BSS length from resp-\u003esize without first proving that\neither extent fits. A short response or oversized BSS length can\ntherefore underflow tlv_buf_size and make the TLV parser walk beyond the\ncommand response.\n\nCompute the fixed extent from the selected normal or background scan\nresponse. Validate that the fixed fields and BSS data fit before deriving\nthe TLV extent and entering the parser."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:16.426Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/25217c5f6ce0bf3004f80c129464cd35fe9a420f"
},
{
"url": "https://git.kernel.org/stable/c/48312f0085aa1577d6d41af2a079b34de17c1a57"
},
{
"url": "https://git.kernel.org/stable/c/dccf5ecaad4d8d43c545921f20328e8f91af8698"
},
{
"url": "https://git.kernel.org/stable/c/c4943323fda22ef27bb6479b9d328ae48c63f64c"
},
{
"url": "https://git.kernel.org/stable/c/cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417"
},
{
"url": "https://git.kernel.org/stable/c/9cff2f39ed38a32070b08364c4c9346e85b8f9ec"
},
{
"url": "https://git.kernel.org/stable/c/7106ad8b74f50cca1ef36131f327d2c78f556daa"
},
{
"url": "https://git.kernel.org/stable/c/3687d7d48070838cc2953431b3a27717cab0aaf6"
}
],
"title": "wifi: mwifiex: validate scan response extents",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98185",
"datePublished": "2026-10-06T08:44:27.654Z",
"dateReserved": "2026-09-25T10:25:14.323Z",
"dateUpdated": "2026-10-19T09:15:16.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98245 (GCVE-0-2026-98245)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()
mark_block_group_to_copy() iterates over the commit root with
skip_locking=true. A concurrent transaction commit can swap and free
the commit root during iteration, causing use-after-free when
accessing extent buffers.
Fix it by using path->need_commit_sem to protect the commit root search.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/dev-replace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "93a025166495c63ba5b8ac721c7040d5312e8335",
"status": "affected",
"version": "78ce9fc269af6e69c1399ab910ba6bc81c934f67",
"versionType": "git"
},
{
"lessThan": "8e2007b263ea250251ec3021a0a197da990ee1a8",
"status": "affected",
"version": "78ce9fc269af6e69c1399ab910ba6bc81c934f67",
"versionType": "git"
},
{
"lessThan": "709f6a5e986535005110c6c69b322f63631cb200",
"status": "affected",
"version": "78ce9fc269af6e69c1399ab910ba6bc81c934f67",
"versionType": "git"
},
{
"lessThan": "c32490c6d3f3a9f2d177d57c7eb8bbc347561d08",
"status": "affected",
"version": "78ce9fc269af6e69c1399ab910ba6bc81c934f67",
"versionType": "git"
},
{
"lessThan": "0594e3423f4ba3137c734371169491f9a98e9af4",
"status": "affected",
"version": "78ce9fc269af6e69c1399ab910ba6bc81c934f67",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/dev-replace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: take commit root semaphore when iterating in mark_block_group_to_copy()\n\nmark_block_group_to_copy() iterates over the commit root with\nskip_locking=true. A concurrent transaction commit can swap and free\nthe commit root during iteration, causing use-after-free when\naccessing extent buffers.\n\nFix it by using path-\u003eneed_commit_sem to protect the commit root search."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:53.797Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/93a025166495c63ba5b8ac721c7040d5312e8335"
},
{
"url": "https://git.kernel.org/stable/c/8e2007b263ea250251ec3021a0a197da990ee1a8"
},
{
"url": "https://git.kernel.org/stable/c/709f6a5e986535005110c6c69b322f63631cb200"
},
{
"url": "https://git.kernel.org/stable/c/c32490c6d3f3a9f2d177d57c7eb8bbc347561d08"
},
{
"url": "https://git.kernel.org/stable/c/0594e3423f4ba3137c734371169491f9a98e9af4"
}
],
"title": "btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98245",
"datePublished": "2026-10-06T08:45:14.758Z",
"dateReserved": "2026-09-25T10:25:14.330Z",
"dateUpdated": "2026-10-21T12:54:53.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89452 (GCVE-0-2026-89452)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/msm: Unwind probe state on registration failure
msm_iommu_probe() adds its devm-managed IOMMU object to
qcom_iommu_devices before adding the IOMMU sysfs device and registering
it with the IOMMU core.
If iommu_device_sysfs_add() fails, probe returns with the object still on
qcom_iommu_devices. The driver core then releases the devm allocation,
leaving a dangling list entry that later list walks may dereference.
If iommu_device_register() fails, the same dangling list entry remains
and the sysfs device is left registered as well.
Unwind the sysfs device and global list entry in reverse setup order on
the corresponding failure paths.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/msm_iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6a1ae472113762f794682229a0f233f1ee0f69a4",
"status": "affected",
"version": "42df43b36163ed7d0ab13992e411093252903273",
"versionType": "git"
},
{
"lessThan": "51e37f9179387b6e3fa64a3d3b4fece1a38b3a02",
"status": "affected",
"version": "42df43b36163ed7d0ab13992e411093252903273",
"versionType": "git"
},
{
"lessThan": "f532401be9312ecd166f616bb74a65b0b4c150fa",
"status": "affected",
"version": "42df43b36163ed7d0ab13992e411093252903273",
"versionType": "git"
},
{
"lessThan": "7f7074a886c4a93e3d12076ce60a510a1ebe400c",
"status": "affected",
"version": "42df43b36163ed7d0ab13992e411093252903273",
"versionType": "git"
},
{
"lessThan": "535a200220ca2c83bc8bf54bd2cbe045d6ee70c4",
"status": "affected",
"version": "42df43b36163ed7d0ab13992e411093252903273",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/msm_iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/msm: Unwind probe state on registration failure\n\nmsm_iommu_probe() adds its devm-managed IOMMU object to\nqcom_iommu_devices before adding the IOMMU sysfs device and registering\nit with the IOMMU core.\n\nIf iommu_device_sysfs_add() fails, probe returns with the object still on\nqcom_iommu_devices. The driver core then releases the devm allocation,\nleaving a dangling list entry that later list walks may dereference.\n\nIf iommu_device_register() fails, the same dangling list entry remains\nand the sysfs device is left registered as well.\n\nUnwind the sysfs device and global list entry in reverse setup order on\nthe corresponding failure paths."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in msm_iommu_probe() for the Qualcomm APQ8064 platform IOMMU (compatible qcom,apq8064-iommu). It is reached only through the local platform driver core at boot or sysfs bind, not via network protocols, Bluetooth/WiFi, or a physical USB/serial endpoint.\nAC:L - After list_add, a failed iommu_device_sysfs_add() or iommu_device_register() deterministically leaves a freed msm_iommu_dev on qcom_iommu_devices. APQ8064 has four IOMMU instances, so a later probe, of_xlate, or attach walks that list and dereferences the object with no attacker-uncontrolled race. GFP_ATOMIC allocation in insert_iommu_master during register can induce the failure.\nPR:N - msm_iommu_probe() and later list walks in qcom_iommu_of_xlate(), find_iommu_for_dev(), and msm_iommu_attach_dev() run from the platform/IOMMU core with no capable() or credential check. On APQ8064 phones and embedded boards this happens automatically during boot or deferred probe without a user account.\nUI:N - Platform probe and subsequent IOMMU client attach/xlate run unattended during normal kernel device bring-up. No victim action such as mounting a filesystem, opening a file, or clicking a prompt is required.\nS:U - The use-after-free corrupts host kernel heap through the driver\u0027s private qcom_iommu_devices list, enabling in-kernel privilege escalation. It does not by itself escape a VM or bypass the IOMMU/DMA isolation boundary as a distinct security authority.\nC:H - The dangling msm_iommu_dev stays linked after devm frees it. Subsequent list walks dereference attacker-influencable freed heap (including embedded list pointers and device state), which per kernel UAF guidance enables arbitrary kernel memory disclosure.\nI:H - Use-after-free of the IOMMU instance structure (list nodes, MMIO base, context-bank maps) allows heap spraying and hijack of later attach/xlate control flow, providing an arbitrary kernel write and code-execution primitive.\nA:H - Any later walk of qcom_iommu_devices after the failed probe dereferences freed memory and can oops or panic the kernel. Kernel UAFs also crash even when not turned into a full exploit."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:30.756Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6a1ae472113762f794682229a0f233f1ee0f69a4"
},
{
"url": "https://git.kernel.org/stable/c/51e37f9179387b6e3fa64a3d3b4fece1a38b3a02"
},
{
"url": "https://git.kernel.org/stable/c/f532401be9312ecd166f616bb74a65b0b4c150fa"
},
{
"url": "https://git.kernel.org/stable/c/7f7074a886c4a93e3d12076ce60a510a1ebe400c"
},
{
"url": "https://git.kernel.org/stable/c/535a200220ca2c83bc8bf54bd2cbe045d6ee70c4"
}
],
"title": "iommu/msm: Unwind probe state on registration failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89452",
"datePublished": "2026-09-11T19:43:17.405Z",
"dateReserved": "2026-09-11T19:38:34.706Z",
"dateUpdated": "2026-10-21T12:47:30.756Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98201 (GCVE-0-2026-98201)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: zero ff_effect before compat copy in input_ff_effect_from_user
In the compat path input_ff_effect_from_user() aliases the caller's
native struct ff_effect with the smaller struct ff_effect_compat and
copies only the compat sized prefix:
compat_effect = (struct ff_effect_compat *)effect;
if (copy_from_user(compat_effect, buffer,
sizeof(struct ff_effect_compat)))
The tail of the native structure is never written. Callers pass an
uninitialized on-stack object, for example evdev_do_ioctl() for
EVIOCSFF, so those bytes keep their previous stack contents.
input_ff_upload() then stores the full native structure in
ff->effects[id], from where a uinput based force feedback daemon can
read it back via UI_BEGIN_FF_UPLOAD, disclosing kernel stack memory to
userspace.
Zero the effect before the compat copy.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2d56f3a32c0e62f99c043d2579840f9731fe5855 Version: 2d56f3a32c0e62f99c043d2579840f9731fe5855 Version: 2d56f3a32c0e62f99c043d2579840f9731fe5855 Version: 2d56f3a32c0e62f99c043d2579840f9731fe5855 Version: 2d56f3a32c0e62f99c043d2579840f9731fe5855 Version: 2d56f3a32c0e62f99c043d2579840f9731fe5855 Version: 2d56f3a32c0e62f99c043d2579840f9731fe5855 Version: 2d56f3a32c0e62f99c043d2579840f9731fe5855 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/input-compat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed0905fda39682d3da7937184397d3276abbffa8",
"status": "affected",
"version": "2d56f3a32c0e62f99c043d2579840f9731fe5855",
"versionType": "git"
},
{
"lessThan": "ec174c2ab1abb76b20fa167c6db848c3d97aa838",
"status": "affected",
"version": "2d56f3a32c0e62f99c043d2579840f9731fe5855",
"versionType": "git"
},
{
"lessThan": "6c26681c5668c973bd0e951407d670ac60d9cd66",
"status": "affected",
"version": "2d56f3a32c0e62f99c043d2579840f9731fe5855",
"versionType": "git"
},
{
"lessThan": "c5e573bb095d502be7cbbaa99c26a20984111c6d",
"status": "affected",
"version": "2d56f3a32c0e62f99c043d2579840f9731fe5855",
"versionType": "git"
},
{
"lessThan": "b878720e8bcaa4cf7163a5081f904dd6baf11b2c",
"status": "affected",
"version": "2d56f3a32c0e62f99c043d2579840f9731fe5855",
"versionType": "git"
},
{
"lessThan": "0d05b43b55d4784a42ce8fb318175f8ad7d9af5a",
"status": "affected",
"version": "2d56f3a32c0e62f99c043d2579840f9731fe5855",
"versionType": "git"
},
{
"lessThan": "ed0406e490f48ed180df140fe2a81be26bccb1a9",
"status": "affected",
"version": "2d56f3a32c0e62f99c043d2579840f9731fe5855",
"versionType": "git"
},
{
"lessThan": "f84819ef8d66931ee3998fee3c4f03230f4cb6cc",
"status": "affected",
"version": "2d56f3a32c0e62f99c043d2579840f9731fe5855",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/input-compat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: zero ff_effect before compat copy in input_ff_effect_from_user\n\nIn the compat path input_ff_effect_from_user() aliases the caller\u0027s\nnative struct ff_effect with the smaller struct ff_effect_compat and\ncopies only the compat sized prefix:\n\n\tcompat_effect = (struct ff_effect_compat *)effect;\n\n\tif (copy_from_user(compat_effect, buffer,\n\t\t\t sizeof(struct ff_effect_compat)))\n\nThe tail of the native structure is never written. Callers pass an\nuninitialized on-stack object, for example evdev_do_ioctl() for\nEVIOCSFF, so those bytes keep their previous stack contents.\ninput_ff_upload() then stores the full native structure in\nff-\u003eeffects[id], from where a uinput based force feedback daemon can\nread it back via UI_BEGIN_FF_UPLOAD, disclosing kernel stack memory to\nuserspace.\n\nZero the effect before the compat copy."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:32.269Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed0905fda39682d3da7937184397d3276abbffa8"
},
{
"url": "https://git.kernel.org/stable/c/ec174c2ab1abb76b20fa167c6db848c3d97aa838"
},
{
"url": "https://git.kernel.org/stable/c/6c26681c5668c973bd0e951407d670ac60d9cd66"
},
{
"url": "https://git.kernel.org/stable/c/c5e573bb095d502be7cbbaa99c26a20984111c6d"
},
{
"url": "https://git.kernel.org/stable/c/b878720e8bcaa4cf7163a5081f904dd6baf11b2c"
},
{
"url": "https://git.kernel.org/stable/c/0d05b43b55d4784a42ce8fb318175f8ad7d9af5a"
},
{
"url": "https://git.kernel.org/stable/c/ed0406e490f48ed180df140fe2a81be26bccb1a9"
},
{
"url": "https://git.kernel.org/stable/c/f84819ef8d66931ee3998fee3c4f03230f4cb6cc"
}
],
"title": "Input: zero ff_effect before compat copy in input_ff_effect_from_user",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98201",
"datePublished": "2026-10-06T08:44:38.952Z",
"dateReserved": "2026-09-25T10:25:14.324Z",
"dateUpdated": "2026-10-19T09:15:32.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98212 (GCVE-0-2026-98212)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mmc: hsq: Fix use-after-free in retry work
mmc_hsq_pump_requests() queues retry_work when request_atomic() returns
-EBUSY; today sdhci-sprd is the only consumer that implements
request_atomic(). The work is embedded in a devm-allocated mmc_hsq, but
is never cancelled during driver removal. Work still pending at unbind
can therefore run after the devm allocation has been released and
dereference hsq->mmc and hsq->mrq.
Use devm_work_autocancel() to cancel and drain retry_work before the devm
allocation is released. By the time devres cleanup begins,
mmc_remove_host() has already stopped the host, so no new requests can
arm the work.
This issue was found by an in-house static analysis tool.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/mmc_hsq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c50d6515bffb148c2c12be6d587ec201dfab4c34",
"status": "affected",
"version": "6db96e5810e0a6a345b7d78549de7676ae5b2662",
"versionType": "git"
},
{
"lessThan": "df2eb59fd9eb33663dc1053f5a4ed851e0aa1f67",
"status": "affected",
"version": "6db96e5810e0a6a345b7d78549de7676ae5b2662",
"versionType": "git"
},
{
"lessThan": "8439bf262ce3267bcfee29d3c61605f1731a2271",
"status": "affected",
"version": "6db96e5810e0a6a345b7d78549de7676ae5b2662",
"versionType": "git"
},
{
"lessThan": "45341b341642c377192c95e4d48e0a859cf85f42",
"status": "affected",
"version": "6db96e5810e0a6a345b7d78549de7676ae5b2662",
"versionType": "git"
},
{
"lessThan": "5d132990475f02cfa1debe03d50b479432864ebd",
"status": "affected",
"version": "6db96e5810e0a6a345b7d78549de7676ae5b2662",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/mmc_hsq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: hsq: Fix use-after-free in retry work\n\nmmc_hsq_pump_requests() queues retry_work when request_atomic() returns\n-EBUSY; today sdhci-sprd is the only consumer that implements\nrequest_atomic(). The work is embedded in a devm-allocated mmc_hsq, but\nis never cancelled during driver removal. Work still pending at unbind\ncan therefore run after the devm allocation has been released and\ndereference hsq-\u003emmc and hsq-\u003emrq.\n\nUse devm_work_autocancel() to cancel and drain retry_work before the devm\nallocation is released. By the time devres cleanup begins,\nmmc_remove_host() has already stopped the host, so no new requests can\narm the work.\n\nThis issue was found by an in-house static analysis tool."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:43.105Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c50d6515bffb148c2c12be6d587ec201dfab4c34"
},
{
"url": "https://git.kernel.org/stable/c/df2eb59fd9eb33663dc1053f5a4ed851e0aa1f67"
},
{
"url": "https://git.kernel.org/stable/c/8439bf262ce3267bcfee29d3c61605f1731a2271"
},
{
"url": "https://git.kernel.org/stable/c/45341b341642c377192c95e4d48e0a859cf85f42"
},
{
"url": "https://git.kernel.org/stable/c/5d132990475f02cfa1debe03d50b479432864ebd"
}
],
"title": "mmc: hsq: Fix use-after-free in retry work",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98212",
"datePublished": "2026-10-06T08:44:48.498Z",
"dateReserved": "2026-09-25T10:25:14.325Z",
"dateUpdated": "2026-10-19T09:15:43.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97536 (GCVE-0-2026-97536)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
The response queue MSI-X handler qla2xxx_msix_rsp_q() schedules
qla_do_work() via queue_work(ha->wq, &qpair->q_work). qla_do_work()
dereferences the qpair (vha, rsp) and takes qpair->qp_lock.
During teardown, qla2xxx_delete_qpair() deletes the response queue, which
calls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and
the qpair. free_irq() waits for running hardirq handlers but does not
cancel work already placed on ha->wq. A still-pending q_work then runs
qla_do_work() against the freed qpair and response queue, causing a
use-after-free. This is especially likely during full adapter teardown,
where destroy_workqueue(ha->wq) forces pending work to run after the queue
pairs have been freed.
Flush the work item with cancel_work_sync() in qla25xx_free_rsp_que()
after free_irq() has released the interrupt (so no new work can be
queued) and before the response queue and qpair memory are freed (so the
flushed handler still sees valid memory). Guard on rsp->qpair and ha->wq
to match the INIT_WORK() condition and avoid operating on an
uninitialized work_struct.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_mid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9bd063c082ef0475dfc28c46f607aa3e90fe13d7",
"status": "affected",
"version": "68ca949cdb04b4dc71451a999148fbc5f187a220",
"versionType": "git"
},
{
"lessThan": "dd6c14db0dbb7774278e62c8114902f953540932",
"status": "affected",
"version": "68ca949cdb04b4dc71451a999148fbc5f187a220",
"versionType": "git"
},
{
"lessThan": "1710a69fd74d0b4bdfcc57c3309b1c4057f70d85",
"status": "affected",
"version": "68ca949cdb04b4dc71451a999148fbc5f187a220",
"versionType": "git"
},
{
"lessThan": "f1f4d1cb93eeeb250eac9405121933e268eefbd3",
"status": "affected",
"version": "68ca949cdb04b4dc71451a999148fbc5f187a220",
"versionType": "git"
},
{
"lessThan": "19788a55cab61d78e33e0914a5a31d27843e8a4a",
"status": "affected",
"version": "68ca949cdb04b4dc71451a999148fbc5f187a220",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_mid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix use-after-free of qpair work on queue teardown\n\nThe response queue MSI-X handler qla2xxx_msix_rsp_q() schedules\nqla_do_work() via queue_work(ha-\u003ewq, \u0026qpair-\u003eq_work). qla_do_work()\ndereferences the qpair (vha, rsp) and takes qpair-\u003eqp_lock.\n\nDuring teardown, qla2xxx_delete_qpair() deletes the response queue, which\ncalls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and\nthe qpair. free_irq() waits for running hardirq handlers but does not\ncancel work already placed on ha-\u003ewq. A still-pending q_work then runs\nqla_do_work() against the freed qpair and response queue, causing a\nuse-after-free. This is especially likely during full adapter teardown,\nwhere destroy_workqueue(ha-\u003ewq) forces pending work to run after the queue\npairs have been freed.\n\nFlush the work item with cancel_work_sync() in qla25xx_free_rsp_que()\nafter free_irq() has released the interrupt (so no new work can be\nqueued) and before the response queue and qpair memory are freed (so the\nflushed handler still sees valid memory). Guard on rsp-\u003eqpair and ha-\u003ewq\nto match the INIT_WORK() condition and avoid operating on an\nuninitialized work_struct."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - qla2xxx_msix_rsp_q() queue_work()s \u0026qpair-\u003eq_work when firmware posts FC/FCoE response-queue IOCBs (STATUS_TYPE/FCP_RSP, LOGINOUT, CT/ELS); qla25xx_free_rsp_que() is reached from qla2xxx_delete_qpair() via qla25xx_delete_rsp_que(). IS_CNA_CAPABLE QLogic CNAs speak FCoE on the SAN fabric, an L2/adjacent transport not a routable IP service.\nAC:H - The UAF fires only when qla25xx_free_rsp_que() free_irq()s then kfree()s rsp and qla2xxx_delete_qpair() kfree()s the qpair while q_work is still queued. Those run from qla24xx_vport_delete() (fc_vport sysfs S_IWUSR) or qla2x00_free_device() after scsi_remove_host, a victim qpair/adapter teardown a fabric peer cannot initiate.\nPR:N - qla2xxx_msix_rsp_q() handles unauthenticated Fibre Channel/FCoE firmware completions in IRQ context with no capable() or Linux credential check, so a SAN N_Port needs no account on the victim. The teardown path is victim-side and does not grant the fabric attacker host privileges.\nUI:N - qla2xxx_msix_rsp_q() schedules q_work automatically on response-queue interrupts. Concurrent qpair teardown in qla24xx_vport_delete() or qla2x00_remove_one()-\u003eqla2x00_free_device() is driver/NPIV/PCI lifecycle, not a victim mount or open of attacker-supplied media.\nS:U - kfree of struct qla_qpair and struct rsp_que and the later qla_do_work() use-after-free stay inside the host kernel qla2xxx driver and do not cross a VM, IOMMU, or other separate security-authority boundary.\nC:H - After kfree(qpair) and kfree(rsp), qla_do_work() container_of()s the freed qpair, loads qpair-\u003evha and qpair-\u003ersp, then qla24xx_process_response_queue() reads the dangling rsp ring/IOCBs. That kernel heap use-after-free enables disclosure of reused object contents.\nI:H - qla_do_work() takes spin_lock_irqsave(\u0026qpair-\u003eqp_lock) on the freed qpair and qla24xx_process_response_queue() writes rsp-\u003ering_index and completion state through dangling rsp/req pointers, yielding a kernel write and control-flow hijack primitive.\nA:H - Use-after-free of qpair from qla_do_work() produces a kernel oops or panic even when not fully exploited. qla2x00_free_device() calls destroy_workqueue(ha-\u003ewq) after qla25xx_delete_queues() has already kfree\u0027d the qpairs, forcing pending q_work to run against freed memory."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:11.632Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9bd063c082ef0475dfc28c46f607aa3e90fe13d7"
},
{
"url": "https://git.kernel.org/stable/c/dd6c14db0dbb7774278e62c8114902f953540932"
},
{
"url": "https://git.kernel.org/stable/c/1710a69fd74d0b4bdfcc57c3309b1c4057f70d85"
},
{
"url": "https://git.kernel.org/stable/c/f1f4d1cb93eeeb250eac9405121933e268eefbd3"
},
{
"url": "https://git.kernel.org/stable/c/19788a55cab61d78e33e0914a5a31d27843e8a4a"
}
],
"title": "scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97536",
"datePublished": "2026-09-25T10:21:34.991Z",
"dateReserved": "2026-09-24T16:01:01.153Z",
"dateUpdated": "2026-10-21T12:53:11.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99999 (GCVE-0-2026-99999)
Vulnerability from cvelistv5
Published
2026-10-15 12:19
Modified
2026-10-24 14:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: validate checksum_start before completing checksum
If a packet with bad checksum metadata gets into the ipv4 stack,
skb_checksum_help can corrupt the network header and cause a bunch of
mischief.
This was discovered and reported by Paulos, and has been reporoduced
by others independently since.
We really shouldn't allow such packets in, but as a defence
in depth measure, let's also check before we complete the checksum.
A more complete validation at input is forthcoming, but needs more work.
References
| URL | Tags | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-15T22:07:24.590Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/15/5"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-99999",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:49:03.519458Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:19:28.844Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/ip.h",
"net/bridge/netfilter/nf_conntrack_bridge.c",
"net/ipv4/ip_output.c",
"net/netfilter/nfnetlink_queue.c",
"net/netfilter/xt_CHECKSUM.c",
"net/xfrm/xfrm_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a464d950f31c89565cbaae038cc60db04fe01956",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "0fab003ef4698e0628060a45a48f14b43ba2a40a",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "94524b7b32691de2e2ce162c04d6cbc9106e5cbf",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "a65f69e0f38ffbed1b128029e09097436416dc8b",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "32a8b0adaa18e52aaa0b246b5ffe683075354dbb",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "f3e835af6226f1dd12160cbd696081e9b6155de0",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "c3e33464746166264334641dc850a36eef7e6326",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "6785011f8b16abf40b1e9d8b2e332232b3e68822",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/ip.h",
"net/bridge/netfilter/nf_conntrack_bridge.c",
"net/ipv4/ip_output.c",
"net/netfilter/nfnetlink_queue.c",
"net/netfilter/xt_CHECKSUM.c",
"net/xfrm/xfrm_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.272",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.223",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.190",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.159",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.272",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.223",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.190",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.159",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn\u0027t allow such packets in, but as a defence\nin depth measure, let\u0027s also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A malicious microVM supplies crafted virtio-net checksum metadata with its outbound frame. The VMM writes it to the host TAP, where tun_get_user() feeds the skb to the IPv4 stack and ip_do_fragment() calls skb_checksum_help(); this is a guest/local virtual-device path, not an Internet receive path.\nAC:L - The guest controls the frame, checksum start and offset, and packet size and can repeat the same fragmentation sequence. No race, timing window, or uncontrollable memory layout is needed; host leak, crash, and code-execution variants were reproduced with crafted packets.\nPR:N - In the microVM scenario, a tenant workload able to transmit through its assigned virtio-net interface can supply the triggering traffic. It needs no host credentials, capability, or access to /dev/net/tun; the privileged VMM merely forwards guest output to its existing TAP fd.\nUI:N - The attacker sends the crafted guest packets directly, and host TAP/IPv4 processing invokes checksum completion automatically. No host administrator or other victim must act.\nS:C - The checksum metadata originates in an untrusted microVM, but skb_checksum_help() and ip_do_fragment() process and corrupt state in the host kernel. The demonstrated leak, crash, and administrator code execution cross the guest-to-host isolation boundary.\nC:H - After skb_checksum_help() changes an already-validated IPv4 IHL, ip_do_fragment() trusts the new length and ip_frag_next() copies beyond the skb\u0027s logical linear head into transmitted IPv4 options. This was demonstrated as continuous host-memory disclosure in guest-emitted packets.\nI:H - skb_checksum_help() writes at the attacker-controlled checksum position inside an IPv4 header after routing and validation, and downstream code trusts the modified fields. Crafted guest packets using this flaw were demonstrated to execute commands with full administrator privileges on the host.\nA:H - Malformed checksum offsets reach skb_checksum_help() from IPv4 fragmentation and can trip WARN_ONCE/panic paths or poison the header geometry used downstream. Crafted guest packets were demonstrated to crash the physical host, taking down all sandboxes on it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:17:15.740Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956"
},
{
"url": "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a"
},
{
"url": "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf"
},
{
"url": "https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b"
},
{
"url": "https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb"
},
{
"url": "https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0"
},
{
"url": "https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326"
},
{
"url": "https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822"
},
{
"url": "https://pwn.ai/blog/pwnescape"
},
{
"url": "https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge"
}
],
"title": "ipv4: validate checksum_start before completing checksum",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99999",
"datePublished": "2026-10-15T12:19:22.784Z",
"dateReserved": "2026-09-25T10:25:14.451Z",
"dateUpdated": "2026-10-24T14:17:15.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97906 (GCVE-0-2026-97906)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bootconfig: Fix integer overflow in initrd size check
Sashiko reported that in get_boot_config_from_initrd(), a crafted initrd
with a huge bootconfig size (such as 0xFFFFFFFF) can cause the pointer
arithmetic:
data = ((void *)hdr) - size;
to wrap around on 32-bit systems (or when pointer subtraction overflows).
Because data wraps around, the subsequent bounds check:
if ((unsigned long)data < initrd_start)
evaluates to false, bypassing the check. The kernel then calls
xbc_calc_checksum(data, size), which attempts to read 4GB of memory,
hitting unmapped pages and triggering a fatal kernel page fault during
early boot. Furthermore, on 64-bit systems with an initrd > 4.29 GB, an
unbounded 32-bit size can similarly bypass the initrd_start check.
Fix this by:
1. Ensuring the initrd is at least large enough to contain the bootconfig
footer and verifying hdr is within the initrd bounds.
2. Checking that size does not exceed XBC_DATA_MAX and does not exceed
the available space between initrd_start and hdr before performing
pointer subtraction.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: de462e5f10718517bacf2f84c8aa2804567ef7df Version: de462e5f10718517bacf2f84c8aa2804567ef7df Version: de462e5f10718517bacf2f84c8aa2804567ef7df Version: de462e5f10718517bacf2f84c8aa2804567ef7df Version: de462e5f10718517bacf2f84c8aa2804567ef7df Version: 32394df25d8e46935b442b429d74b37885c4f092 Version: 5.6.14 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"init/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "97be05f33f79342ea65d9b99c9ad07a93b8eef5a",
"status": "affected",
"version": "de462e5f10718517bacf2f84c8aa2804567ef7df",
"versionType": "git"
},
{
"lessThan": "4d45bc0f8cdf606d5409b5f64a8a6609f6520c03",
"status": "affected",
"version": "de462e5f10718517bacf2f84c8aa2804567ef7df",
"versionType": "git"
},
{
"lessThan": "8d4343a411eaa182d323ab5b149496416015f27d",
"status": "affected",
"version": "de462e5f10718517bacf2f84c8aa2804567ef7df",
"versionType": "git"
},
{
"lessThan": "bff9a1579e2c9b2a59fdf3793becc9d7bf5ff1a6",
"status": "affected",
"version": "de462e5f10718517bacf2f84c8aa2804567ef7df",
"versionType": "git"
},
{
"lessThan": "7812d6dab0698001e50e8c2f901e17da3eb6f429",
"status": "affected",
"version": "de462e5f10718517bacf2f84c8aa2804567ef7df",
"versionType": "git"
},
{
"status": "affected",
"version": "32394df25d8e46935b442b429d74b37885c4f092",
"versionType": "git"
},
{
"lessThan": "5.7",
"status": "affected",
"version": "5.6.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"init/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbootconfig: Fix integer overflow in initrd size check\n\nSashiko reported that in get_boot_config_from_initrd(), a crafted initrd\nwith a huge bootconfig size (such as 0xFFFFFFFF) can cause the pointer\narithmetic:\n\n data = ((void *)hdr) - size;\n\nto wrap around on 32-bit systems (or when pointer subtraction overflows).\nBecause data wraps around, the subsequent bounds check:\n\n if ((unsigned long)data \u003c initrd_start)\n\nevaluates to false, bypassing the check. The kernel then calls\nxbc_calc_checksum(data, size), which attempts to read 4GB of memory,\nhitting unmapped pages and triggering a fatal kernel page fault during\nearly boot. Furthermore, on 64-bit systems with an initrd \u003e 4.29 GB, an\nunbounded 32-bit size can similarly bypass the initrd_start check.\n\nFix this by:\n1. Ensuring the initrd is at least large enough to contain the bootconfig\n footer and verifying hdr is within the initrd bounds.\n2. Checking that size does not exceed XBC_DATA_MAX and does not exceed\n the available space between initrd_start and hdr before performing\n pointer subtraction."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:32.335Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/97be05f33f79342ea65d9b99c9ad07a93b8eef5a"
},
{
"url": "https://git.kernel.org/stable/c/4d45bc0f8cdf606d5409b5f64a8a6609f6520c03"
},
{
"url": "https://git.kernel.org/stable/c/8d4343a411eaa182d323ab5b149496416015f27d"
},
{
"url": "https://git.kernel.org/stable/c/bff9a1579e2c9b2a59fdf3793becc9d7bf5ff1a6"
},
{
"url": "https://git.kernel.org/stable/c/7812d6dab0698001e50e8c2f901e17da3eb6f429"
}
],
"title": "bootconfig: Fix integer overflow in initrd size check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97906",
"datePublished": "2026-09-25T10:22:31.640Z",
"dateReserved": "2026-09-25T10:18:58.200Z",
"dateUpdated": "2026-10-21T12:53:32.335Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98198 (GCVE-0-2026-98198)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pwm-fan) Stop RPM timer before freeing tach data
sample_timer() rearms the RPM timer and accesses the devm-managed
ctx->tachs and ctx->pulses_per_revolution arrays. The cleanup action
which stops the timer is registered before those arrays are allocated.
Since devres releases entries in reverse order, driver detach can free
the arrays before pwm_fan_cleanup() shuts down the timer. A timer expiry
in that window accesses the freed tach data.
With a KASAN kernel, a test-only kprobe delayed entry to
pwm_fan_cleanup() while normal sysfs unbind ran. Each of three runs
reported three four-byte reads and two four-byte writes in sample_timer()
after its backing devm allocations had been freed. The helper did not
invoke the timer callback, cleanup actions or free functions.
With the fix, three matching unbind runs completed without KASAN, BUG,
WARNING, Oops or panic. Instrumentation confirmed that timer retirement
completed before the first timer backing allocation was released.
Split timer retirement from the power cleanup and register its devres
action after the timer backing data and IRQ actions are installed. This
preserves the early power rollback action while ensuring the timer is
retired before its backing data is released. Use timer_shutdown_sync()
because the callback can rearm itself.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pwm-fan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d073d306e587c1f35aaf9c07c42e54a3d5895d8f",
"status": "affected",
"version": "01695410d4529e38fea6159fa9f1260c598290b0",
"versionType": "git"
},
{
"lessThan": "1e824fdb14a187ce56697e803b02b1e86243a755",
"status": "affected",
"version": "01695410d4529e38fea6159fa9f1260c598290b0",
"versionType": "git"
},
{
"lessThan": "a5ce3fe5335a24d0220958c6866830a6d5fa1cc0",
"status": "affected",
"version": "01695410d4529e38fea6159fa9f1260c598290b0",
"versionType": "git"
},
{
"lessThan": "b48339b0a577783e4590a69e4cd2f2760ce33154",
"status": "affected",
"version": "01695410d4529e38fea6159fa9f1260c598290b0",
"versionType": "git"
},
{
"lessThan": "26d5ff79768548efb1e604bb6e8697c101e06269",
"status": "affected",
"version": "01695410d4529e38fea6159fa9f1260c598290b0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pwm-fan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pwm-fan) Stop RPM timer before freeing tach data\n\nsample_timer() rearms the RPM timer and accesses the devm-managed\nctx-\u003etachs and ctx-\u003epulses_per_revolution arrays. The cleanup action\nwhich stops the timer is registered before those arrays are allocated.\n\nSince devres releases entries in reverse order, driver detach can free\nthe arrays before pwm_fan_cleanup() shuts down the timer. A timer expiry\nin that window accesses the freed tach data.\n\nWith a KASAN kernel, a test-only kprobe delayed entry to\npwm_fan_cleanup() while normal sysfs unbind ran. Each of three runs\nreported three four-byte reads and two four-byte writes in sample_timer()\nafter its backing devm allocations had been freed. The helper did not\ninvoke the timer callback, cleanup actions or free functions.\n\nWith the fix, three matching unbind runs completed without KASAN, BUG,\nWARNING, Oops or panic. Instrumentation confirmed that timer retirement\ncompleted before the first timer backing allocation was released.\n\nSplit timer retirement from the power cleanup and register its devres\naction after the timer backing data and IRQ actions are installed. This\npreserves the early power rollback action while ensuring the timer is\nretired before its backing data is released. Use timer_shutdown_sync()\nbecause the callback can rearm itself."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:52.698Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d073d306e587c1f35aaf9c07c42e54a3d5895d8f"
},
{
"url": "https://git.kernel.org/stable/c/1e824fdb14a187ce56697e803b02b1e86243a755"
},
{
"url": "https://git.kernel.org/stable/c/a5ce3fe5335a24d0220958c6866830a6d5fa1cc0"
},
{
"url": "https://git.kernel.org/stable/c/b48339b0a577783e4590a69e4cd2f2760ce33154"
},
{
"url": "https://git.kernel.org/stable/c/26d5ff79768548efb1e604bb6e8697c101e06269"
}
],
"title": "hwmon: (pwm-fan) Stop RPM timer before freeing tach data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98198",
"datePublished": "2026-10-06T08:44:36.944Z",
"dateReserved": "2026-09-25T10:25:14.324Z",
"dateUpdated": "2026-10-21T12:54:52.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98343 (GCVE-0-2026-98343)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
When dma_device_put() drops the last reference on chan->device->ref,
dma_device_release() runs and may free the dma_device along with its
channels.
dma_chan_put() then still reads chan->device->owner via
dma_chan_to_owner() for the trailing module_put(). KASAN catches it:
slab-use-after-free in dma_chan_put+0x3e6/0x4c0
Read of size 8 by task insmod/6319
Freed by task 6319:
kfree+0x225/0x470
dma_chan_put+0x395/0x4c0
dmaengine_put+0xf8/0x160
Cache the module owner in dma_chan_put() before the put so the trailing
module_put() does not need chan->device.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 Version: 8ad342a863590b24ce77681b7e081363fb3333f7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/dmaengine.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b92c502595336a3cc5bb7a060170891366745a5d",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "855187a88bdf762c46b6849307597e3e02bfc1d9",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "c9780b601438137494b407eb4301bb3de2587ac9",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "07eb075b60d565a5e465a1945a80cc62807492ad",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "9319dd64d5cdef851841c091f30424faa2284c31",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "6cf31716b77a71c0d634106f4f3951377b8dc6dc",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "02bd02c585293634b213b142cba63cbf77891f6b",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
},
{
"lessThan": "e873c74132f0c5f1452816cd9bb26208f0bba1e1",
"status": "affected",
"version": "8ad342a863590b24ce77681b7e081363fb3333f7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/dmaengine.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()\n\nWhen dma_device_put() drops the last reference on chan-\u003edevice-\u003eref,\ndma_device_release() runs and may free the dma_device along with its\nchannels.\n\ndma_chan_put() then still reads chan-\u003edevice-\u003eowner via\ndma_chan_to_owner() for the trailing module_put(). KASAN catches it:\n\n\tslab-use-after-free in dma_chan_put+0x3e6/0x4c0\n\tRead of size 8 by task insmod/6319\n\tFreed by task 6319:\n\t kfree+0x225/0x470\n\t dma_chan_put+0x395/0x4c0\n\t dmaengine_put+0xf8/0x160\n\nCache the module owner in dma_chan_put() before the put so the trailing\nmodule_put() does not need chan-\u003edevice."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:54.287Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b92c502595336a3cc5bb7a060170891366745a5d"
},
{
"url": "https://git.kernel.org/stable/c/855187a88bdf762c46b6849307597e3e02bfc1d9"
},
{
"url": "https://git.kernel.org/stable/c/c9780b601438137494b407eb4301bb3de2587ac9"
},
{
"url": "https://git.kernel.org/stable/c/07eb075b60d565a5e465a1945a80cc62807492ad"
},
{
"url": "https://git.kernel.org/stable/c/9319dd64d5cdef851841c091f30424faa2284c31"
},
{
"url": "https://git.kernel.org/stable/c/6cf31716b77a71c0d634106f4f3951377b8dc6dc"
},
{
"url": "https://git.kernel.org/stable/c/02bd02c585293634b213b142cba63cbf77891f6b"
},
{
"url": "https://git.kernel.org/stable/c/e873c74132f0c5f1452816cd9bb26208f0bba1e1"
}
],
"title": "dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98343",
"datePublished": "2026-10-06T08:46:33.196Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-19T09:17:54.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98365 (GCVE-0-2026-98365)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
mr_check_range() validates that [iova, iova+length) falls within the
registered MR range using wraparound-prone arithmetic:
if (iova < mr->ibmr.iova ||
iova + length > mr->ibmr.iova + mr->ibmr.length)
A remote peer can craft an RDMA-Write/Read RETH so that iova + length
wraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the
check. rxe_mr_iova_to_index() then computes a huge index (int idx, only
guarded by WARN_ON) and rxe_mr_copy_xarray() dereferences
mr->page_info[huge], causing an out-of-bounds read/write and a kernel
oops that is triggerable by an unauthenticated remote peer.
Rewrite the check in overflow-safe form; the first two clauses guarantee
that the subsequent subtractions do not underflow:
if (iova < mr->ibmr.iova ||
length > mr->ibmr.length ||
iova - mr->ibmr.iova > mr->ibmr.length - length)
With the fix, mr_check_range() returns -EINVAL for the crafted iova and
the responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7d2118660545a00b21e83010ded1a231c6fb8c5",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "5d9426a74fc8cb8f375fcdc19b465a030f9b8cab",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "2f3b705144e3a3c14184fec6e354680081fe91ec",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "3431f525718f6b07da308cda6d44f8cb548bbd37",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
},
{
"lessThan": "d10e2a08799e858d3e71ea4169bcd018f216d444",
"status": "affected",
"version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_mr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access\n\nmr_check_range() validates that [iova, iova+length) falls within the\nregistered MR range using wraparound-prone arithmetic:\n\n if (iova \u003c mr-\u003eibmr.iova ||\n iova + length \u003e mr-\u003eibmr.iova + mr-\u003eibmr.length)\n\nA remote peer can craft an RDMA-Write/Read RETH so that iova + length\nwraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the\ncheck. rxe_mr_iova_to_index() then computes a huge index (int idx, only\nguarded by WARN_ON) and rxe_mr_copy_xarray() dereferences\nmr-\u003epage_info[huge], causing an out-of-bounds read/write and a kernel\noops that is triggerable by an unauthenticated remote peer.\n\nRewrite the check in overflow-safe form; the first two clauses guarantee\nthat the subsequent subtractions do not underflow:\n\n if (iova \u003c mr-\u003eibmr.iova ||\n length \u003e mr-\u003eibmr.length ||\n iova - mr-\u003eibmr.iova \u003e mr-\u003eibmr.length - length)\n\nWith the fix, mr_check_range() returns -EINVAL for the crafted iova and\nthe responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bad iova and length come from the RETH header of a RoCEv2 RDMA WRITE/READ (UDP/IP, routable). qp_resp_from_reth() copies them into qp-\u003eresp, and check_rkey() hands them to mr_check_range(), where iova+length wraps past 2^64 and the bounds check passes.\nAC:L - The attacker is the connected RC peer, so it controls the QPN, PSN and RETH contents and chooses va near 2^64 to make iova+length wrap for any MR. The bug fires on the first packet, with no race or memory layout to win.\nPR:N - RoCE has no authentication. check_addr() only matches the peer\u0027s IP address, and services such as rtrs-srv send MR rkeys with IB_ACCESS_REMOTE_WRITE to any client that connects, without checking credentials.\nUI:N - No victim action is needed. The responder processes the attacker\u0027s RETH request entirely in kernel receive context once the QP is connected.\nS:U - The out-of-bounds access corrupts or discloses kernel memory on the same host, inside the kernel\u0027s own security authority. No VM or IOMMU boundary is crossed.\nC:H - For RDMA READ, rxe_mr_copy_xarray() memcpy()s from a struct page pointer read out of bounds of mr-\u003epage_info[], and that data is sent back to the remote peer. Choosing va moves the index over a window of about 2^20 entries.\nI:H - For RDMA WRITE, rxe_mr_copy_xarray() memcpy()s the peer\u0027s payload into the page pointed to by the out-of-bounds page_info[idx].page entry. That is a remote write into kernel-chosen memory, which can be used to hijack control flow.\nA:H - An out-of-bounds page_info index, past the WARN_ON in rxe_mr_iova_to_index(), dereferences garbage page pointers and oopses the kernel. A remote peer can repeat this at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:17.324Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7d2118660545a00b21e83010ded1a231c6fb8c5"
},
{
"url": "https://git.kernel.org/stable/c/5d9426a74fc8cb8f375fcdc19b465a030f9b8cab"
},
{
"url": "https://git.kernel.org/stable/c/2f3b705144e3a3c14184fec6e354680081fe91ec"
},
{
"url": "https://git.kernel.org/stable/c/3431f525718f6b07da308cda6d44f8cb548bbd37"
},
{
"url": "https://git.kernel.org/stable/c/d10e2a08799e858d3e71ea4169bcd018f216d444"
}
],
"title": "RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98365",
"datePublished": "2026-10-06T08:46:50.834Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:17.324Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98306 (GCVE-0-2026-98306)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
When an SRv6 packet arrives on an interface enslaved to a VRF,
vrf_ip6_rcv() sets IP6SKB_L3SLAVE in IP6CB, but decap_and_validate()
has never set IPSKB_L3SLAVE in IPCB. The bit stayed clear in the
common case, and with CONFIG_IPV6_MIP6 the leftover frag_max_size of
a reassembled outer packet could even set it, with no VRF involved.
Commit 44930446dde4 ("ipv6: seg6: clear IPv4 control block on IPIP
decapsulation") then made the unreliable bit reliably clear.
The effect of the missing flag is visible with End.DX4 when a
delivery to a local address of the node reaches the socket lookup.
For example, a UDP socket bound to the enslaved ingress interface
does not receive any of the decapsulated packets, while an unbound
socket outside the VRF does.
This contradicts Documentation/networking/vrf.rst: by default the
scope of an unbound UDP or TCP socket is limited to the default VRF.
Set IPSKB_L3SLAVE for IPv4 in decap_and_validate(), which already does
the same for IPv6. The socket lookup then matches the decapsulated
packet like any other packet received on that enslaved interface. Such
a packet matches an unbound UDP or TCP socket only when
udp_l3mdev_accept or tcp_l3mdev_accept is set.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 Version: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 Version: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 Version: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 Version: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 Version: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 Version: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 Version: 891ef8dd2a8d14e4e73a81dcdb135b574c57f556 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/seg6_local.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1d9f5c78903dd25a3556229eb716dd465c5f3573",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "72f410616000d21a0a6ec6c93a60301b9c92e95c",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "e4d7c52f15f572608374947c6c802052e1a2fc82",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "5130afa025c95faa621adf8bac525baeb2b290d2",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "f8fb4738ccef5f9d107845b05734a56352747b1a",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "ddf60220c925b54a1714c4722fdbdb12833232d0",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "8c16e1ccc082a3763dfc6bc2d3f658c1a6336f9d",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
},
{
"lessThan": "7616242a2b37883f7322aaa1d2bd6cd0fed28315",
"status": "affected",
"version": "891ef8dd2a8d14e4e73a81dcdb135b574c57f556",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/seg6_local.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation\n\nWhen an SRv6 packet arrives on an interface enslaved to a VRF,\nvrf_ip6_rcv() sets IP6SKB_L3SLAVE in IP6CB, but decap_and_validate()\nhas never set IPSKB_L3SLAVE in IPCB. The bit stayed clear in the\ncommon case, and with CONFIG_IPV6_MIP6 the leftover frag_max_size of\na reassembled outer packet could even set it, with no VRF involved.\nCommit 44930446dde4 (\"ipv6: seg6: clear IPv4 control block on IPIP\ndecapsulation\") then made the unreliable bit reliably clear.\n\nThe effect of the missing flag is visible with End.DX4 when a\ndelivery to a local address of the node reaches the socket lookup.\nFor example, a UDP socket bound to the enslaved ingress interface\ndoes not receive any of the decapsulated packets, while an unbound\nsocket outside the VRF does.\nThis contradicts Documentation/networking/vrf.rst: by default the\nscope of an unbound UDP or TCP socket is limited to the default VRF.\n\nSet IPSKB_L3SLAVE for IPv4 in decap_and_validate(), which already does\nthe same for IPv6. The socket lookup then matches the decapsulated\npacket like any other packet received on that enslaved interface. Such\na packet matches an unbound UDP or TCP socket only when\nudp_l3mdev_accept or tcp_l3mdev_accept is set."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:17.032Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1d9f5c78903dd25a3556229eb716dd465c5f3573"
},
{
"url": "https://git.kernel.org/stable/c/72f410616000d21a0a6ec6c93a60301b9c92e95c"
},
{
"url": "https://git.kernel.org/stable/c/e4d7c52f15f572608374947c6c802052e1a2fc82"
},
{
"url": "https://git.kernel.org/stable/c/5130afa025c95faa621adf8bac525baeb2b290d2"
},
{
"url": "https://git.kernel.org/stable/c/f8fb4738ccef5f9d107845b05734a56352747b1a"
},
{
"url": "https://git.kernel.org/stable/c/ddf60220c925b54a1714c4722fdbdb12833232d0"
},
{
"url": "https://git.kernel.org/stable/c/8c16e1ccc082a3763dfc6bc2d3f658c1a6336f9d"
},
{
"url": "https://git.kernel.org/stable/c/7616242a2b37883f7322aaa1d2bd6cd0fed28315"
}
],
"title": "seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98306",
"datePublished": "2026-10-06T08:46:03.001Z",
"dateReserved": "2026-09-25T10:25:14.338Z",
"dateUpdated": "2026-10-19T09:17:17.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98316 (GCVE-0-2026-98316)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: bcd2000: Fix race between rawmidi and disconnect
Although we tried to fix the potential UAF issues at USB disconnect on
bcd2000 driver, there is still an overlooked case -- namely, when a
rawmidi trigger callback has been already running at USB disconnect
handling, the in-flight function (e.g. bcd2000_midi_send()) could
still access the URB, because the previous URB NULL-check & clearance
was considered only for the URB complete callbacks, but not about the
parallel rawmidi operations.
For addressing the race, this patch introduced a new spinlock that
covers each rawmidi operation as well as the rawmidi handling in the
complete callback. The URB is cleared with the lock, so it guarantees
that the pending rawmidi task already finished or a NULL check is
effective.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3c00004f134fc819f9d9e202c6a64acde0a1f8d0 Version: 6c07aad8a7c9ef8ebc4d03a964b882123a349a2e Version: eb482a06791d6168beb8c78cc904ac5a5ed96a55 Version: 7df3194bdb7479cad9199889655a566a2c0c1d1b Version: b06ebc7fe25a6af4a9f6e4a3d4236a4178ad4b01 Version: 459d3a64766f5ca2f1886daeaf24582831a5f5ab Version: 9af08677aa57debaca5b57c8045c52a83d3dd376 Version: 5a77febac6faf6da40fbb4555f703eeb91b58130 Version: 5.10.270 ≤ Version: 5.15.221 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/bcd2000/bcd2000.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3b824930259d54f5047ce6b5c97bd20db2fc2b98",
"status": "affected",
"version": "3c00004f134fc819f9d9e202c6a64acde0a1f8d0",
"versionType": "git"
},
{
"lessThan": "c83d6b0a65f7b71bbabcc91c045dfbffdff6ae76",
"status": "affected",
"version": "6c07aad8a7c9ef8ebc4d03a964b882123a349a2e",
"versionType": "git"
},
{
"lessThan": "0a7ecf52cb59ed77ec525deb52c496ea8fba10b1",
"status": "affected",
"version": "eb482a06791d6168beb8c78cc904ac5a5ed96a55",
"versionType": "git"
},
{
"lessThan": "812ca56867bec3065c2a27f1ff5ce04e2a8bf4f0",
"status": "affected",
"version": "7df3194bdb7479cad9199889655a566a2c0c1d1b",
"versionType": "git"
},
{
"lessThan": "9c8b6eff6e7505c128b615d9a1364ef66fa5c18e",
"status": "affected",
"version": "b06ebc7fe25a6af4a9f6e4a3d4236a4178ad4b01",
"versionType": "git"
},
{
"lessThan": "221253723dc58bb901c3f27a7659823e63fc598c",
"status": "affected",
"version": "459d3a64766f5ca2f1886daeaf24582831a5f5ab",
"versionType": "git"
},
{
"status": "affected",
"version": "9af08677aa57debaca5b57c8045c52a83d3dd376",
"versionType": "git"
},
{
"status": "affected",
"version": "5a77febac6faf6da40fbb4555f703eeb91b58130",
"versionType": "git"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.221",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/bcd2000/bcd2000.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.1.189",
"status": "affected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThan": "6.6.158",
"status": "affected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThan": "6.18.54",
"status": "affected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThan": "7.2.8",
"status": "affected",
"version": "7.2.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "6.1.188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.6.157",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12.109",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.18.50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "7.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.270",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.221",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: bcd2000: Fix race between rawmidi and disconnect\n\nAlthough we tried to fix the potential UAF issues at USB disconnect on\nbcd2000 driver, there is still an overlooked case -- namely, when a\nrawmidi trigger callback has been already running at USB disconnect\nhandling, the in-flight function (e.g. bcd2000_midi_send()) could\nstill access the URB, because the previous URB NULL-check \u0026 clearance\nwas considered only for the URB complete callbacks, but not about the\nparallel rawmidi operations.\n\nFor addressing the race, this patch introduced a new spinlock that\ncovers each rawmidi operation as well as the rawmidi handling in the\ncomplete callback. The URB is cleared with the lock, so it guarantees\nthat the pending rawmidi task already finished or a NULL check is\neffective."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:26.993Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3b824930259d54f5047ce6b5c97bd20db2fc2b98"
},
{
"url": "https://git.kernel.org/stable/c/c83d6b0a65f7b71bbabcc91c045dfbffdff6ae76"
},
{
"url": "https://git.kernel.org/stable/c/0a7ecf52cb59ed77ec525deb52c496ea8fba10b1"
},
{
"url": "https://git.kernel.org/stable/c/812ca56867bec3065c2a27f1ff5ce04e2a8bf4f0"
},
{
"url": "https://git.kernel.org/stable/c/9c8b6eff6e7505c128b615d9a1364ef66fa5c18e"
},
{
"url": "https://git.kernel.org/stable/c/221253723dc58bb901c3f27a7659823e63fc598c"
}
],
"title": "ALSA: bcd2000: Fix race between rawmidi and disconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98316",
"datePublished": "2026-10-06T08:46:11.528Z",
"dateReserved": "2026-09-25T10:25:14.339Z",
"dateUpdated": "2026-10-19T09:17:26.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98267 (GCVE-0-2026-98267)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
9p: Fix v9fs_issue_write() to update i_size and remote_i_size
Fix v9fs_issue_write() to update i_size and remote_i_size to the new size
of the server file if we made it larger, using the start fpos and the count
returned by p9_client_write() to calculate the new minimum file size.
This assumes that if the 9P server makes a short write (say it hits
ENOSPC), a reduced count is returned.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/9p/vfs_addr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aeb1fe55583836744aef11fbfa2a09122aa9816c",
"status": "affected",
"version": "5fb70e7275a61dd404f684370e1add7fe0ebe9c5",
"versionType": "git"
},
{
"lessThan": "88871ab548c1d7b11cde9b04063f3c1c6fbd7039",
"status": "affected",
"version": "5fb70e7275a61dd404f684370e1add7fe0ebe9c5",
"versionType": "git"
},
{
"lessThan": "9cd92e3392bdd14568e9e44aec1ac05e1fcd62e5",
"status": "affected",
"version": "5fb70e7275a61dd404f684370e1add7fe0ebe9c5",
"versionType": "git"
},
{
"lessThan": "c60ae98c5aa64021751b38ab1313b19d620bf640",
"status": "affected",
"version": "5fb70e7275a61dd404f684370e1add7fe0ebe9c5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/9p/vfs_addr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\n9p: Fix v9fs_issue_write() to update i_size and remote_i_size\n\nFix v9fs_issue_write() to update i_size and remote_i_size to the new size\nof the server file if we made it larger, using the start fpos and the count\nreturned by p9_client_write() to calculate the new minimum file size.\n\nThis assumes that if the 9P server makes a short write (say it hits\nENOSPC), a reduced count is returned."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:38.154Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aeb1fe55583836744aef11fbfa2a09122aa9816c"
},
{
"url": "https://git.kernel.org/stable/c/88871ab548c1d7b11cde9b04063f3c1c6fbd7039"
},
{
"url": "https://git.kernel.org/stable/c/9cd92e3392bdd14568e9e44aec1ac05e1fcd62e5"
},
{
"url": "https://git.kernel.org/stable/c/c60ae98c5aa64021751b38ab1313b19d620bf640"
}
],
"title": "9p: Fix v9fs_issue_write() to update i_size and remote_i_size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98267",
"datePublished": "2026-10-06T08:45:30.042Z",
"dateReserved": "2026-09-25T10:25:14.333Z",
"dateUpdated": "2026-10-19T09:16:38.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97901 (GCVE-0-2026-97901)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
genetlink: pin family module during policy dump
The generic netlink controller's policy dump keeps pointers to the target
family's operation and policy tables in its callback state. A dump may be
split across multiple skbs and remain pending after the initial request.
Netlink pins the module which owns the dump callback, but in this case
that is the controller's owner rather than the target family's owner. The
target family can consequently be unregistered and its module unloaded
while a policy dump is pending. Advancing the dump then dereferences
policy memory from the unloaded module.
Take a reference to the target family's module when the dump starts.
Drop it from the error and done paths. This matches the lifetime for which
the dump context retains the family and policy pointers.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netlink/genetlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1a345d95e59a99e25404138b5a1ec2edcb03269f",
"status": "affected",
"version": "d07dcf9aadd6b2842b439e8668ff7ea2873f28d7",
"versionType": "git"
},
{
"lessThan": "6e4d746e55c83c240cffce92356763d16b236af5",
"status": "affected",
"version": "d07dcf9aadd6b2842b439e8668ff7ea2873f28d7",
"versionType": "git"
},
{
"lessThan": "508387ad95ef9c13aa6431678c39763e882da2dc",
"status": "affected",
"version": "d07dcf9aadd6b2842b439e8668ff7ea2873f28d7",
"versionType": "git"
},
{
"lessThan": "6d8e653fcf1c90310797eeba8e5fafe9ccc3de9e",
"status": "affected",
"version": "d07dcf9aadd6b2842b439e8668ff7ea2873f28d7",
"versionType": "git"
},
{
"lessThan": "6a1094c34d176827b2b173e163dcc964a13af93f",
"status": "affected",
"version": "d07dcf9aadd6b2842b439e8668ff7ea2873f28d7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netlink/genetlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngenetlink: pin family module during policy dump\n\nThe generic netlink controller\u0027s policy dump keeps pointers to the target\nfamily\u0027s operation and policy tables in its callback state. A dump may be\nsplit across multiple skbs and remain pending after the initial request.\n\nNetlink pins the module which owns the dump callback, but in this case\nthat is the controller\u0027s owner rather than the target family\u0027s owner. The\ntarget family can consequently be unregistered and its module unloaded\nwhile a policy dump is pending. Advancing the dump then dereferences\npolicy memory from the unloaded module.\n\nTake a reference to the target family\u0027s module when the dump starts.\nDrop it from the error and done paths. This matches the lifetime for which\nthe dump context retains the family and policy pointers."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:31.195Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1a345d95e59a99e25404138b5a1ec2edcb03269f"
},
{
"url": "https://git.kernel.org/stable/c/6e4d746e55c83c240cffce92356763d16b236af5"
},
{
"url": "https://git.kernel.org/stable/c/508387ad95ef9c13aa6431678c39763e882da2dc"
},
{
"url": "https://git.kernel.org/stable/c/6d8e653fcf1c90310797eeba8e5fafe9ccc3de9e"
},
{
"url": "https://git.kernel.org/stable/c/6a1094c34d176827b2b173e163dcc964a13af93f"
}
],
"title": "genetlink: pin family module during policy dump",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97901",
"datePublished": "2026-09-25T10:22:28.655Z",
"dateReserved": "2026-09-25T10:18:58.200Z",
"dateUpdated": "2026-10-21T12:53:31.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98295 (GCVE-0-2026-98295)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: coredump: Quiesce dump work on unregister
hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers
queue dump_rx without holding an hdev reference. Unregister leaves both
works live, so disconnecting during an active dump lets them access hdev
after hci_release_dev() frees it.
Shut down coredump processing during unregister. Close the producer gate
under dump_q.lock before disabling both works, then free the active buffer
and queued packets under hci_dev_lock. Serializing the gate with enqueue
prevents controller-specific workers from adding packets after the final
purge.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9695ef876fd122cb7bbc04a4a93b8727d2e36bda Version: 9695ef876fd122cb7bbc04a4a93b8727d2e36bda Version: 9695ef876fd122cb7bbc04a4a93b8727d2e36bda Version: 9695ef876fd122cb7bbc04a4a93b8727d2e36bda Version: deb8156ebe5cb63a5988e7f86cc46aa062527c2b Version: 6.1.188 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/coredump.h",
"net/bluetooth/coredump.c",
"net/bluetooth/hci_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "24af375d7d8aa5f698e4dc41317102f44114351a",
"status": "affected",
"version": "9695ef876fd122cb7bbc04a4a93b8727d2e36bda",
"versionType": "git"
},
{
"lessThan": "dcaf10ef27f928568c25de3e9fc242e538de5c67",
"status": "affected",
"version": "9695ef876fd122cb7bbc04a4a93b8727d2e36bda",
"versionType": "git"
},
{
"lessThan": "82699d1b727ba5980b94f1eb8dc3d346f41b7c67",
"status": "affected",
"version": "9695ef876fd122cb7bbc04a4a93b8727d2e36bda",
"versionType": "git"
},
{
"lessThan": "d236517c264e41dc09833c708ef23bccb7a91219",
"status": "affected",
"version": "9695ef876fd122cb7bbc04a4a93b8727d2e36bda",
"versionType": "git"
},
{
"status": "affected",
"version": "deb8156ebe5cb63a5988e7f86cc46aa062527c2b",
"versionType": "git"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.188",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/coredump.h",
"net/bluetooth/coredump.c",
"net/bluetooth/hci_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.188",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: coredump: Quiesce dump work on unregister\n\nhci_devcd_handle_pkt_init() arms dump_timeout and coredump producers\nqueue dump_rx without holding an hdev reference. Unregister leaves both\nworks live, so disconnecting during an active dump lets them access hdev\nafter hci_release_dev() frees it.\n\nShut down coredump processing during unregister. Close the producer gate\nunder dump_q.lock before disabling both works, then free the active buffer\nand queued packets under hci_dev_lock. Serializing the gate with enqueue\nprevents controller-specific workers from adding packets after the final\npurge."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:06.302Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/24af375d7d8aa5f698e4dc41317102f44114351a"
},
{
"url": "https://git.kernel.org/stable/c/dcaf10ef27f928568c25de3e9fc242e538de5c67"
},
{
"url": "https://git.kernel.org/stable/c/82699d1b727ba5980b94f1eb8dc3d346f41b7c67"
},
{
"url": "https://git.kernel.org/stable/c/d236517c264e41dc09833c708ef23bccb7a91219"
}
],
"title": "Bluetooth: coredump: Quiesce dump work on unregister",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98295",
"datePublished": "2026-10-06T08:45:54.141Z",
"dateReserved": "2026-09-25T10:25:14.337Z",
"dateUpdated": "2026-10-19T09:17:06.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97530 (GCVE-0-2026-97530)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() poll
rsp_q->ring_ptr->signature for RESPONSE_PROCESSED (0xDEADDEAD) to decide
whether the next continuation IOCB has arrived, spinning on cpu_relax()
without advancing the ring or decrementing the entry count while it has
not. response_t::signature lives at byte offset 60, but a continuation
IOCB (sts_cont_entry_t / struct sts_cont_entry_ext) carries raw FC frame
payload at that offset (data[56..59]). A received frame whose payload
bytes happen to equal 0xDEADDEAD is therefore misread as "not yet
arrived", and the loop spins forever in interrupt/DPC context, causing a
CPU soft lockup.
The poll is also unnecessary: callers of qla27xx_copy_multiple_pkt()
(PT_LS4_UNSOL and the NVMe purls path) already gate on
qla_chk_cont_iocb_avail(), which guarantees all entry_count IOCBs are
present before copying begins. The sibling helper
__qla_copy_purex_to_buffer() already drops the signature poll and relies
on the entry_type == STATUS_CONT_TYPE guard instead.
Remove the signature busy-wait from both helpers, keeping the entry_type
guard, and gate the FPIN path with qla_chk_cont_iocb_avail() so it defers
and re-processes on the next interrupt once all continuation IOCBs have
arrived, mirroring the ELS_AUTH_ELS and PT_LS4_UNSOL arms. With this the
signature field is never read on a continuation IOCB, eliminating the
payload-aliasing lockup.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_isr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "428e244dd4066abd40ca1ec525b7aab9a9db8296",
"status": "affected",
"version": "9f2475fe7406b8ef5f97099c4980021344872d9f",
"versionType": "git"
},
{
"lessThan": "3e58eb888ebf265af937f636d05997c60d2f197c",
"status": "affected",
"version": "9f2475fe7406b8ef5f97099c4980021344872d9f",
"versionType": "git"
},
{
"lessThan": "6e6c2ba9022eb8f9b062c81bdc6fd24c7b4c4c16",
"status": "affected",
"version": "9f2475fe7406b8ef5f97099c4980021344872d9f",
"versionType": "git"
},
{
"lessThan": "6aa722fca9d2aa1f64094101587f8f4a2f83f6aa",
"status": "affected",
"version": "9f2475fe7406b8ef5f97099c4980021344872d9f",
"versionType": "git"
},
{
"lessThan": "d7e3fa7d06bf7fcaac186d3c4d635caac166d36c",
"status": "affected",
"version": "9f2475fe7406b8ef5f97099c4980021344872d9f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_isr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix soft lockup polling continuation IOCB signature\n\nqla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() poll\nrsp_q-\u003ering_ptr-\u003esignature for RESPONSE_PROCESSED (0xDEADDEAD) to decide\nwhether the next continuation IOCB has arrived, spinning on cpu_relax()\nwithout advancing the ring or decrementing the entry count while it has\nnot. response_t::signature lives at byte offset 60, but a continuation\nIOCB (sts_cont_entry_t / struct sts_cont_entry_ext) carries raw FC frame\npayload at that offset (data[56..59]). A received frame whose payload\nbytes happen to equal 0xDEADDEAD is therefore misread as \"not yet\narrived\", and the loop spins forever in interrupt/DPC context, causing a\nCPU soft lockup.\n\nThe poll is also unnecessary: callers of qla27xx_copy_multiple_pkt()\n(PT_LS4_UNSOL and the NVMe purls path) already gate on\nqla_chk_cont_iocb_avail(), which guarantees all entry_count IOCBs are\npresent before copying begins. The sibling helper\n__qla_copy_purex_to_buffer() already drops the signature poll and relies\non the entry_type == STATUS_CONT_TYPE guard instead.\n\nRemove the signature busy-wait from both helpers, keeping the entry_type\nguard, and gate the FPIN path with qla_chk_cont_iocb_avail() so it defers\nand re-processes on the next interrupt once all continuation IOCBs have\narrived, mirroring the ELS_AUTH_ELS and PT_LS4_UNSOL arms. With this the\nsignature field is never read on a continuation IOCB, eliminating the\npayload-aliasing lockup."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:06.121Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/428e244dd4066abd40ca1ec525b7aab9a9db8296"
},
{
"url": "https://git.kernel.org/stable/c/3e58eb888ebf265af937f636d05997c60d2f197c"
},
{
"url": "https://git.kernel.org/stable/c/6e6c2ba9022eb8f9b062c81bdc6fd24c7b4c4c16"
},
{
"url": "https://git.kernel.org/stable/c/6aa722fca9d2aa1f64094101587f8f4a2f83f6aa"
},
{
"url": "https://git.kernel.org/stable/c/d7e3fa7d06bf7fcaac186d3c4d635caac166d36c"
}
],
"title": "scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97530",
"datePublished": "2026-09-25T10:21:31.326Z",
"dateReserved": "2026-09-24T16:01:01.153Z",
"dateUpdated": "2026-10-21T12:53:06.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97949 (GCVE-0-2026-97949)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
configfs: unhash the dentry before dropping the item in rmdir
configfs_get_config_item() treats a hashed dentry as proof that
sd->s_element is a live config_item. configfs_rmdir() breaks that:
simple_rmdir() leaves the dentry hashed, the last reference to the item is
dropped right after, and the dentry is only unhashed by d_delete() once
->rmdir() has returned. configfs_symlink() resolves its target holding no
lock on it, so get_target() can land in that window:
BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90
get_target fs/configfs/symlink.c:128 [inline]
configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185
Unhash in configfs_remove_dir(), while the item is still guaranteed to be
there. A reference obtained just before that stays harmless, as
create_link() rechecks CONFIGFS_USET_DROPPING, already set by
configfs_detach_prep(). Both configfs_unregister_subsystem() paths
d_drop() after detaching, so this only makes rmdir match them.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/configfs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b315d865660766d45ecdbf7433a4e3d36a554b3b",
"status": "affected",
"version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
"versionType": "git"
},
{
"lessThan": "446720051d44eebaa81b33969173160057b73a33",
"status": "affected",
"version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
"versionType": "git"
},
{
"lessThan": "5d7cbfb65e47cc71d5d94d87d5d0d1679080f3eb",
"status": "affected",
"version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
"versionType": "git"
},
{
"lessThan": "925d8564f1b2d9b46c5ab63b9bc942cea006da9b",
"status": "affected",
"version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
"versionType": "git"
},
{
"lessThan": "f06c2d26d1999d37e93299db0ecead04ca7d0b9f",
"status": "affected",
"version": "7063fbf2261194f72ee75afca67b3b38b554b5fa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/configfs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.16"
},
{
"lessThan": "2.6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nconfigfs: unhash the dentry before dropping the item in rmdir\n\nconfigfs_get_config_item() treats a hashed dentry as proof that\nsd-\u003es_element is a live config_item. configfs_rmdir() breaks that:\nsimple_rmdir() leaves the dentry hashed, the last reference to the item is\ndropped right after, and the dentry is only unhashed by d_delete() once\n-\u003ermdir() has returned. configfs_symlink() resolves its target holding no\nlock on it, so get_target() can land in that window:\n\n BUG: KASAN: slab-use-after-free in config_item_get+0x26/0x90\n get_target fs/configfs/symlink.c:128 [inline]\n configfs_symlink+0x4ab/0x1030 fs/configfs/symlink.c:185\n\nUnhash in configfs_remove_dir(), while the item is still guaranteed to be\nthere. A reference obtained just before that stays harmless, as\ncreate_link() rechecks CONFIGFS_USET_DROPPING, already set by\nconfigfs_detach_prep(). Both configfs_unregister_subsystem() paths\nd_drop() after detaching, so this only makes rmdir match them."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:47.600Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b315d865660766d45ecdbf7433a4e3d36a554b3b"
},
{
"url": "https://git.kernel.org/stable/c/446720051d44eebaa81b33969173160057b73a33"
},
{
"url": "https://git.kernel.org/stable/c/5d7cbfb65e47cc71d5d94d87d5d0d1679080f3eb"
},
{
"url": "https://git.kernel.org/stable/c/925d8564f1b2d9b46c5ab63b9bc942cea006da9b"
},
{
"url": "https://git.kernel.org/stable/c/f06c2d26d1999d37e93299db0ecead04ca7d0b9f"
}
],
"title": "configfs: unhash the dentry before dropping the item in rmdir",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97949",
"datePublished": "2026-09-25T10:22:58.375Z",
"dateReserved": "2026-09-25T10:18:58.205Z",
"dateUpdated": "2026-10-21T12:53:47.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89859 (GCVE-0-2026-89859)
Vulnerability from cvelistv5
Published
2026-09-16 10:31
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak
qla2x00_do_dport_diagnostics() allocates the qla_dport_diag response
buffer with kmalloc_obj() (non-zeroing) and, on success, copies the full
sizeof(*dd) back to user space via sg_copy_from_buffer(). The inbound
sg_copy_to_buffer() only fills as many bytes as the user request payload
provides, and qla26xx_dport_diagnostics() zeroes only dd->buf. The
options and unused[] fields are therefore copied out uninitialized,
leaking kernel heap contents to user space.
Allocate with kzalloc_obj(), matching qla2x00_do_dport_diagnostics_v2().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_bsg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ecc30066c2284d2ed11bbd576ec97156b384054",
"status": "affected",
"version": "ec89146215d124c429bff84b498dccdc4919ffa7",
"versionType": "git"
},
{
"lessThan": "5dfc77099c7d9fde9520a229794b0154d7ccccc1",
"status": "affected",
"version": "ec89146215d124c429bff84b498dccdc4919ffa7",
"versionType": "git"
},
{
"lessThan": "d6e2411516bb95e52cb74c9c56b60ad2548a2730",
"status": "affected",
"version": "ec89146215d124c429bff84b498dccdc4919ffa7",
"versionType": "git"
},
{
"lessThan": "9fc03be982763a131913f84fe73b240ae45bca37",
"status": "affected",
"version": "ec89146215d124c429bff84b498dccdc4919ffa7",
"versionType": "git"
},
{
"lessThan": "a152edab3854f01dd2daf3eaf8f32cbabdb3834e",
"status": "affected",
"version": "ec89146215d124c429bff84b498dccdc4919ffa7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_bsg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak\n\nqla2x00_do_dport_diagnostics() allocates the qla_dport_diag response\nbuffer with kmalloc_obj() (non-zeroing) and, on success, copies the full\nsizeof(*dd) back to user space via sg_copy_from_buffer(). The inbound\nsg_copy_to_buffer() only fills as many bytes as the user request payload\nprovides, and qla26xx_dport_diagnostics() zeroes only dd-\u003ebuf. The\noptions and unused[] fields are therefore copied out uninitialized,\nleaking kernel heap contents to user space.\n\nAllocate with kzalloc_obj(), matching qla2x00_do_dport_diagnostics_v2()."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:04.067Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ecc30066c2284d2ed11bbd576ec97156b384054"
},
{
"url": "https://git.kernel.org/stable/c/5dfc77099c7d9fde9520a229794b0154d7ccccc1"
},
{
"url": "https://git.kernel.org/stable/c/d6e2411516bb95e52cb74c9c56b60ad2548a2730"
},
{
"url": "https://git.kernel.org/stable/c/9fc03be982763a131913f84fe73b240ae45bca37"
},
{
"url": "https://git.kernel.org/stable/c/a152edab3854f01dd2daf3eaf8f32cbabdb3834e"
}
],
"title": "scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89859",
"datePublished": "2026-09-16T10:31:31.554Z",
"dateReserved": "2026-09-11T19:38:34.771Z",
"dateUpdated": "2026-10-21T12:49:04.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89520 (GCVE-0-2026-89520)
Vulnerability from cvelistv5
Published
2026-09-11 19:44
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched/core: Make core-sched flips wait for in-flight selections
Core scheduling's pick_next_task() operates on all sibling rqs under one
acquisition of the shared core-wide lock. A ->pick_task() that releases the
rq lock leaves every sibling __lock momentarily free, letting
__sched_core_flip(false) complete mid-selection and rebind rq_lockp() under
it. The selection resumes on the split locks, touching sibling state it no
longer protects, and __schedule() finally releases a lock that was never
taken while leaking the one that was.
Count in-flight core-wide selections in the leader's rq->core_pick_in_flight
and make __sched_core_flip() wait for the count to drain. The count only
changes under the shared lock, which the flip holds while sampling, so no
other ordering is needed. The wait can repeat while selections overlap, but
the flip backs off between samples and flips are rare cookie-lifetime
events.
sched_core_cpu_deactivate() moves the count to the new leader - a stale copy
left behind would bias it forever if that CPU later returns as its own
leader.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/core.c",
"kernel/sched/sched.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a2a16896ed53046f275f56a6cd8ca3fb6f12c4f3",
"status": "affected",
"version": "539f65125d20aacab54d02d77f10a839f45b09dc",
"versionType": "git"
},
{
"lessThan": "3e2511bffa93a639774a99e392181e21d28677e2",
"status": "affected",
"version": "539f65125d20aacab54d02d77f10a839f45b09dc",
"versionType": "git"
},
{
"lessThan": "9d69422ddaa13526c2223444e237d948d6e44728",
"status": "affected",
"version": "539f65125d20aacab54d02d77f10a839f45b09dc",
"versionType": "git"
},
{
"lessThan": "23eda24f325a6e6d686d30ec75f2e9d6745e2015",
"status": "affected",
"version": "539f65125d20aacab54d02d77f10a839f45b09dc",
"versionType": "git"
},
{
"lessThan": "f3629c63a4af3e491381780bc6c123cb498c4c40",
"status": "affected",
"version": "539f65125d20aacab54d02d77f10a839f45b09dc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/core.c",
"kernel/sched/sched.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Make core-sched flips wait for in-flight selections\n\nCore scheduling\u0027s pick_next_task() operates on all sibling rqs under one\nacquisition of the shared core-wide lock. A -\u003epick_task() that releases the\nrq lock leaves every sibling __lock momentarily free, letting\n__sched_core_flip(false) complete mid-selection and rebind rq_lockp() under\nit. The selection resumes on the split locks, touching sibling state it no\nlonger protects, and __schedule() finally releases a lock that was never\ntaken while leaking the one that was.\n\nCount in-flight core-wide selections in the leader\u0027s rq-\u003ecore_pick_in_flight\nand make __sched_core_flip() wait for the count to drain. The count only\nchanges under the shared lock, which the flip holds while sampling, so no\nother ordering is needed. The wait can repeat while selections overlap, but\nthe flip backs off between samples and flips are rare cookie-lifetime\nevents.\n\nsched_core_cpu_deactivate() moves the count to the new leader - a stale copy\nleft behind would bias it forever if that CPU later returns as its own\nleader."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The race is in pick_next_task() and __sched_core_flip() in kernel/sched/core.c, reached locally via prctl(PR_SCHED_CORE) cookie create/drop and ordinary schedule() on SMT siblings; there is no network or adjacent-packet path.\nAC:L - The attacker enables core scheduling with PR_SCHED_CORE_CREATE, then drops the last cookie to queue __sched_core_flip(false) while forcing SMT-sibling scheduling so a lock-dropping pick_task() (CFS newidle or sched_ext) releases the shared rq lock; both sides of the race are attacker-controlled and retryable.\nPR:L - sched_core_share_pid() only requires ptrace_may_access(PTRACE_MODE_READ_REALCREDS) on the target, which an unprivileged process always has for itself, so prctl(PR_SCHED_CORE) needs no capability or init-namespace root.\nUI:N - No victim action such as mounting a filesystem or opening a file is required; the attacker enables core scheduling on their own tasks and races cookie teardown against their own threads\u0027 scheduling.\nS:U - Unprotected sibling runqueue accesses and unlocking the rebound rq lock corrupt host kernel scheduler state inside a single security authority; this is not a guest-to-host, IOMMU, or sandbox boundary crossing.\nC:H - After __sched_core_flip(false) rebinds rq_lockp() mid-selection, pick_next_task() keeps reading sibling rq and task_struct fields without the core-wide lock, so concurrent scheduler-structure corruption can be turned into a kernel memory-disclosure primitive.\nI:H - The same unlocked sibling walk can place one task_struct on two CPUs, and __schedule() then unlocks a lock it never took while leaking the shared core lock, yielding write and control-flow hijack primitives against scheduler state.\nA:H - Unlocking an unheld lock, leaking the shared core lock, and racing sibling runqueue mutation cause kernel oops, lockdep panics, deadlocks, and hangs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:38.219Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a2a16896ed53046f275f56a6cd8ca3fb6f12c4f3"
},
{
"url": "https://git.kernel.org/stable/c/3e2511bffa93a639774a99e392181e21d28677e2"
},
{
"url": "https://git.kernel.org/stable/c/9d69422ddaa13526c2223444e237d948d6e44728"
},
{
"url": "https://git.kernel.org/stable/c/23eda24f325a6e6d686d30ec75f2e9d6745e2015"
},
{
"url": "https://git.kernel.org/stable/c/f3629c63a4af3e491381780bc6c123cb498c4c40"
}
],
"title": "sched/core: Make core-sched flips wait for in-flight selections",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89520",
"datePublished": "2026-09-11T19:44:02.510Z",
"dateReserved": "2026-09-11T19:38:34.718Z",
"dateUpdated": "2026-10-21T12:47:38.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97615 (GCVE-0-2026-97615)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: use option bits for CFM/MRP frame handlers
CFM and MRP register a global br_frame_type whose hlist_node is linked
into the per-bridge frame_type_list when the first MEP/MRP instance is
created. Enabling the protocol on multiple bridges therefore inserts the
same node into multiple lists. Unregistering it on one bridge then
corrupts list state belonging to another.
These handlers can only be installed once per bridge, and they are
uncommon. Track their per-bridge enable state with net_bridge option
bits, which already live on the Rx hot cache line, and dispatch the
matching handler directly from the receive path. Check both bits
together first as an unlikely case.
Remove the generic frame_type_list and br_frame_type helpers, which
have had no other users since CFM and MRP were added. That shrinks
struct net_bridge by 8 bytes and drops the list walk from the fast
path. When neither protocol is compiled in, BR_CFM_MRP_OPTS is 0 and
the compiler prunes the branch.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_cfm.c",
"net/bridge/br_device.c",
"net/bridge/br_input.c",
"net/bridge/br_mrp.c",
"net/bridge/br_private.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "260f99b355a44f6ce67971ebc9223b22c8f93957",
"status": "affected",
"version": "90c628dd47ff4178f645b34938470bf43d02d123",
"versionType": "git"
},
{
"lessThan": "be5ead6552418d70df3a76b962ccd6ed78a31fb5",
"status": "affected",
"version": "90c628dd47ff4178f645b34938470bf43d02d123",
"versionType": "git"
},
{
"lessThan": "994fd705ca498223d188024cde833739a9dddbd2",
"status": "affected",
"version": "90c628dd47ff4178f645b34938470bf43d02d123",
"versionType": "git"
},
{
"lessThan": "42e033c8f30fd2923ccac3373ae70797e521dae1",
"status": "affected",
"version": "90c628dd47ff4178f645b34938470bf43d02d123",
"versionType": "git"
},
{
"lessThan": "7a49e6b16f36b8e085521699adbca3e321b6dd0c",
"status": "affected",
"version": "90c628dd47ff4178f645b34938470bf43d02d123",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_cfm.c",
"net/bridge/br_device.c",
"net/bridge/br_input.c",
"net/bridge/br_mrp.c",
"net/bridge/br_private.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: use option bits for CFM/MRP frame handlers\n\nCFM and MRP register a global br_frame_type whose hlist_node is linked\ninto the per-bridge frame_type_list when the first MEP/MRP instance is\ncreated. Enabling the protocol on multiple bridges therefore inserts the\nsame node into multiple lists. Unregistering it on one bridge then\ncorrupts list state belonging to another.\n\nThese handlers can only be installed once per bridge, and they are\nuncommon. Track their per-bridge enable state with net_bridge option\nbits, which already live on the Rx hot cache line, and dispatch the\nmatching handler directly from the receive path. Check both bits\ntogether first as an unlikely case.\n\nRemove the generic frame_type_list and br_frame_type helpers, which\nhave had no other users since CFM and MRP were added. That shrinks\nstruct net_bridge by 8 bytes and drops the list walk from the fast\npath. When neither protocol is compiled in, BR_CFM_MRP_OPTS is 0 and\nthe compiler prunes the branch."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:27.949Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/260f99b355a44f6ce67971ebc9223b22c8f93957"
},
{
"url": "https://git.kernel.org/stable/c/be5ead6552418d70df3a76b962ccd6ed78a31fb5"
},
{
"url": "https://git.kernel.org/stable/c/994fd705ca498223d188024cde833739a9dddbd2"
},
{
"url": "https://git.kernel.org/stable/c/42e033c8f30fd2923ccac3373ae70797e521dae1"
},
{
"url": "https://git.kernel.org/stable/c/7a49e6b16f36b8e085521699adbca3e321b6dd0c"
}
],
"title": "net: bridge: use option bits for CFM/MRP frame handlers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97615",
"datePublished": "2026-09-25T10:22:23.234Z",
"dateReserved": "2026-09-24T16:01:01.159Z",
"dateUpdated": "2026-10-21T12:53:27.949Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81016 (GCVE-0-2026-81016)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
platform/x86/amd/pmc: Propagate SMU errors and validate S2D address
amd_stb_s2d_init() discards the return value of several S2D SMU commands.
When the SMU refuses a command (e.g. "SMU cmd failed. err: 0xff") the
failure is only noticed indirectly - if at all - and reported as -EIO,
masking the real error.
More seriously, the S2D_PHYS_ADDR_LOW/HIGH return values are ignored, so
on failure phys_addr_low/hi are left uninitialised and the assembled
address is passed straight to devm_ioremap(). When the SMU leaves them at
zero this maps physical address 0 and trips the ioremap-on-RAM warning:
amd_pmc AMDI000B:00: SMU cmd failed. err: 0xff
ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff
WARNING: CPU: 13 PID: 4592 at arch/x86/mm/ioremap.c:...
Check the return value of each SMU command and propagate it, and reject a
zero physical address before calling devm_ioremap().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/amd/pmc/mp1_stb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "85ef9d4c384c1d143c51580933674d94dba3b8d9",
"status": "affected",
"version": "3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d",
"versionType": "git"
},
{
"lessThan": "638e1ca5d4e2b4fdbb209db64926d013b34f3b79",
"status": "affected",
"version": "3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d",
"versionType": "git"
},
{
"lessThan": "8178f59d76570b152d836bde07f5997f15861f04",
"status": "affected",
"version": "3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d",
"versionType": "git"
},
{
"lessThan": "775d4cde1f9737796ce7d8393521e9e8c5b49891",
"status": "affected",
"version": "3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d",
"versionType": "git"
},
{
"lessThan": "0225c1d637687b03726f00ac65b6def843d2c464",
"status": "affected",
"version": "3d7d407dfb05b257e15cb0c6b056428a4a8c2e5d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/amd/pmc/mp1_stb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd/pmc: Propagate SMU errors and validate S2D address\n\namd_stb_s2d_init() discards the return value of several S2D SMU commands.\nWhen the SMU refuses a command (e.g. \"SMU cmd failed. err: 0xff\") the\nfailure is only noticed indirectly - if at all - and reported as -EIO,\nmasking the real error.\n\nMore seriously, the S2D_PHYS_ADDR_LOW/HIGH return values are ignored, so\non failure phys_addr_low/hi are left uninitialised and the assembled\naddress is passed straight to devm_ioremap(). When the SMU leaves them at\nzero this maps physical address 0 and trips the ioremap-on-RAM warning:\n\n amd_pmc AMDI000B:00: SMU cmd failed. err: 0xff\n ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff\n WARNING: CPU: 13 PID: 4592 at arch/x86/mm/ioremap.c:...\n\nCheck the return value of each SMU command and propagate it, and reject a\nzero physical address before calling devm_ioremap()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - amd_stb_s2d_init() runs from amd_pmc_probe() on the AMD PMC ACPI platform driver (AMDI0005\u2013AMDI000C and related IDs) during local device bind or module load; the SMU mailbox commands and devm_ioremap() are not reachable from network, Bluetooth, Wi-Fi, or USB packet paths.\nAC:L - On affected AMD platforms where SMU accepts S2D_TELEMETRY_SIZE but rejects S2D_PHYS_ADDR_LOW/HIGH (observed err 0xff), ignored failures leave phys_addr_low/hi uninitialized or zero and the subsequent ioremap is deterministic; stack zeroing makes address 0 reliable, with no race or attacker-uncontrollable layout.\nPR:N - The SMU queries and devm_ioremap() execute automatically in amd_pmc_probe() during ACPI/udev bind with no capable() check; enable_stb=1 is the vulnerable STB debug deployment (kernel cmdline or modprobe), after which kernel context runs the path without a user account or namespace privilege.\nUI:N - No victim interaction is required; the invalid ioremap occurs during automatic amd_pmc probe at boot or module load when STB is enabled, before any debugfs open, mount, or other user action.\nS:U - The bad physical-address ioremap, kernel warning, and any subsequent STB debugfs copy occur entirely inside the host kernel PMC driver; this is not a VM escape, IOMMU/DMA boundary bypass, or other cross-authority breakout.\nC:H - Ignored SMU failures pass uninitialized phys_addr_low/hi to devm_ioremap() for up to 16MB (S2D_TELEMETRY_DRAMBYTES_MAX); a non-RAM physical address creates a mapping that amd_stb_debugfs_open_v2 copies to userspace via memcpy_fromio on the 0644 stb_read node, yielding a large physical-memory disclosure.\nI:N - The driver only memcpy_fromio()s the STB mapping and never writes through stb_virt_addr; ioremap of RAM at address 0 is rejected, and there is no out-of-bounds write, use-after-free, or other kernel integrity or control-flow primitive.\nA:H - devm_ioremap() of physical address 0 hits WARN_ONCE in arch/x86/mm/ioremap.c, which panics under panic_on_warn; when the mapping fails, stb_virt_addr stays NULL while debugfs stb_read remains, so a later open does memcpy_fromio(NULL) and oopses the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:24.488Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/85ef9d4c384c1d143c51580933674d94dba3b8d9"
},
{
"url": "https://git.kernel.org/stable/c/638e1ca5d4e2b4fdbb209db64926d013b34f3b79"
},
{
"url": "https://git.kernel.org/stable/c/8178f59d76570b152d836bde07f5997f15861f04"
},
{
"url": "https://git.kernel.org/stable/c/775d4cde1f9737796ce7d8393521e9e8c5b49891"
},
{
"url": "https://git.kernel.org/stable/c/0225c1d637687b03726f00ac65b6def843d2c464"
}
],
"title": "platform/x86/amd/pmc: Propagate SMU errors and validate S2D address",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-81016",
"datePublished": "2026-09-11T19:43:04.740Z",
"dateReserved": "2026-08-26T14:34:25.813Z",
"dateUpdated": "2026-10-21T12:47:24.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98195 (GCVE-0-2026-98195)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlegacy: fix broadcast stations deallocation
On the error path of __il4965_up(), il_dealloc_bcast_stations() clears
only IL_STA_UCODE_ACTIVE, leaving IL_STA_BCAST set. This causes the
same broadcast stations to be deallocated again by __il4965_down().
This can occur when RF_KILL is toggled during driver startup.
To fix clear the entire 'used' field, since we will not do any
other operations on the station.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c2fd34469d1623111e3c3db65cde533f3bddc26e Version: c2fd34469d1623111e3c3db65cde533f3bddc26e Version: c2fd34469d1623111e3c3db65cde533f3bddc26e Version: c2fd34469d1623111e3c3db65cde533f3bddc26e Version: c2fd34469d1623111e3c3db65cde533f3bddc26e Version: c2fd34469d1623111e3c3db65cde533f3bddc26e Version: c2fd34469d1623111e3c3db65cde533f3bddc26e Version: c2fd34469d1623111e3c3db65cde533f3bddc26e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlegacy/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "275d474a4b4bd4e73b18b1452f12e78806a8843a",
"status": "affected",
"version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
"versionType": "git"
},
{
"lessThan": "526fdd45548e22eee50ee1062abd88269d9f32e0",
"status": "affected",
"version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
"versionType": "git"
},
{
"lessThan": "c9a116d691364cd7f59d8329b395adcaf826d5c6",
"status": "affected",
"version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
"versionType": "git"
},
{
"lessThan": "85d847ff71fe736cbc15ada321256818e630e205",
"status": "affected",
"version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
"versionType": "git"
},
{
"lessThan": "1d84c2a3de449aceb94ed79eaefecdf1bedb6468",
"status": "affected",
"version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
"versionType": "git"
},
{
"lessThan": "55d34422c0d91436983028fd3c1546a1c2bee55f",
"status": "affected",
"version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
"versionType": "git"
},
{
"lessThan": "a9176fe666af1730cab92350f9c8cf67ebf14439",
"status": "affected",
"version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
"versionType": "git"
},
{
"lessThan": "b5526b780f8b297a76030410b96ba29153afb98f",
"status": "affected",
"version": "c2fd34469d1623111e3c3db65cde533f3bddc26e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlegacy/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlegacy: fix broadcast stations deallocation\n\nOn the error path of __il4965_up(), il_dealloc_bcast_stations() clears\nonly IL_STA_UCODE_ACTIVE, leaving IL_STA_BCAST set. This causes the\nsame broadcast stations to be deallocated again by __il4965_down().\n\nThis can occur when RF_KILL is toggled during driver startup.\n\nTo fix clear the entire \u0027used\u0027 field, since we will not do any\nother operations on the station."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:26.463Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/275d474a4b4bd4e73b18b1452f12e78806a8843a"
},
{
"url": "https://git.kernel.org/stable/c/526fdd45548e22eee50ee1062abd88269d9f32e0"
},
{
"url": "https://git.kernel.org/stable/c/c9a116d691364cd7f59d8329b395adcaf826d5c6"
},
{
"url": "https://git.kernel.org/stable/c/85d847ff71fe736cbc15ada321256818e630e205"
},
{
"url": "https://git.kernel.org/stable/c/1d84c2a3de449aceb94ed79eaefecdf1bedb6468"
},
{
"url": "https://git.kernel.org/stable/c/55d34422c0d91436983028fd3c1546a1c2bee55f"
},
{
"url": "https://git.kernel.org/stable/c/a9176fe666af1730cab92350f9c8cf67ebf14439"
},
{
"url": "https://git.kernel.org/stable/c/b5526b780f8b297a76030410b96ba29153afb98f"
}
],
"title": "wifi: iwlegacy: fix broadcast stations deallocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98195",
"datePublished": "2026-10-06T08:44:34.915Z",
"dateReserved": "2026-09-25T10:25:14.324Z",
"dateUpdated": "2026-10-19T09:15:26.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98217 (GCVE-0-2026-98217)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/mlx4: Fix use-after-free on pkey sysfs registration failure
register_pkey_tree() ignores errors from register_one_pkey_tree() and
continues registering the remaining slaves. The per-slave error path has
already released the pkey parent kobjects, but their pointers remain
stored in the device. A later device cleanup therefore passes the stale
pointers to kobject_put(), causing a use-after-free.
Clear the parent pointers after releasing a failed slave tree and skip
unregistered trees during device cleanup. This preserves the existing
best-effort registration behavior while preventing a second cleanup of
the failed tree.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c1e7e466120b80ce49e91af0c9da1ce6dee4844a Version: c1e7e466120b80ce49e91af0c9da1ce6dee4844a Version: c1e7e466120b80ce49e91af0c9da1ce6dee4844a Version: c1e7e466120b80ce49e91af0c9da1ce6dee4844a Version: c1e7e466120b80ce49e91af0c9da1ce6dee4844a Version: c1e7e466120b80ce49e91af0c9da1ce6dee4844a Version: c1e7e466120b80ce49e91af0c9da1ce6dee4844a Version: c1e7e466120b80ce49e91af0c9da1ce6dee4844a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mlx4/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "791471421d848ce13e84f4b21c9e19973d471c4e",
"status": "affected",
"version": "c1e7e466120b80ce49e91af0c9da1ce6dee4844a",
"versionType": "git"
},
{
"lessThan": "734f066933484f6c7cedea0312763249beed5845",
"status": "affected",
"version": "c1e7e466120b80ce49e91af0c9da1ce6dee4844a",
"versionType": "git"
},
{
"lessThan": "a07bee32127d7c4cd3b1bb9a088e21d0c93634c9",
"status": "affected",
"version": "c1e7e466120b80ce49e91af0c9da1ce6dee4844a",
"versionType": "git"
},
{
"lessThan": "cf20d7476754c00eec04ae23d3e929de33ce0345",
"status": "affected",
"version": "c1e7e466120b80ce49e91af0c9da1ce6dee4844a",
"versionType": "git"
},
{
"lessThan": "0c3482e965b18bc242e54e899d1c4d391ca8e5e3",
"status": "affected",
"version": "c1e7e466120b80ce49e91af0c9da1ce6dee4844a",
"versionType": "git"
},
{
"lessThan": "ffb80872617b5f9b3dd1536ec2909029fa66f228",
"status": "affected",
"version": "c1e7e466120b80ce49e91af0c9da1ce6dee4844a",
"versionType": "git"
},
{
"lessThan": "ced1186fea7c77e16681c7ef4802897885989c3b",
"status": "affected",
"version": "c1e7e466120b80ce49e91af0c9da1ce6dee4844a",
"versionType": "git"
},
{
"lessThan": "1af874e9f4ce22ccf8b10ab5462f32c70d3be21a",
"status": "affected",
"version": "c1e7e466120b80ce49e91af0c9da1ce6dee4844a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mlx4/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx4: Fix use-after-free on pkey sysfs registration failure\n\nregister_pkey_tree() ignores errors from register_one_pkey_tree() and\ncontinues registering the remaining slaves. The per-slave error path has\nalready released the pkey parent kobjects, but their pointers remain\nstored in the device. A later device cleanup therefore passes the stale\npointers to kobject_put(), causing a use-after-free.\n\nClear the parent pointers after releasing a failed slave tree and skip\nunregistered trees during device cleanup. This preserves the existing\nbest-effort registration behavior while preventing a second cleanup of\nthe failed tree."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:47.995Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/791471421d848ce13e84f4b21c9e19973d471c4e"
},
{
"url": "https://git.kernel.org/stable/c/734f066933484f6c7cedea0312763249beed5845"
},
{
"url": "https://git.kernel.org/stable/c/a07bee32127d7c4cd3b1bb9a088e21d0c93634c9"
},
{
"url": "https://git.kernel.org/stable/c/cf20d7476754c00eec04ae23d3e929de33ce0345"
},
{
"url": "https://git.kernel.org/stable/c/0c3482e965b18bc242e54e899d1c4d391ca8e5e3"
},
{
"url": "https://git.kernel.org/stable/c/ffb80872617b5f9b3dd1536ec2909029fa66f228"
},
{
"url": "https://git.kernel.org/stable/c/ced1186fea7c77e16681c7ef4802897885989c3b"
},
{
"url": "https://git.kernel.org/stable/c/1af874e9f4ce22ccf8b10ab5462f32c70d3be21a"
}
],
"title": "IB/mlx4: Fix use-after-free on pkey sysfs registration failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98217",
"datePublished": "2026-10-06T08:44:53.152Z",
"dateReserved": "2026-09-25T10:25:14.326Z",
"dateUpdated": "2026-10-19T09:15:47.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98265 (GCVE-0-2026-98265)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
data_ep_set_params() allocates each data URB for exactly u->packets
isochronous frames, so urb->iso_frame_desc[] has u->packets slots and
ctx->packets is the driver's only record of that limit. For an implicit
feedback sink, snd_usb_queue_pending_output_urbs() overwrites it with the
sync source's packet count, which is calculated independently from the
capture endpoint's parameters. When that count is larger,
prepare_playback_urb() and prepare_silent_urb() can write
iso_frame_desc[] past the allocation; their existing bounds limit payload
bytes, not the descriptor index.
The reproducer uses a high-speed UAC2 device declaring bInterval 1 for
implicit feedback capture (8 packets) and bInterval 4 for playback
(1 packet). On the first capture completion after the stream starts, it
accesses seven descriptors spanning 112 bytes beyond the one-packet URB:
BUG: KASAN: slab-out-of-bounds in prepare_playback_urb (sound/usb/pcm.c:1560)
Write of size 4 at addr ffff88801e696ad0 by task vhci_rx/178
prepare_playback_urb (sound/usb/pcm.c:1560)
prepare_outbound_urb (sound/usb/endpoint.c:340)
snd_usb_queue_pending_output_urbs (sound/usb/endpoint.c:501)
snd_complete_urb (sound/usb/endpoint.c:1834)
__usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)
usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)
vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107)
kthread (kernel/kthread.c:436)
The buggy address belongs to the object at ffff88801e696a00
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 0 bytes to the right of
allocated 208-byte region [ffff88801e696a00, ffff88801e696ad0)
Record the allocated packet count per endpoint and clamp both the adopted
count and the packet-size copy to it. Fold the Format Type II delimiter
into urb_packs before the allocation loop so the recorded limit matches
every URB.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c26bde6301f20d9aafbfb7c2459a88c6a6ec178f Version: 32a1f64f8ff6e2c5391f5964baec697bce25b83c Version: e949fd266cfa1dcca7caa3faa698578c4ffd26d6 Version: cf044e44190234a41a788de1cdbb6c21f4a52e1e Version: cf044e44190234a41a788de1cdbb6c21f4a52e1e Version: df75696e70c88b22ed1d8c9d515993a858c58fd0 Version: 3a74f6b46c01d9a816378cd83c327a59f61475ec Version: f6fbdf797e016fbf968dd54301026b182175985a Version: 6.6.128 ≤ Version: 6.12.75 ≤ Version: 6.18.16 ≤ Version: 5.15.202 ≤ Version: 6.1.165 ≤ Version: 6.19.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/card.h",
"sound/usb/endpoint.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8b637ab10e40e01b452f4aff66dad335a9b89a16",
"status": "affected",
"version": "c26bde6301f20d9aafbfb7c2459a88c6a6ec178f",
"versionType": "git"
},
{
"lessThan": "ad279ba0dc1781229f5b52f58d38d56960400e06",
"status": "affected",
"version": "32a1f64f8ff6e2c5391f5964baec697bce25b83c",
"versionType": "git"
},
{
"lessThan": "79c55a7b5d71cf2a6bbd4bd7698e1b10b70f813a",
"status": "affected",
"version": "e949fd266cfa1dcca7caa3faa698578c4ffd26d6",
"versionType": "git"
},
{
"lessThan": "ab77e3f453c5f2499c08d6e8e218501d25bab39e",
"status": "affected",
"version": "cf044e44190234a41a788de1cdbb6c21f4a52e1e",
"versionType": "git"
},
{
"lessThan": "76a986c980bb502c7688d605ac7a67fd257a9a1b",
"status": "affected",
"version": "cf044e44190234a41a788de1cdbb6c21f4a52e1e",
"versionType": "git"
},
{
"status": "affected",
"version": "df75696e70c88b22ed1d8c9d515993a858c58fd0",
"versionType": "git"
},
{
"status": "affected",
"version": "3a74f6b46c01d9a816378cd83c327a59f61475ec",
"versionType": "git"
},
{
"status": "affected",
"version": "f6fbdf797e016fbf968dd54301026b182175985a",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThan": "6.18.54",
"status": "affected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/card.h",
"sound/usb/endpoint.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.128",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.18.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.202",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.165",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Clamp implicit feedback packet count to URB capacity\n\ndata_ep_set_params() allocates each data URB for exactly u-\u003epackets\nisochronous frames, so urb-\u003eiso_frame_desc[] has u-\u003epackets slots and\nctx-\u003epackets is the driver\u0027s only record of that limit. For an implicit\nfeedback sink, snd_usb_queue_pending_output_urbs() overwrites it with the\nsync source\u0027s packet count, which is calculated independently from the\ncapture endpoint\u0027s parameters. When that count is larger,\nprepare_playback_urb() and prepare_silent_urb() can write\niso_frame_desc[] past the allocation; their existing bounds limit payload\nbytes, not the descriptor index.\n\nThe reproducer uses a high-speed UAC2 device declaring bInterval 1 for\nimplicit feedback capture (8 packets) and bInterval 4 for playback\n(1 packet). On the first capture completion after the stream starts, it\naccesses seven descriptors spanning 112 bytes beyond the one-packet URB:\n\n BUG: KASAN: slab-out-of-bounds in prepare_playback_urb (sound/usb/pcm.c:1560)\n Write of size 4 at addr ffff88801e696ad0 by task vhci_rx/178\n prepare_playback_urb (sound/usb/pcm.c:1560)\n prepare_outbound_urb (sound/usb/endpoint.c:340)\n snd_usb_queue_pending_output_urbs (sound/usb/endpoint.c:501)\n snd_complete_urb (sound/usb/endpoint.c:1834)\n __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)\n usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)\n vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107)\n kthread (kernel/kthread.c:436)\n The buggy address belongs to the object at ffff88801e696a00\n which belongs to the cache kmalloc-256 of size 256\n The buggy address is located 0 bytes to the right of\n allocated 208-byte region [ffff88801e696a00, ffff88801e696ad0)\n\nRecord the allocated packet count per endpoint and clamp both the adopted\ncount and the packet-size copy to it. Fold the Format Type II delimiter\ninto urb_packs before the allocation loop so the recorded limit matches\nevery URB."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:54.873Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8b637ab10e40e01b452f4aff66dad335a9b89a16"
},
{
"url": "https://git.kernel.org/stable/c/ad279ba0dc1781229f5b52f58d38d56960400e06"
},
{
"url": "https://git.kernel.org/stable/c/79c55a7b5d71cf2a6bbd4bd7698e1b10b70f813a"
},
{
"url": "https://git.kernel.org/stable/c/ab77e3f453c5f2499c08d6e8e218501d25bab39e"
},
{
"url": "https://git.kernel.org/stable/c/76a986c980bb502c7688d605ac7a67fd257a9a1b"
}
],
"title": "ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98265",
"datePublished": "2026-10-06T08:45:28.438Z",
"dateReserved": "2026-09-25T10:25:14.333Z",
"dateUpdated": "2026-10-21T12:54:54.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97609 (GCVE-0-2026-97609)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: cttimeout: prevent UAF during module unload
nf_ct_set_timeout() protects the timeout hook dereference and policy lookup
with rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net
operations before it clears the hook.
This allows the following interleaving:
CPU 0 CPU 1
cttimeout_exit() nf_ct_set_timeout()
unregister_pernet_subsys() rcu_read_lock()
kfree(pernet) h = nf_ct_timeout_hook
h->timeout_find_get()
nfct_timeout_pernet()
The hook still points to ctnl_timeout_find_get() when CPU 1 looks up the
already freed per-net timeout list. KASAN reported:
BUG: KASAN: slab-use-after-free in ctnl_timeout_find_get
Read of size 8 by task poc/90
Call Trace:
ctnl_timeout_find_get+0x271/0x2a0 [nfnetlink_cttimeout]
nf_ct_set_timeout+0x7b/0x3c0
xt_ct_tg_check+0x724/0xb20
xt_check_target+0x234/0xa90
do_ipt_set_ctl+0x570/0x1270
Allocated by task 89:
__kmalloc_noprof+0x16e/0x460
ops_init+0x6d/0x420
register_pernet_operations+0x2f6/0x670
Freed by task 91:
kfree+0x131/0x390
ops_undo_list+0x3d4/0x730
unregister_pernet_operations+0x232/0x490
unregister_pernet_subsys+0x1c/0x30
cttimeout_exit+0x52/0x970 [nfnetlink_cttimeout]
Clear the hook and wait for existing readers before unregistering the
per-net operations. This blocks new policy lookups and ensures readers that
observed the hook finish before the per-net storage is freed.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_cttimeout.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f664e06699829a31e95675a6864655a6c5f9904f",
"status": "affected",
"version": "ebfbe67568a734a449203097b02c4ab884257535",
"versionType": "git"
},
{
"lessThan": "73f353bec62509c776184e49a031c6145cec0d05",
"status": "affected",
"version": "ebfbe67568a734a449203097b02c4ab884257535",
"versionType": "git"
},
{
"lessThan": "a7fdd86c386b7f7cc72a126389c2cdb55d035221",
"status": "affected",
"version": "ebfbe67568a734a449203097b02c4ab884257535",
"versionType": "git"
},
{
"lessThan": "1f69c570a73f2dedf75ea5166d47622d5fa958c1",
"status": "affected",
"version": "ebfbe67568a734a449203097b02c4ab884257535",
"versionType": "git"
},
{
"lessThan": "fec9b1de0d02de8dafa3cc344bcb91cf28660643",
"status": "affected",
"version": "ebfbe67568a734a449203097b02c4ab884257535",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_cttimeout.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: cttimeout: prevent UAF during module unload\n\nnf_ct_set_timeout() protects the timeout hook dereference and policy lookup\nwith rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net\noperations before it clears the hook.\n\nThis allows the following interleaving:\n\n CPU 0 CPU 1\n cttimeout_exit() nf_ct_set_timeout()\n unregister_pernet_subsys() rcu_read_lock()\n kfree(pernet) h = nf_ct_timeout_hook\n h-\u003etimeout_find_get()\n nfct_timeout_pernet()\n\nThe hook still points to ctnl_timeout_find_get() when CPU 1 looks up the\nalready freed per-net timeout list. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in ctnl_timeout_find_get\n Read of size 8 by task poc/90\n Call Trace:\n ctnl_timeout_find_get+0x271/0x2a0 [nfnetlink_cttimeout]\n nf_ct_set_timeout+0x7b/0x3c0\n xt_ct_tg_check+0x724/0xb20\n xt_check_target+0x234/0xa90\n do_ipt_set_ctl+0x570/0x1270\n Allocated by task 89:\n __kmalloc_noprof+0x16e/0x460\n ops_init+0x6d/0x420\n register_pernet_operations+0x2f6/0x670\n Freed by task 91:\n kfree+0x131/0x390\n ops_undo_list+0x3d4/0x730\n unregister_pernet_operations+0x232/0x490\n unregister_pernet_subsys+0x1c/0x30\n cttimeout_exit+0x52/0x970 [nfnetlink_cttimeout]\n\nClear the hook and wait for existing readers before unregistering the\nper-net operations. This blocks new policy lookups and ensures readers that\nobserved the hook finish before the per-net storage is freed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The reader that hits freed memory is reached only by a local setsockopt: do_ipt_set_ctl() -\u003e xt_ct_tg_check() -\u003e nf_ct_set_timeout() -\u003e ctnl_timeout_find_get(), installing an iptables CT target with a timeout policy. No packet from a remote peer carries data into this path.\nAC:H - The free happens only when cttimeout_exit() runs, i.e. an admin unloading nfnetlink_cttimeout. The attacker must hit the short window between unregister_pernet_subsys() freeing the per-net list and RCU_INIT_POINTER(nf_ct_timeout_hook, NULL). An unprivileged attacker cannot cause that unload.\nPR:L - The racing side needs only CAP_NET_ADMIN over the netns, which an unprivileged user gets via unshare -Urn and then installs a CT --timeout rule through iptables set_ctl. The unload is the admin\u0027s action, not a privilege the attacker must hold.\nUI:N - No victim has to open, mount or run anything on the attacker\u0027s behalf. The attacker only needs to be running its setsockopt loop while the module unload happens (already counted in AC:H).\nS:U - The use-after-free is in kernel heap memory (the nfct_timeout_pernet list head) inside the same kernel security authority. No VM or hardware isolation boundary is crossed.\nC:H - ctnl_timeout_find_get() walks nfct_timeout_list inside the freed per-net storage. If that memory is reallocated with attacker data, the walk follows a fake list to a fake ctnl_timeout, and that pointer is returned to nf_ct_set_timeout(), enabling reads of kernel memory.\nI:H - Following a forged list entry, the code increments a refcount on the attacker-chosen object and stores the returned nf_ct_timeout pointer in the conntrack template\u0027s timeout extension. That gives a write primitive and a controlled object pointer that can be used for memory corruption.\nA:H - Dereferencing freed per-net memory in ctnl_timeout_find_get() produces a KASAN slab-use-after-free (shown in the fix commit), and on production kernels can oops or corrupt the heap and crash the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:26.912Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f664e06699829a31e95675a6864655a6c5f9904f"
},
{
"url": "https://git.kernel.org/stable/c/73f353bec62509c776184e49a031c6145cec0d05"
},
{
"url": "https://git.kernel.org/stable/c/a7fdd86c386b7f7cc72a126389c2cdb55d035221"
},
{
"url": "https://git.kernel.org/stable/c/1f69c570a73f2dedf75ea5166d47622d5fa958c1"
},
{
"url": "https://git.kernel.org/stable/c/fec9b1de0d02de8dafa3cc344bcb91cf28660643"
}
],
"title": "netfilter: cttimeout: prevent UAF during module unload",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97609",
"datePublished": "2026-09-25T10:22:19.627Z",
"dateReserved": "2026-09-24T16:01:01.158Z",
"dateUpdated": "2026-10-21T12:53:26.912Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98192 (GCVE-0-2026-98192)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-21 12:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
wcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(),
which only dequeues the timer and does not wait for a callback that is
already executing; the preceding free_irq() calls synchronize the
interrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can
therefore be running past the teardown and use the wcn freed along
with the ieee80211_hw in wcn36xx_remove(): it takes wcn->dxe_lock,
reads wcn->tx_ack_skb and passes wcn->hw to
ieee80211_tx_status_irqsafe().
Fix this by using timer_shutdown_sync(), which waits for a running
callback and also prevents the timer from being rearmed again. The
timer is set up again by wcn36xx_dxe_init() on the next start, so the
start/stop cycle is unaffected.
This issue was found by an in-house static analysis tool.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/wcn36xx/dxe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "15e59e377facc87ce82228279d88efaa89fdbca5",
"status": "affected",
"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31",
"versionType": "git"
},
{
"lessThan": "3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd",
"status": "affected",
"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31",
"versionType": "git"
},
{
"lessThan": "2bddc5d088cf430ecd913020472f1def32a36a3d",
"status": "affected",
"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31",
"versionType": "git"
},
{
"lessThan": "c0df0878e9110909cf0bec6080d72d36401a0c89",
"status": "affected",
"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31",
"versionType": "git"
},
{
"lessThan": "d9be5e75530772fc31637070d51e5717d6aeaa2a",
"status": "affected",
"version": "fdf21cc3714939dd4327f3d664fe5863d15ccb31",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/wcn36xx/dxe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown\n\nwcn36xx_dxe_deinit() tears down the TX ack timer with timer_delete(),\nwhich only dequeues the timer and does not wait for a callback that is\nalready executing; the preceding free_irq() calls synchronize the\ninterrupt handlers only. The callback, wcn36xx_dxe_tx_timer(), can\ntherefore be running past the teardown and use the wcn freed along\nwith the ieee80211_hw in wcn36xx_remove(): it takes wcn-\u003edxe_lock,\nreads wcn-\u003etx_ack_skb and passes wcn-\u003ehw to\nieee80211_tx_status_irqsafe().\n\nFix this by using timer_shutdown_sync(), which waits for a running\ncallback and also prevents the timer from being rearmed again. The\ntimer is set up again by wcn36xx_dxe_init() on the next start, so the\nstart/stop cycle is unaffected.\n\nThis issue was found by an in-house static analysis tool."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:54:50.525Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/15e59e377facc87ce82228279d88efaa89fdbca5"
},
{
"url": "https://git.kernel.org/stable/c/3edabc965bcce49cbb2ec1c2b91f8a555a8ec8bd"
},
{
"url": "https://git.kernel.org/stable/c/2bddc5d088cf430ecd913020472f1def32a36a3d"
},
{
"url": "https://git.kernel.org/stable/c/c0df0878e9110909cf0bec6080d72d36401a0c89"
},
{
"url": "https://git.kernel.org/stable/c/d9be5e75530772fc31637070d51e5717d6aeaa2a"
}
],
"title": "wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98192",
"datePublished": "2026-10-06T08:44:32.912Z",
"dateReserved": "2026-09-25T10:25:14.323Z",
"dateUpdated": "2026-10-21T12:54:50.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97935 (GCVE-0-2026-97935)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Set the trace clock before registering the histogram trigger
hist_register_trigger() puts the trigger on the global named_triggers
list in cmd_ops->init(), and only then sets the trace clock:
if (data->cmd_ops->init) {
ret = data->cmd_ops->init(data);
if (ret < 0)
goto out;
}
if (hist_data->enable_timestamps) {
ret = tracing_set_clock(file->tr, hist_data->attrs->clock);
if (ret) {
hist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock));
goto out;
}
The clock string is not checked anywhere before that call, so a named
trigger using common_timestamp with an unknown clock fails after it has
already become findable. event_hist_trigger_parse() then frees it
without taking it off the list, and the next lookup by name reads the
freed object:
~# cd /sys/kernel/tracing/events/sched/sched_switch
~# echo 'hist:name=foo:keys=common_pid:ts=common_timestamp:clock=bogus' > trigger
bash: echo: write error: Invalid argument
~# echo 'hist:name=foo:keys=common_pid' > trigger
BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0
Read of size 8 at addr ffff88800915d760 by task init/1
find_named_trigger+0xac/0xc0
hist_register_trigger+0xc1/0x900
event_hist_trigger_parse+0x3146/0x6af0
event_trigger_write+0xce/0x160
Freed by task 63:
kfree+0x154/0x420
trigger_kthread_fn+0xfd/0x160
Set the clock before the trigger is registered, so that nothing which
can fail runs after it is published, the way commit 6f86bdeab633
("tracing: Fix bad hist from corrupting named_triggers list") moved the
registration below the rest of the setup.
tracing_set_filter_buffering() is reference counted, so the init failure
path has to drop the reference that the clock block now takes first.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "578d39ab420b18b76a12fc8d0573ec041a84da28",
"status": "affected",
"version": "a4072fe85ba3671720cab0788291af953db27318",
"versionType": "git"
},
{
"lessThan": "cc6c4cf565b0c187c61ffd2e67a4dfb2427675ad",
"status": "affected",
"version": "a4072fe85ba3671720cab0788291af953db27318",
"versionType": "git"
},
{
"lessThan": "cfad128171f8e2237a3c723d6478ef2cfb3b9127",
"status": "affected",
"version": "a4072fe85ba3671720cab0788291af953db27318",
"versionType": "git"
},
{
"lessThan": "65d1e28198f344832a8a63e8ccf84b8f65b92a32",
"status": "affected",
"version": "a4072fe85ba3671720cab0788291af953db27318",
"versionType": "git"
},
{
"lessThan": "6ede78d0563a2a3ae3e46f9c07cedb5d79645429",
"status": "affected",
"version": "a4072fe85ba3671720cab0788291af953db27318",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Set the trace clock before registering the histogram trigger\n\nhist_register_trigger() puts the trigger on the global named_triggers\nlist in cmd_ops-\u003einit(), and only then sets the trace clock:\n\n\tif (data-\u003ecmd_ops-\u003einit) {\n\t\tret = data-\u003ecmd_ops-\u003einit(data);\n\t\tif (ret \u003c 0)\n\t\t\tgoto out;\n\t}\n\n\tif (hist_data-\u003eenable_timestamps) {\n\t\tret = tracing_set_clock(file-\u003etr, hist_data-\u003eattrs-\u003eclock);\n\t\tif (ret) {\n\t\t\thist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock));\n\t\t\tgoto out;\n\t\t}\n\nThe clock string is not checked anywhere before that call, so a named\ntrigger using common_timestamp with an unknown clock fails after it has\nalready become findable. event_hist_trigger_parse() then frees it\nwithout taking it off the list, and the next lookup by name reads the\nfreed object:\n\n ~# cd /sys/kernel/tracing/events/sched/sched_switch\n ~# echo \u0027hist:name=foo:keys=common_pid:ts=common_timestamp:clock=bogus\u0027 \u003e trigger\n bash: echo: write error: Invalid argument\n ~# echo \u0027hist:name=foo:keys=common_pid\u0027 \u003e trigger\n\n BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n Read of size 8 at addr ffff88800915d760 by task init/1\n find_named_trigger+0xac/0xc0\n hist_register_trigger+0xc1/0x900\n event_hist_trigger_parse+0x3146/0x6af0\n event_trigger_write+0xce/0x160\n Freed by task 63:\n kfree+0x154/0x420\n trigger_kthread_fn+0xfd/0x160\n\nSet the clock before the trigger is registered, so that nothing which\ncan fail runs after it is published, the way commit 6f86bdeab633\n(\"tracing: Fix bad hist from corrupting named_triggers list\") moved the\nregistration below the rest of the setup.\n\ntracing_set_filter_buffering() is reference counted, so the init failure\npath has to drop the reference that the clock block now takes first."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:44.309Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/578d39ab420b18b76a12fc8d0573ec041a84da28"
},
{
"url": "https://git.kernel.org/stable/c/cc6c4cf565b0c187c61ffd2e67a4dfb2427675ad"
},
{
"url": "https://git.kernel.org/stable/c/cfad128171f8e2237a3c723d6478ef2cfb3b9127"
},
{
"url": "https://git.kernel.org/stable/c/65d1e28198f344832a8a63e8ccf84b8f65b92a32"
},
{
"url": "https://git.kernel.org/stable/c/6ede78d0563a2a3ae3e46f9c07cedb5d79645429"
}
],
"title": "tracing: Set the trace clock before registering the histogram trigger",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97935",
"datePublished": "2026-09-25T10:22:49.820Z",
"dateReserved": "2026-09-25T10:18:58.203Z",
"dateUpdated": "2026-10-21T12:53:44.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98194 (GCVE-0-2026-98194)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: libertas_tf: fix UAF in lbtf_free_adapter()
lbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command
buffers before calling timer_delete_sync() to wait for the command
timer callback. If the timer callback (command_timer_fn) is already
running when lbtf_free_cmd_buffer() frees the command array, the
callback dereferences priv->cur_cmd->cmdbuf which points to freed
memory.
Swap the order so that timer_delete_sync() runs first, ensuring any
in-flight callback has completed before the command buffers are freed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 06b16ae5319251c26377afcb401e46056d5673f4 Version: 06b16ae5319251c26377afcb401e46056d5673f4 Version: 06b16ae5319251c26377afcb401e46056d5673f4 Version: 06b16ae5319251c26377afcb401e46056d5673f4 Version: 06b16ae5319251c26377afcb401e46056d5673f4 Version: 06b16ae5319251c26377afcb401e46056d5673f4 Version: 06b16ae5319251c26377afcb401e46056d5673f4 Version: 06b16ae5319251c26377afcb401e46056d5673f4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/libertas_tf/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3fb3663260ec396f86b733aab9f81fac6669d2fa",
"status": "affected",
"version": "06b16ae5319251c26377afcb401e46056d5673f4",
"versionType": "git"
},
{
"lessThan": "f6c3fa0d17ca0c9e6033bb45f52e33b27a9a40e6",
"status": "affected",
"version": "06b16ae5319251c26377afcb401e46056d5673f4",
"versionType": "git"
},
{
"lessThan": "b4745d6063758c681d33affca9733bbd356b6ea1",
"status": "affected",
"version": "06b16ae5319251c26377afcb401e46056d5673f4",
"versionType": "git"
},
{
"lessThan": "41b1a4d545ec348b7d5324b6d4f4c6a3e0326d46",
"status": "affected",
"version": "06b16ae5319251c26377afcb401e46056d5673f4",
"versionType": "git"
},
{
"lessThan": "2b99bfc5a127ce8cd6a887d82815fc2e712f365b",
"status": "affected",
"version": "06b16ae5319251c26377afcb401e46056d5673f4",
"versionType": "git"
},
{
"lessThan": "e82536aad653e27c8ca7a8e0f6f816bc3f853ec3",
"status": "affected",
"version": "06b16ae5319251c26377afcb401e46056d5673f4",
"versionType": "git"
},
{
"lessThan": "04c837d413dc11a91e0275b08b9e35a6c111175e",
"status": "affected",
"version": "06b16ae5319251c26377afcb401e46056d5673f4",
"versionType": "git"
},
{
"lessThan": "bbb9a0ab96d44a64529aafc7a16de460a1712f6a",
"status": "affected",
"version": "06b16ae5319251c26377afcb401e46056d5673f4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/libertas_tf/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.28"
},
{
"lessThan": "2.6.28",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas_tf: fix UAF in lbtf_free_adapter()\n\nlbtf_free_adapter() calls lbtf_free_cmd_buffer() to free the command\nbuffers before calling timer_delete_sync() to wait for the command\ntimer callback. If the timer callback (command_timer_fn) is already\nrunning when lbtf_free_cmd_buffer() frees the command array, the\ncallback dereferences priv-\u003ecur_cmd-\u003ecmdbuf which points to freed\nmemory.\n\nSwap the order so that timer_delete_sync() runs first, ensuring any\nin-flight callback has completed before the command buffers are freed."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:25.503Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3fb3663260ec396f86b733aab9f81fac6669d2fa"
},
{
"url": "https://git.kernel.org/stable/c/f6c3fa0d17ca0c9e6033bb45f52e33b27a9a40e6"
},
{
"url": "https://git.kernel.org/stable/c/b4745d6063758c681d33affca9733bbd356b6ea1"
},
{
"url": "https://git.kernel.org/stable/c/41b1a4d545ec348b7d5324b6d4f4c6a3e0326d46"
},
{
"url": "https://git.kernel.org/stable/c/2b99bfc5a127ce8cd6a887d82815fc2e712f365b"
},
{
"url": "https://git.kernel.org/stable/c/e82536aad653e27c8ca7a8e0f6f816bc3f853ec3"
},
{
"url": "https://git.kernel.org/stable/c/04c837d413dc11a91e0275b08b9e35a6c111175e"
},
{
"url": "https://git.kernel.org/stable/c/bbb9a0ab96d44a64529aafc7a16de460a1712f6a"
}
],
"title": "wifi: libertas_tf: fix UAF in lbtf_free_adapter()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98194",
"datePublished": "2026-10-06T08:44:34.253Z",
"dateReserved": "2026-09-25T10:25:14.324Z",
"dateUpdated": "2026-10-19T09:15:25.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97535 (GCVE-0-2026-97535)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
The VP control IOCB selects its target virtual port by setting one bit
in vp_idx_map, a fixed 16-byte (128-bit) array in both
vp_ctrl_entry_24xx and vp_ctrl_entry_24xx_ext. qla25xx_ctrlvp_iocb()
computes map = (vp_index - 1) / 8 and writes vce->vp_idx_map[map]
without checking that map stays within the array.
max_npiv_vports is taken from firmware and only sanitized to a
MIN_MULTI_ID_FABRIC-aligned boundary, so it can legitimately be 191 or
255, and qla24xx_control_vp() only rejects vp_index >= max_npiv_vports.
A vp_index above 128 therefore yields map >= 16 and an out-of-bounds
write of up to 16 bytes past vp_idx_map, corrupting the trailing IOCB
fields (or the adjacent request-ring slot on the 64-byte layout).
Reject a vp_index that cannot be represented in the IOCB bitmap in
qla24xx_control_vp(), and add a defensive ARRAY_SIZE() guard in
qla25xx_ctrlvp_iocb() before the write. Adapters that report the usual
63 or 127 NPIV vports are unaffected.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_iocb.c",
"drivers/scsi/qla2xxx/qla_mid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "674d783f2e80d0d7c1c86bf36dc0a09033e704de",
"status": "affected",
"version": "2853192e154b813fe34a6cbee5e34dfef50d29d0",
"versionType": "git"
},
{
"lessThan": "c80a0362a0fe548c15a0324b1f61c04b62bb2174",
"status": "affected",
"version": "2853192e154b813fe34a6cbee5e34dfef50d29d0",
"versionType": "git"
},
{
"lessThan": "48a44e19746eaa70320a3c2571dcb345192fca72",
"status": "affected",
"version": "2853192e154b813fe34a6cbee5e34dfef50d29d0",
"versionType": "git"
},
{
"lessThan": "13354ad251ab009102597a791bc7c4d2265229e1",
"status": "affected",
"version": "2853192e154b813fe34a6cbee5e34dfef50d29d0",
"versionType": "git"
},
{
"lessThan": "878613ecb5a36db26859c4fd83daf9283a334fa2",
"status": "affected",
"version": "2853192e154b813fe34a6cbee5e34dfef50d29d0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_iocb.c",
"drivers/scsi/qla2xxx/qla_mid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size\n\nThe VP control IOCB selects its target virtual port by setting one bit\nin vp_idx_map, a fixed 16-byte (128-bit) array in both\nvp_ctrl_entry_24xx and vp_ctrl_entry_24xx_ext. qla25xx_ctrlvp_iocb()\ncomputes map = (vp_index - 1) / 8 and writes vce-\u003evp_idx_map[map]\nwithout checking that map stays within the array.\n\nmax_npiv_vports is taken from firmware and only sanitized to a\nMIN_MULTI_ID_FABRIC-aligned boundary, so it can legitimately be 191 or\n255, and qla24xx_control_vp() only rejects vp_index \u003e= max_npiv_vports.\nA vp_index above 128 therefore yields map \u003e= 16 and an out-of-bounds\nwrite of up to 16 bytes past vp_idx_map, corrupting the trailing IOCB\nfields (or the adjacent request-ring slot on the 64-byte layout).\n\nReject a vp_index that cannot be represented in the IOCB bitmap in\nqla24xx_control_vp(), and add a defensive ARRAY_SIZE() guard in\nqla25xx_ctrlvp_iocb() before the write. Adapters that report the usual\n63 or 127 NPIV vports are unaffected."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:10.511Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/674d783f2e80d0d7c1c86bf36dc0a09033e704de"
},
{
"url": "https://git.kernel.org/stable/c/c80a0362a0fe548c15a0324b1f61c04b62bb2174"
},
{
"url": "https://git.kernel.org/stable/c/48a44e19746eaa70320a3c2571dcb345192fca72"
},
{
"url": "https://git.kernel.org/stable/c/13354ad251ab009102597a791bc7c4d2265229e1"
},
{
"url": "https://git.kernel.org/stable/c/878613ecb5a36db26859c4fd83daf9283a334fa2"
}
],
"title": "scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97535",
"datePublished": "2026-09-25T10:21:34.395Z",
"dateReserved": "2026-09-24T16:01:01.153Z",
"dateUpdated": "2026-10-21T12:53:10.511Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98403 (GCVE-0-2026-98403)
Vulnerability from cvelistv5
Published
2026-10-14 13:26
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/boot: Avoid IPL parameter append past command line
A command line may occupy all but the terminating byte of
COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size
to the IPL parameter conversion helpers and points the destination one
byte past early_command_line. The helpers subtract one from the unsigned
size and write the converted parameter outside the command line buffer.
Convert the IPL parameter in the command line parsing buffer first. A
parameter beginning with '=' can then replace the existing command line
regardless of its length, while other parameters are appended only when
space remains.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/boot/ipl_parm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af9866021a00ab9eeacf0c33ee73f3d134b4ed70",
"status": "affected",
"version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
"versionType": "git"
},
{
"lessThan": "73eec5a0d55916d7e1115f5d03a7ffc06d6215cf",
"status": "affected",
"version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
"versionType": "git"
},
{
"lessThan": "8d11bfec8666f8409fac9072e9c25b691d3e30ac",
"status": "affected",
"version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
"versionType": "git"
},
{
"lessThan": "d76181dfabdaa720703167393704efacba343442",
"status": "affected",
"version": "5ecb2da660ab8eddafe059a6a8a708465db89ca2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/boot/ipl_parm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/boot: Avoid IPL parameter append past command line\n\nA command line may occupy all but the terminating byte of\nCOMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size\nto the IPL parameter conversion helpers and points the destination one\nbyte past early_command_line. The helpers subtract one from the unsigned\nsize and write the converted parameter outside the command line buffer.\n\nConvert the IPL parameter in the command line parsing buffer first. A\nparameter beginning with \u0027=\u0027 can then replace the existing command line\nregardless of its length, while other parameters are appended only when\nspace remains."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:56.682Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af9866021a00ab9eeacf0c33ee73f3d134b4ed70"
},
{
"url": "https://git.kernel.org/stable/c/73eec5a0d55916d7e1115f5d03a7ffc06d6215cf"
},
{
"url": "https://git.kernel.org/stable/c/8d11bfec8666f8409fac9072e9c25b691d3e30ac"
},
{
"url": "https://git.kernel.org/stable/c/d76181dfabdaa720703167393704efacba343442"
}
],
"title": "s390/boot: Avoid IPL parameter append past command line",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98403",
"datePublished": "2026-10-14T13:26:02.916Z",
"dateReserved": "2026-09-25T10:25:14.347Z",
"dateUpdated": "2026-10-19T09:18:56.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98428 (GCVE-0-2026-98428)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-26 06:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb: 6fire: Avoid embedded URBs
The USB 6fire driver uses URBs embedded in different structs for PCM,
MIDI and communication, and this is basically a buggy implementation
nowadays; since a URB is managed with a refcount, this may lead to a
UAF when the URB is released asynchronously.
For addressing the problem, this patch converts those embedded URBs to
ones that are properly allocated via usb_alloc_urb(). The
pcm_urb.packets[] is gone, as it's allocated by usb_alloc_urb(), hence
it's found in urb.iso_frame_desc[] instead.
The conversions are rather straightforward; each embedded struct urb
is changed to a pointer, and its callers are updated accordingly.
The resource for those structs are released in the common destructor
functions (usb6fire_comm_free(), etc), which are called at both the
init error path and the disconnect.
No functional changes, only compile-tested.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 Version: c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 Version: c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 Version: c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 Version: c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 Version: c6d43ba816d1cf1d125bfbfc938f2a28a87facf9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/6fire/comm.c",
"sound/usb/6fire/comm.h",
"sound/usb/6fire/midi.c",
"sound/usb/6fire/midi.h",
"sound/usb/6fire/pcm.c",
"sound/usb/6fire/pcm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a",
"status": "affected",
"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
"versionType": "git"
},
{
"lessThan": "8b8559aeaba2e51cfee1779b2383b085991f7d81",
"status": "affected",
"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
"versionType": "git"
},
{
"lessThan": "52a43c2d57e774489ac3fbbac06ff02f19bd9a52",
"status": "affected",
"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
"versionType": "git"
},
{
"lessThan": "999f433c09e4668412bd68ca207ae2b4af863862",
"status": "affected",
"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
"versionType": "git"
},
{
"lessThan": "d181434549b3da668110a25d743848cce9897f4e",
"status": "affected",
"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
"versionType": "git"
},
{
"lessThan": "9fe49dbc023e82dfaee7b245997d820d01742a9a",
"status": "affected",
"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/6fire/comm.c",
"sound/usb/6fire/comm.h",
"sound/usb/6fire/midi.c",
"sound/usb/6fire/midi.h",
"sound/usb/6fire/pcm.c",
"sound/usb/6fire/pcm.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.39"
},
{
"lessThan": "2.6.39",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.39",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb: 6fire: Avoid embedded URBs\n\nThe USB 6fire driver uses URBs embedded in different structs for PCM,\nMIDI and communication, and this is basically a buggy implementation\nnowadays; since a URB is managed with a refcount, this may lead to a\nUAF when the URB is released asynchronously.\n\nFor addressing the problem, this patch converts those embedded URBs to\nones that are properly allocated via usb_alloc_urb(). The\npcm_urb.packets[] is gone, as it\u0027s allocated by usb_alloc_urb(), hence\nit\u0027s found in urb.iso_frame_desc[] instead.\n\nThe conversions are rather straightforward; each embedded struct urb\nis changed to a pointer, and its callers are updated accordingly.\nThe resource for those structs are released in the common destructor\nfunctions (usb6fire_comm_free(), etc), which are called at both the\ninit error path and the disconnect.\n\nNo functional changes, only compile-tested."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T06:55:43.958Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3ef9093d83ffecb8e5f6c9d5769a52d39df74f7a"
},
{
"url": "https://git.kernel.org/stable/c/8b8559aeaba2e51cfee1779b2383b085991f7d81"
},
{
"url": "https://git.kernel.org/stable/c/52a43c2d57e774489ac3fbbac06ff02f19bd9a52"
},
{
"url": "https://git.kernel.org/stable/c/999f433c09e4668412bd68ca207ae2b4af863862"
},
{
"url": "https://git.kernel.org/stable/c/d181434549b3da668110a25d743848cce9897f4e"
},
{
"url": "https://git.kernel.org/stable/c/9fe49dbc023e82dfaee7b245997d820d01742a9a"
}
],
"title": "ALSA: usb: 6fire: Avoid embedded URBs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98428",
"datePublished": "2026-10-14T13:27:54.364Z",
"dateReserved": "2026-09-25T10:25:14.348Z",
"dateUpdated": "2026-10-26T06:55:43.958Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98370 (GCVE-0-2026-98370)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix compat ALLOCSPI request use-after-free
xfrm_state_netlink() builds the ALLOCSPI response with
dump_one_state(), which already calls alloc_compat() with the response
skb and header.
xfrm_alloc_userspi() then calls alloc_compat() again, but passes the
original request skb and its header. For a compat request, the
translator therefore interprets the 228-byte compat xfrm_userspi_info
as the 232-byte native layout and reads four bytes past the declared
payload. It also publishes the translated child through the request's
frag_list.
A multicast clone of the request shares skb_shared_info and can observe
that child. xfrm_user_rcv_msg() frees it after the request handler
returns, racing a compat receiver which may still be copying from it and
resulting in a use-after-free.
Remove the redundant conversion. The response keeps its correct compat
translation from dump_one_state(), and no child is attached to the
inbound request.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 Version: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 Version: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 Version: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 Version: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 Version: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 Version: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 Version: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "494f2bee9d8d0ebcfa249ac41bed7fed26d119b4",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "17893987e52918c23945c42e47e894a936305a25",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "bb63ab52a18273ec68340ac49aebbaa7b514ccd5",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "248433942155b42a0ef04a5806c8aca024ea7c33",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "e70f639aee2ff0def155c256cace9e0f81d998e2",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
},
{
"lessThan": "d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320",
"status": "affected",
"version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix compat ALLOCSPI request use-after-free\n\nxfrm_state_netlink() builds the ALLOCSPI response with\ndump_one_state(), which already calls alloc_compat() with the response\nskb and header.\n\nxfrm_alloc_userspi() then calls alloc_compat() again, but passes the\noriginal request skb and its header. For a compat request, the\ntranslator therefore interprets the 228-byte compat xfrm_userspi_info\nas the 232-byte native layout and reads four bytes past the declared\npayload. It also publishes the translated child through the request\u0027s\nfrag_list.\n\nA multicast clone of the request shares skb_shared_info and can observe\nthat child. xfrm_user_rcv_msg() frees it after the request handler\nreturns, racing a compat receiver which may still be copying from it and\nresulting in a use-after-free.\n\nRemove the redundant conversion. The response keeps its correct compat\ntranslation from dump_one_state(), and no child is attached to the\ninbound request."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:22.245Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/494f2bee9d8d0ebcfa249ac41bed7fed26d119b4"
},
{
"url": "https://git.kernel.org/stable/c/17893987e52918c23945c42e47e894a936305a25"
},
{
"url": "https://git.kernel.org/stable/c/42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810"
},
{
"url": "https://git.kernel.org/stable/c/2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718"
},
{
"url": "https://git.kernel.org/stable/c/bb63ab52a18273ec68340ac49aebbaa7b514ccd5"
},
{
"url": "https://git.kernel.org/stable/c/248433942155b42a0ef04a5806c8aca024ea7c33"
},
{
"url": "https://git.kernel.org/stable/c/e70f639aee2ff0def155c256cace9e0f81d998e2"
},
{
"url": "https://git.kernel.org/stable/c/d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320"
}
],
"title": "xfrm: fix compat ALLOCSPI request use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98370",
"datePublished": "2026-10-06T08:46:54.981Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:22.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90146 (GCVE-0-2026-90146)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-21 12:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, xdp: move offload check into dev_xdp_install()
bpf_xdp_link_update() calls dev_xdp_install() directly and skips
dev_xdp_attach(), so the checks in dev_xdp_attach() do not run. A user can
make an XDP link with a normal program and then swap in an offloaded or
device-bound program with BPF_LINK_UPDATE, which puts it on the software
path.
dev_xdp_install() is the one place all three paths go through:
"ip link set xdp" and BPF_LINK_CREATE reach it via dev_xdp_attach(), and
BPF_LINK_UPDATE calls it directly. So move the program checks (offloaded,
bound to another device, device-bound in generic mode, native vs generic,
DEVMAP and CPUMAP) there, and keep only the netlink-flag check
(XDP_FLAGS_UPDATE_IF_NOEXIST) in dev_xdp_attach().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 Version: 026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 Version: 026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 Version: 026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 Version: 026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 Version: 026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bd06033625ec20b7bdec43d21f776fc1a5e9000e",
"status": "affected",
"version": "026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74",
"versionType": "git"
},
{
"lessThan": "486dbe7efec2be19cd3625be282f7f6b34a3f2c5",
"status": "affected",
"version": "026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74",
"versionType": "git"
},
{
"lessThan": "f14b774ec9bd52d0f4ec29a6597a35fd107197f9",
"status": "affected",
"version": "026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74",
"versionType": "git"
},
{
"lessThan": "ea7b35dcc9430293b861bc7bad0c546f193c85f9",
"status": "affected",
"version": "026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74",
"versionType": "git"
},
{
"lessThan": "03022dd874070768a7099f18b1944c633641315f",
"status": "affected",
"version": "026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74",
"versionType": "git"
},
{
"lessThan": "ad27ed7d2309419a129078d781504f486b1b469a",
"status": "affected",
"version": "026a4c28e1db3b0cb99cd9a3e495d4a8b632fa74",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, xdp: move offload check into dev_xdp_install()\n\nbpf_xdp_link_update() calls dev_xdp_install() directly and skips\ndev_xdp_attach(), so the checks in dev_xdp_attach() do not run. A user can\nmake an XDP link with a normal program and then swap in an offloaded or\ndevice-bound program with BPF_LINK_UPDATE, which puts it on the software\npath.\n\ndev_xdp_install() is the one place all three paths go through:\n\"ip link set xdp\" and BPF_LINK_CREATE reach it via dev_xdp_attach(), and\nBPF_LINK_UPDATE calls it directly. So move the program checks (offloaded,\nbound to another device, device-bound in generic mode, native vs generic,\nDEVMAP and CPUMAP) there, and keep only the netlink-flag check\n(XDP_FLAGS_UPDATE_IF_NOEXIST) in dev_xdp_attach()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker-controlled data is the replacement program fd on bpf(BPF_LINK_UPDATE), which __sys_bpf() dispatches to link_update() then bpf_xdp_link_update() in net/core/dev.c; that local syscall installs the prog, rather than a parsed ksmbd/nfsd/packet payload.\nAC:L - bpf_xdp_link_update() only compares prog-\u003etype and expected_attach_type, so BPF_LINK_CREATE of a normal XDP prog on a veth with XDP_FLAGS_SKB_MODE followed by BPF_LINK_UPDATE of a BPF_F_XDP_DEV_BOUND_ONLY prog that calls bpf_xdp_metadata_rx_* always bypasses the skipped dev_xdp_attach() checks, with no race.\nPR:L - bpf_prog_load() of BPF_PROG_TYPE_XDP requires bpf_token_capable(CAP_BPF) and bpf_token_capable(CAP_NET_ADMIN) before bpf_xdp_link_attach()/link_update(); those caps, and the CAP_NET_ADMIN to add the veth attach target, are obtainable in a user/netns via unshare and BPF token delegation, not only init-namespace root.\nUI:N - The attacker loads both programs, creates the XDP link, calls BPF_LINK_UPDATE, and then drives do_xdp_generic() by sending a frame through their own veth peer; no victim mount, file open, or other cooperative action is required.\nS:U - The confused metadata kfuncs (veth_xdp_rx_hash() and friends) run in the host kernel XDP path do_xdp_generic()/bpf_prog_run_generic_xdp() and corrupt host kernel memory; this is not a KVM/Xen guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - After the skipped bpf_prog_is_dev_bound() checks, a veth-bound program can run on generic XDP\u0027s stack struct xdp_buff; veth_xdp_rx_timestamp()/veth_xdp_rx_vlan_tag() cast it to veth_xdp_buff and read skb_hwtstamps()/vlan fields through that bogus skb pointer, an unbounded kernel read into BPF maps.\nI:H - The same confused veth_xdp_buff.skb is passed to skb_get_hash(), which writes hash/sw_hash/l4_hash via __skb_get_hash_net(); swapping a veth-bound prog onto mlx5 native XDP likewise treats mlx5e_xdp_buff.cqe as an sk_buff and writes into the CQE, which is type confusion with a kernel write.\nA:H - do_xdp_generic() allocates a bare struct xdp_buff, so the next RX after the bad BPF_LINK_UPDATE makes veth_xdp_rx_hash() or mlx5e_xdp_rx_timestamp() dereference adjacent stack/wrapper bytes as skb, cqe, or rq and oops; an offloaded prog swapped onto the software path also hits bpf_prog_warn_on_exec() per packet."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:50:04.647Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bd06033625ec20b7bdec43d21f776fc1a5e9000e"
},
{
"url": "https://git.kernel.org/stable/c/486dbe7efec2be19cd3625be282f7f6b34a3f2c5"
},
{
"url": "https://git.kernel.org/stable/c/f14b774ec9bd52d0f4ec29a6597a35fd107197f9"
},
{
"url": "https://git.kernel.org/stable/c/ea7b35dcc9430293b861bc7bad0c546f193c85f9"
},
{
"url": "https://git.kernel.org/stable/c/03022dd874070768a7099f18b1944c633641315f"
},
{
"url": "https://git.kernel.org/stable/c/ad27ed7d2309419a129078d781504f486b1b469a"
}
],
"title": "bpf, xdp: move offload check into dev_xdp_install()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90146",
"datePublished": "2026-09-17T16:06:41.695Z",
"dateReserved": "2026-09-11T19:38:34.789Z",
"dateUpdated": "2026-10-21T12:50:04.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98307 (GCVE-0-2026-98307)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()
When mac80211 removes a sta, it calls .sta_state() which in turn calls
ath11k_mac_station_remove(). In that function we clean up both peers &
arsta related resources.
But when the firmware crashes, ath11k calls ieee80211_restart_hw(), which
assumes that all driver related resources are cleaned up beforehand. This
cleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not
in fact free arsta->rx_stats / tx_stats.
Extract the arsta cleanup from ath11k_mac_station_remove() into a
new ath11k_mac_station_cleanup() and call it from both there and
ath11k_mac_peer_cleanup_all().
This should handle kmemleaks reports like:
unreferenced object 0xffffff801ae66400 (size 1024):
comm "hostapd", pid 1306, jiffies 4295011565
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc d61c08ec):
kmemleak_alloc+0x3c/0x50
__kmalloc_cache_noprof+0x2b0/0x3e0
ath11k_mac_op_sta_state+0x1dc/0xb10
drv_sta_state+0xac/0x6f8
sta_info_insert_rcu+0x314/0x5e0
sta_info_insert+0x14/0x38
ieee80211_add_station+0x10c/0x1a0
nl80211_new_station+0x3e8/0x680
genl_family_rcv_msg_doit+0xc0/0x120
genl_rcv_msg+0x1b4/0x258
netlink_rcv_skb+0x4c/0x108
genl_rcv+0x38/0x60
netlink_unicast+0x190/0x278
netlink_sendmsg+0x15c/0x370
____sys_sendmsg+0x120/0x290
___sys_sendmsg+0x70/0xa0
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath11k/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c4108dce0838ec7d38d782f76f9c007cfe2fff45",
"status": "affected",
"version": "d5c65159f2895379e11ca13f62feabe93278985d",
"versionType": "git"
},
{
"lessThan": "57bc3cd46458eafa1c38e3044a61b7399cde7642",
"status": "affected",
"version": "d5c65159f2895379e11ca13f62feabe93278985d",
"versionType": "git"
},
{
"lessThan": "be1d5e95ec499ed5ee9704aa27dd1407ccf0d0ac",
"status": "affected",
"version": "d5c65159f2895379e11ca13f62feabe93278985d",
"versionType": "git"
},
{
"lessThan": "820b8cff81c796ba20573e04722ab62500713f97",
"status": "affected",
"version": "d5c65159f2895379e11ca13f62feabe93278985d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath11k/mac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()\n\nWhen mac80211 removes a sta, it calls .sta_state() which in turn calls\nath11k_mac_station_remove(). In that function we clean up both peers \u0026\narsta related resources.\n\nBut when the firmware crashes, ath11k calls ieee80211_restart_hw(), which\nassumes that all driver related resources are cleaned up beforehand. This\ncleanup is supposedly done by ath11k_mac_peer_cleanup_all() but does not\nin fact free arsta-\u003erx_stats / tx_stats.\n\nExtract the arsta cleanup from ath11k_mac_station_remove() into a\nnew ath11k_mac_station_cleanup() and call it from both there and\nath11k_mac_peer_cleanup_all().\n\nThis should handle kmemleaks reports like:\n\tunreferenced object 0xffffff801ae66400 (size 1024):\n\t comm \"hostapd\", pid 1306, jiffies 4295011565\n\t hex dump (first 32 bytes):\n\t 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n\t 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n\t backtrace (crc d61c08ec):\n\t kmemleak_alloc+0x3c/0x50\n\t __kmalloc_cache_noprof+0x2b0/0x3e0\n\t ath11k_mac_op_sta_state+0x1dc/0xb10\n\t drv_sta_state+0xac/0x6f8\n\t sta_info_insert_rcu+0x314/0x5e0\n\t sta_info_insert+0x14/0x38\n\t ieee80211_add_station+0x10c/0x1a0\n\t nl80211_new_station+0x3e8/0x680\n\t genl_family_rcv_msg_doit+0xc0/0x120\n\t genl_rcv_msg+0x1b4/0x258\n\t netlink_rcv_skb+0x4c/0x108\n\t genl_rcv+0x38/0x60\n\t netlink_unicast+0x190/0x278\n\t netlink_sendmsg+0x15c/0x370\n\t ____sys_sendmsg+0x120/0x290\n\t ___sys_sendmsg+0x70/0xa0\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-01977-QCAHKSWPL_SILICONZ-1"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:17.992Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c4108dce0838ec7d38d782f76f9c007cfe2fff45"
},
{
"url": "https://git.kernel.org/stable/c/57bc3cd46458eafa1c38e3044a61b7399cde7642"
},
{
"url": "https://git.kernel.org/stable/c/be1d5e95ec499ed5ee9704aa27dd1407ccf0d0ac"
},
{
"url": "https://git.kernel.org/stable/c/820b8cff81c796ba20573e04722ab62500713f97"
}
],
"title": "wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98307",
"datePublished": "2026-10-06T08:46:04.301Z",
"dateReserved": "2026-09-25T10:25:14.338Z",
"dateUpdated": "2026-10-19T09:17:17.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98190 (GCVE-0-2026-98190)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: wilc1000: fix out-of-bounds read in P2P public action frames
wilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once
ieee80211_is_public_action() returns true. That helper only verifies the
frame is long enough for the action category field, that is
offsetofend(struct ieee80211_mgmt, u.action.category), 25 bytes. Both
functions then read the P2P public action header up to oui_subtype at
offset 30 and pass "size - ie_offset" to cfg80211_find_vendor_ie(), where
ie_offset is offsetof(struct ieee80211_mgmt, u) + sizeof(*d), i.e. 32.
A public action frame of 25 to 31 bytes passes the check but is shorter
than that 32 byte header, so oui_subtype can be read out of bounds, and
because the length is unsigned, "size - ie_offset" underflows to a value
close to 4 GiB. cfg80211_find_vendor_ie() takes an unsigned int length,
so even the size_t subtraction in mgmt_tx() is truncated to the same
value. It then walks far past the buffer searching for a vendor element
until it reaches unmapped memory.
In the receive path the frame arrives over the air and needs no
association, so a nearby unauthenticated device can crash the host while
it is in P2P listen. Reject frames shorter than the P2P public action
header in both paths before dereferencing it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4fb8b5aa2a1126783ae00bae544d6f3c519408ef Version: 4fb8b5aa2a1126783ae00bae544d6f3c519408ef Version: 4fb8b5aa2a1126783ae00bae544d6f3c519408ef Version: 4fb8b5aa2a1126783ae00bae544d6f3c519408ef Version: 4fb8b5aa2a1126783ae00bae544d6f3c519408ef Version: 4fb8b5aa2a1126783ae00bae544d6f3c519408ef Version: 4fb8b5aa2a1126783ae00bae544d6f3c519408ef Version: 4fb8b5aa2a1126783ae00bae544d6f3c519408ef |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/microchip/wilc1000/cfg80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e98ad9f4c59f2e836f8d971b57763a4277680422",
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"versionType": "git"
},
{
"lessThan": "f0c46f8111a479b97b8ab17747c528cade6257f1",
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"versionType": "git"
},
{
"lessThan": "a5b827dad8a3037cef04d0240d1c2acb1557101e",
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"versionType": "git"
},
{
"lessThan": "491df93b10d76aebaf6aa4bb05a6ba897f4fccfb",
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"versionType": "git"
},
{
"lessThan": "cc2ee642ebeac8699b671ddb6d5955a785e5ff43",
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"versionType": "git"
},
{
"lessThan": "68b786691ce24c5c94e28811db243e573c50f9c1",
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"versionType": "git"
},
{
"lessThan": "6fbe76eb2796d2aee45cc6a2dd16e85d3cc96304",
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"versionType": "git"
},
{
"lessThan": "ba6cb7c0868a412c2eb68e8efd5aa38bfb258a14",
"status": "affected",
"version": "4fb8b5aa2a1126783ae00bae544d6f3c519408ef",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/microchip/wilc1000/cfg80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: fix out-of-bounds read in P2P public action frames\n\nwilc_wfi_p2p_rx() and mgmt_tx() start parsing a frame once\nieee80211_is_public_action() returns true. That helper only verifies the\nframe is long enough for the action category field, that is\noffsetofend(struct ieee80211_mgmt, u.action.category), 25 bytes. Both\nfunctions then read the P2P public action header up to oui_subtype at\noffset 30 and pass \"size - ie_offset\" to cfg80211_find_vendor_ie(), where\nie_offset is offsetof(struct ieee80211_mgmt, u) + sizeof(*d), i.e. 32.\n\nA public action frame of 25 to 31 bytes passes the check but is shorter\nthan that 32 byte header, so oui_subtype can be read out of bounds, and\nbecause the length is unsigned, \"size - ie_offset\" underflows to a value\nclose to 4 GiB. cfg80211_find_vendor_ie() takes an unsigned int length,\nso even the size_t subtraction in mgmt_tx() is truncated to the same\nvalue. It then walks far past the buffer searching for a vendor element\nuntil it reaches unmapped memory.\n\nIn the receive path the frame arrives over the air and needs no\nassociation, so a nearby unauthenticated device can crash the host while\nit is in P2P listen. Reject frames shorter than the P2P public action\nheader in both paths before dereferencing it."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:21.647Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e98ad9f4c59f2e836f8d971b57763a4277680422"
},
{
"url": "https://git.kernel.org/stable/c/f0c46f8111a479b97b8ab17747c528cade6257f1"
},
{
"url": "https://git.kernel.org/stable/c/a5b827dad8a3037cef04d0240d1c2acb1557101e"
},
{
"url": "https://git.kernel.org/stable/c/491df93b10d76aebaf6aa4bb05a6ba897f4fccfb"
},
{
"url": "https://git.kernel.org/stable/c/cc2ee642ebeac8699b671ddb6d5955a785e5ff43"
},
{
"url": "https://git.kernel.org/stable/c/68b786691ce24c5c94e28811db243e573c50f9c1"
},
{
"url": "https://git.kernel.org/stable/c/6fbe76eb2796d2aee45cc6a2dd16e85d3cc96304"
},
{
"url": "https://git.kernel.org/stable/c/ba6cb7c0868a412c2eb68e8efd5aa38bfb258a14"
}
],
"title": "wifi: wilc1000: fix out-of-bounds read in P2P public action frames",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98190",
"datePublished": "2026-10-06T08:44:31.520Z",
"dateReserved": "2026-09-25T10:25:14.323Z",
"dateUpdated": "2026-10-19T09:15:21.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98181 (GCVE-0-2026-98181)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
The plane property loop uses req->properties[num_properties + i] as write
index while simultaneously incrementing `num_properties` inside the loop.
At iteration i, num_properties has also incremented by i, so the write
is done at `initial_num_properties + 2*i`, skipping every other index and
advancing by 2 per iteration.
With just 2 connector and 32 plane properties the last write happens at
index 64, one slot past the end of the 64-slot (indices 0–63)
allocation. A USB device can trigger OOB by advertising the maximum
number of properties.
Fix by dropping the redundant `+ i`; num_properties is already the correct
running index, as gud_connector_fill_properties() fills the preceding
slots.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 Version: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 Version: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 Version: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 Version: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 Version: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 Version: 40e1a70b4aedf2859a1829991b48ef0ebe650bf2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/gud/gud_pipe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee04903fe6a098160d20dde4fc5af4cb42846735",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
},
{
"lessThan": "4153a9e008f2512bd3cf90a319436865847369b9",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
},
{
"lessThan": "5f5e565410b4987e9663f599f9ab0c350f8338d4",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
},
{
"lessThan": "7e630edb22088df7aa0d55b02237a71e4c9a523d",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
},
{
"lessThan": "2c92af27ad23e2fbc0367b11a9027d36d94ef4b3",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
},
{
"lessThan": "ea57100955c1c2a525ba1a98c18d9a05b25aeedb",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
},
{
"lessThan": "59ced288fcba9e91bd38e61a972ad782c4edb7d0",
"status": "affected",
"version": "40e1a70b4aedf2859a1829991b48ef0ebe650bf2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/gud/gud_pipe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gud: fix out-of-bounds write in gud_plane_atomic_check()\n\nThe plane property loop uses req-\u003eproperties[num_properties + i] as write\nindex while simultaneously incrementing `num_properties` inside the loop.\nAt iteration i, num_properties has also incremented by i, so the write\nis done at `initial_num_properties + 2*i`, skipping every other index and\nadvancing by 2 per iteration.\n\nWith just 2 connector and 32 plane properties the last write happens at\nindex 64, one slot past the end of the 64-slot (indices 0\u201363)\nallocation. A USB device can trigger OOB by advertising the maximum\nnumber of properties.\n\nFix by dropping the redundant `+ i`; num_properties is already the correct\nrunning index, as gud_connector_fill_properties() fills the preceding\nslots."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:12.473Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee04903fe6a098160d20dde4fc5af4cb42846735"
},
{
"url": "https://git.kernel.org/stable/c/4153a9e008f2512bd3cf90a319436865847369b9"
},
{
"url": "https://git.kernel.org/stable/c/5f5e565410b4987e9663f599f9ab0c350f8338d4"
},
{
"url": "https://git.kernel.org/stable/c/7e630edb22088df7aa0d55b02237a71e4c9a523d"
},
{
"url": "https://git.kernel.org/stable/c/2c92af27ad23e2fbc0367b11a9027d36d94ef4b3"
},
{
"url": "https://git.kernel.org/stable/c/ea57100955c1c2a525ba1a98c18d9a05b25aeedb"
},
{
"url": "https://git.kernel.org/stable/c/59ced288fcba9e91bd38e61a972ad782c4edb7d0"
}
],
"title": "drm/gud: fix out-of-bounds write in gud_plane_atomic_check()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98181",
"datePublished": "2026-10-06T08:44:24.284Z",
"dateReserved": "2026-09-25T10:25:14.322Z",
"dateUpdated": "2026-10-19T09:15:12.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98234 (GCVE-0-2026-98234)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: hhf: cap hh_flows_limit at change time
hhf_change() stores TCA_HHF_HH_FLOWS_LIMIT with no upper bound. A huge
hh_flows_limit lets each new heavy-hitter flow pass the
hh_flows_current_cnt check in alloc_new_hh() and forces a fixed-size
kzalloc(GFP_ATOMIC) per flow under spoofed traffic, for unbounded memory
growth.
Bound the attribute with NLA_POLICY_MAX() at 2*HH_FLOWS_CNT (the
hhf_init() default) and report the rejected value via extack. The
deprecated nested parse is kept: legacy tc does not set NLA_F_NESTED on
TCA_OPTIONS. Configs relying on hh_limit above the default were relying
on unbounded, unsafe behaviour and are not supported going forward.
hhf_init() also ran hhf_change() before setting the default
hh_flows_limit, so a user-supplied hh_limit at add time was clobbered
back to 2048. Set the default before hhf_change() so the configured
value sticks.
This is a follow-up to commit eb56a495f59b ("net/sched: hhf: clamp
quantum in change and init paths"), which bounded the quantum of the
same qdisc; the hh_flows_limit bound is the remaining unbounded knob of
that series' scope.
Conditions to recreate the bug: CAP_NET_ADMIN in a user namespace;
tc qdisc change dev X root hhf hh_limit 4294967295 succeeds and the
value is echoed by tc qdisc show, unbounding heavy-hitter flow
allocations; also tc qdisc add dev X root hhf hh_limit 500 stores 2048
instead of 500.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 10239edf86f137ce4c39b62ea9575e8053c549a0 Version: 10239edf86f137ce4c39b62ea9575e8053c549a0 Version: 10239edf86f137ce4c39b62ea9575e8053c549a0 Version: 10239edf86f137ce4c39b62ea9575e8053c549a0 Version: 10239edf86f137ce4c39b62ea9575e8053c549a0 Version: 10239edf86f137ce4c39b62ea9575e8053c549a0 Version: 10239edf86f137ce4c39b62ea9575e8053c549a0 Version: 10239edf86f137ce4c39b62ea9575e8053c549a0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_hhf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7adfd0a42174b85c6bd678858ecd6674f403f336",
"status": "affected",
"version": "10239edf86f137ce4c39b62ea9575e8053c549a0",
"versionType": "git"
},
{
"lessThan": "35fd423a5c5132c6f4321f6c4f0a7b4b90af830c",
"status": "affected",
"version": "10239edf86f137ce4c39b62ea9575e8053c549a0",
"versionType": "git"
},
{
"lessThan": "06d2a101e89063cb0b9b459104db48bdfb0a797d",
"status": "affected",
"version": "10239edf86f137ce4c39b62ea9575e8053c549a0",
"versionType": "git"
},
{
"lessThan": "d8e2f1f0263b7c97b222c06070cccf13e0ab7112",
"status": "affected",
"version": "10239edf86f137ce4c39b62ea9575e8053c549a0",
"versionType": "git"
},
{
"lessThan": "f3f4a5cb4a6e9b1f1f25d34dfc25f836a1601db4",
"status": "affected",
"version": "10239edf86f137ce4c39b62ea9575e8053c549a0",
"versionType": "git"
},
{
"lessThan": "1731ff1d20489afe4cd01b7d16d37f324746ac54",
"status": "affected",
"version": "10239edf86f137ce4c39b62ea9575e8053c549a0",
"versionType": "git"
},
{
"lessThan": "f6547d27ce2093c5627636fb63dd0b7523c466f9",
"status": "affected",
"version": "10239edf86f137ce4c39b62ea9575e8053c549a0",
"versionType": "git"
},
{
"lessThan": "2cef2588c995722a901368def30befeef9ae55c6",
"status": "affected",
"version": "10239edf86f137ce4c39b62ea9575e8053c549a0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_hhf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: hhf: cap hh_flows_limit at change time\n\nhhf_change() stores TCA_HHF_HH_FLOWS_LIMIT with no upper bound. A huge\nhh_flows_limit lets each new heavy-hitter flow pass the\nhh_flows_current_cnt check in alloc_new_hh() and forces a fixed-size\nkzalloc(GFP_ATOMIC) per flow under spoofed traffic, for unbounded memory\ngrowth.\n\nBound the attribute with NLA_POLICY_MAX() at 2*HH_FLOWS_CNT (the\nhhf_init() default) and report the rejected value via extack. The\ndeprecated nested parse is kept: legacy tc does not set NLA_F_NESTED on\nTCA_OPTIONS. Configs relying on hh_limit above the default were relying\non unbounded, unsafe behaviour and are not supported going forward.\n\nhhf_init() also ran hhf_change() before setting the default\nhh_flows_limit, so a user-supplied hh_limit at add time was clobbered\nback to 2048. Set the default before hhf_change() so the configured\nvalue sticks.\n\nThis is a follow-up to commit eb56a495f59b (\"net/sched: hhf: clamp\nquantum in change and init paths\"), which bounded the quantum of the\nsame qdisc; the hh_flows_limit bound is the remaining unbounded knob of\nthat series\u0027 scope.\n\nConditions to recreate the bug: CAP_NET_ADMIN in a user namespace;\ntc qdisc change dev X root hhf hh_limit 4294967295 succeeds and the\nvalue is echoed by tc qdisc show, unbounding heavy-hitter flow\nallocations; also tc qdisc add dev X root hhf hh_limit 500 stores 2048\ninstead of 500."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:06.128Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7adfd0a42174b85c6bd678858ecd6674f403f336"
},
{
"url": "https://git.kernel.org/stable/c/35fd423a5c5132c6f4321f6c4f0a7b4b90af830c"
},
{
"url": "https://git.kernel.org/stable/c/06d2a101e89063cb0b9b459104db48bdfb0a797d"
},
{
"url": "https://git.kernel.org/stable/c/d8e2f1f0263b7c97b222c06070cccf13e0ab7112"
},
{
"url": "https://git.kernel.org/stable/c/f3f4a5cb4a6e9b1f1f25d34dfc25f836a1601db4"
},
{
"url": "https://git.kernel.org/stable/c/1731ff1d20489afe4cd01b7d16d37f324746ac54"
},
{
"url": "https://git.kernel.org/stable/c/f6547d27ce2093c5627636fb63dd0b7523c466f9"
},
{
"url": "https://git.kernel.org/stable/c/2cef2588c995722a901368def30befeef9ae55c6"
}
],
"title": "net/sched: hhf: cap hh_flows_limit at change time",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98234",
"datePublished": "2026-10-06T08:45:07.215Z",
"dateReserved": "2026-09-25T10:25:14.329Z",
"dateUpdated": "2026-10-19T09:16:06.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98378 (GCVE-0-2026-98378)
Vulnerability from cvelistv5
Published
2026-10-09 07:34
Modified
2026-10-24 14:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Skip unsettled links in link iterator
bpf_link_prime() inserts a link into link_idr before anon_inode_getfile()
succeeds and before bpf_link_settle() publishes the ID in link->id.
bpf_link_by_id() treats such an ID-zero link as unsettled, but the link
iterator takes a reference without this check.
If anon_inode_getfile() then fails, the creator removes the ID and frees
its still-private link directly. The iterator is left with a dangling
reference and its next bpf_link_put() accesses freed memory.
Treat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as
bpf_link_by_id() does.
BUG: KASAN: slab-use-after-free in bpf_link_put
Write of size 8 by task exp/384
Call Trace:
bpf_link_put kernel/bpf/syscall.c:3372
bpf_link_seq_next kernel/bpf/link_iter.c:33
bpf_seq_read kernel/bpf/bpf_iter.c:158
vfs_read fs/read_write.c:572
ksys_read fs/read_write.c:716
do_syscall_64 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121
Kernel panic - not syncing: KASAN: panic_on_warn set ...
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9f88361273082825d9f0d13a543d49f9fa0d44a8 Version: 9f88361273082825d9f0d13a543d49f9fa0d44a8 Version: 9f88361273082825d9f0d13a543d49f9fa0d44a8 Version: 9f88361273082825d9f0d13a543d49f9fa0d44a8 Version: 9f88361273082825d9f0d13a543d49f9fa0d44a8 Version: 9f88361273082825d9f0d13a543d49f9fa0d44a8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68930f8d40ab4c10ca3b019f076136758fd100a8",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "c251ed48bd9063cf7de6049421e78b6de989060f",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "798a61edbc436cacdb659927d067368eeb1e30e2",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "6e271f093d15d323f42de26f66556af53fa8e19f",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "87ce4b53b7436b50fc984f0a6afaf77f68ac5573",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
},
{
"lessThan": "50e80e2bb5e2be8515205b9c496b9640ddefa434",
"status": "affected",
"version": "9f88361273082825d9f0d13a543d49f9fa0d44a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/syscall.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.55",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.9",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip unsettled links in link iterator\n\nbpf_link_prime() inserts a link into link_idr before anon_inode_getfile()\nsucceeds and before bpf_link_settle() publishes the ID in link-\u003eid.\nbpf_link_by_id() treats such an ID-zero link as unsettled, but the link\niterator takes a reference without this check.\n\nIf anon_inode_getfile() then fails, the creator removes the ID and frees\nits still-private link directly. The iterator is left with a dangling\nreference and its next bpf_link_put() accesses freed memory.\n\nTreat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as\nbpf_link_by_id() does.\n\n BUG: KASAN: slab-use-after-free in bpf_link_put\n Write of size 8 by task exp/384\n Call Trace:\n bpf_link_put kernel/bpf/syscall.c:3372\n bpf_link_seq_next kernel/bpf/link_iter.c:33\n bpf_seq_read kernel/bpf/bpf_iter.c:158\n vfs_read fs/read_write.c:572\n ksys_read fs/read_write.c:716\n do_syscall_64 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe arch/x86/entry/entry_64.S:121\n Kernel panic - not syncing: KASAN: panic_on_warn set ..."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Both required paths are local: bpf(BPF_LINK_CREATE/BPF_ITER_CREATE) prepares the bpf_link iterator, and read() reaches bpf_seq_read() -\u003e bpf_link_seq_next() -\u003e the patched bpf_link_get_curr_or_next(); no network data enters this state.\nAC:L - The attacker can fill fs.file-max so anon_inode_getfile() returns -ENFILE, then run the iterator reader and repeated BPF_LINK_CREATE calls concurrently, controlling both sides of the IDR insert/remove race.\nPR:L - BPF_PROG_LOAD for BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER requires CAP_BPF and CAP_PERFMON, but bpf_token_capable() accepts them in a delegated bpffs token\u0027s user namespace; this permits a namespace-root local user, while a bare user namespace does not.\nUI:N - After preparing the iterator and program FDs, the attacking process itself issues read() and concurrent BPF_LINK_CREATE calls; no victim action is required.\nS:U - bpf_link_get_curr_or_next() leaves a dangling object inside the same host kernel that services the BPF syscalls; it crosses no guest/host, IOMMU, or separate security authority boundary.\nC:H - The iterator retains a freed struct bpf_link pointer; reclaiming that slab object makes later bpf_link_put()/bpf_link_free() consume attacker-influenced refcnt, ops, and prog fields, supporting kernel-memory disclosure.\nI:H - bpf_link_put() performs atomic64_dec_and_test() on the freed object\u0027s first eight bytes and can initialize and queue its reclaimed work_struct, so controlled reuse supports arbitrary corruption or control-flow hijacking.\nA:H - The demonstrated read() path reaches bpf_link_seq_next() and bpf_link_put() after the link is freed, producing a KASAN use-after-free and kernel panic; the same stale write can crash a non-KASAN kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:08:37.091Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/68930f8d40ab4c10ca3b019f076136758fd100a8"
},
{
"url": "https://git.kernel.org/stable/c/c251ed48bd9063cf7de6049421e78b6de989060f"
},
{
"url": "https://git.kernel.org/stable/c/798a61edbc436cacdb659927d067368eeb1e30e2"
},
{
"url": "https://git.kernel.org/stable/c/6e271f093d15d323f42de26f66556af53fa8e19f"
},
{
"url": "https://git.kernel.org/stable/c/87ce4b53b7436b50fc984f0a6afaf77f68ac5573"
},
{
"url": "https://git.kernel.org/stable/c/50e80e2bb5e2be8515205b9c496b9640ddefa434"
}
],
"title": "bpf: Skip unsettled links in link iterator",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98378",
"datePublished": "2026-10-09T07:34:18.626Z",
"dateReserved": "2026-09-25T10:25:14.345Z",
"dateUpdated": "2026-10-24T14:08:37.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89837 (GCVE-0-2026-89837)
Vulnerability from cvelistv5
Published
2026-09-16 10:31
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix dentry folio leak in find_in_level
find_in_level() gets a dentry folio with f2fs_find_data_folio() before
calling find_in_block(). If find_in_block() returns an error, the
function stores the error in res_folio and breaks out of the loop without
dropping the dentry folio.
This leaks the folio reference on the find_in_block() error path. Drop
the dentry folio before returning the error to the caller.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b6c0e77d950bf80ab357e2b4b9667f4389ed417c",
"status": "affected",
"version": "7ad08a58bf67594057362e45cbddd3e27e53e557",
"versionType": "git"
},
{
"lessThan": "af9cc316d31371824de8d409260a2ab9759dd51c",
"status": "affected",
"version": "7ad08a58bf67594057362e45cbddd3e27e53e557",
"versionType": "git"
},
{
"lessThan": "aefb4b0f465b6f95fe02b52d1822a3fb4a9ae922",
"status": "affected",
"version": "7ad08a58bf67594057362e45cbddd3e27e53e557",
"versionType": "git"
},
{
"lessThan": "93a3e6a4c9e726a13a935963e8dc43d181db1527",
"status": "affected",
"version": "7ad08a58bf67594057362e45cbddd3e27e53e557",
"versionType": "git"
},
{
"lessThan": "cca7d3e30bf30333314e31bc70b9a739f1342167",
"status": "affected",
"version": "7ad08a58bf67594057362e45cbddd3e27e53e557",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix dentry folio leak in find_in_level\n\nfind_in_level() gets a dentry folio with f2fs_find_data_folio() before\ncalling find_in_block(). If find_in_block() returns an error, the\nfunction stores the error in res_folio and breaks out of the loop without\ndropping the dentry folio.\n\nThis leaks the folio reference on the find_in_block() error path. Drop\nthe dentry folio before returning the error to the caller."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:00.051Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b6c0e77d950bf80ab357e2b4b9667f4389ed417c"
},
{
"url": "https://git.kernel.org/stable/c/af9cc316d31371824de8d409260a2ab9759dd51c"
},
{
"url": "https://git.kernel.org/stable/c/aefb4b0f465b6f95fe02b52d1822a3fb4a9ae922"
},
{
"url": "https://git.kernel.org/stable/c/93a3e6a4c9e726a13a935963e8dc43d181db1527"
},
{
"url": "https://git.kernel.org/stable/c/cca7d3e30bf30333314e31bc70b9a739f1342167"
}
],
"title": "f2fs: fix dentry folio leak in find_in_level",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89837",
"datePublished": "2026-09-16T10:31:11.557Z",
"dateReserved": "2026-09-11T19:38:34.769Z",
"dateUpdated": "2026-10-21T12:49:00.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97558 (GCVE-0-2026-97558)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix cifsFileInfo reference leak in deferred close
When cifs_close() defers a close, it hands the cifsFileInfo reference
of the closing struct file to the queued work. Each execution of
smb2_deferred_work_close() drops one such reference.
deferred_close_scheduled can be false while the work is pending: the
workqueue clears PENDING when the callback starts to run, before the
callback clears the flag under deferred_lock. A close in that
interval requeues the running work, and the callback then clears the
flag, leaving the requeued work pending with the flag down. A later
cifs_open() can reuse the handle and its cifs_close() reaches the
same branch: queue_delayed_work() fails because the work is still
pending, but cifs_close() returns without dropping the closing file's
reference. The cifsFileInfo count stays pinned and its tlink, dentry
and server handle are leaked.
Check the return value and hand off the reference only when work was
actually queued. Otherwise, use the shared _cifsFileInfo_put(), like
the mod_delayed_work() branch above: the pending execution already
owns its reference.
This issue was found by an in-house static analysis tool.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "525c225e23d61694091f2806de553a69362a78ff",
"status": "affected",
"version": "c3f207ab29f793b8c942ce8067ed123f18d5b81b",
"versionType": "git"
},
{
"lessThan": "bbeb7a42c9ea656e17ddcbdc2d7917aa853383a6",
"status": "affected",
"version": "c3f207ab29f793b8c942ce8067ed123f18d5b81b",
"versionType": "git"
},
{
"lessThan": "a6767712902beb0f53238be485971c9a83ea1079",
"status": "affected",
"version": "c3f207ab29f793b8c942ce8067ed123f18d5b81b",
"versionType": "git"
},
{
"lessThan": "ea93759d6c2789924f4e557aed5be532207715ea",
"status": "affected",
"version": "c3f207ab29f793b8c942ce8067ed123f18d5b81b",
"versionType": "git"
},
{
"lessThan": "5520e89a5a4f834bced64cf2ac927001cc513a40",
"status": "affected",
"version": "c3f207ab29f793b8c942ce8067ed123f18d5b81b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.113",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix cifsFileInfo reference leak in deferred close\n\nWhen cifs_close() defers a close, it hands the cifsFileInfo reference\nof the closing struct file to the queued work. Each execution of\nsmb2_deferred_work_close() drops one such reference.\n\ndeferred_close_scheduled can be false while the work is pending: the\nworkqueue clears PENDING when the callback starts to run, before the\ncallback clears the flag under deferred_lock. A close in that\ninterval requeues the running work, and the callback then clears the\nflag, leaving the requeued work pending with the flag down. A later\ncifs_open() can reuse the handle and its cifs_close() reaches the\nsame branch: queue_delayed_work() fails because the work is still\npending, but cifs_close() returns without dropping the closing file\u0027s\nreference. The cifsFileInfo count stays pinned and its tlink, dentry\nand server handle are leaked.\n\nCheck the return value and hand off the reference only when work was\nactually queued. Otherwise, use the shared _cifsFileInfo_put(), like\nthe mod_delayed_work() branch above: the pending execution already\nowns its reference.\n\nThis issue was found by an in-house static analysis tool."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:16.017Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/525c225e23d61694091f2806de553a69362a78ff"
},
{
"url": "https://git.kernel.org/stable/c/bbeb7a42c9ea656e17ddcbdc2d7917aa853383a6"
},
{
"url": "https://git.kernel.org/stable/c/a6767712902beb0f53238be485971c9a83ea1079"
},
{
"url": "https://git.kernel.org/stable/c/ea93759d6c2789924f4e557aed5be532207715ea"
},
{
"url": "https://git.kernel.org/stable/c/5520e89a5a4f834bced64cf2ac927001cc513a40"
}
],
"title": "smb: client: fix cifsFileInfo reference leak in deferred close",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97558",
"datePublished": "2026-09-25T10:21:48.277Z",
"dateReserved": "2026-09-24T16:01:01.155Z",
"dateUpdated": "2026-10-21T12:53:16.017Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97919 (GCVE-0-2026-97919)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Take the reference before publishing the named histogram trigger
event_hist_trigger_named_init() puts the trigger on the global
named_triggers list and only then takes the reference on the trigger it
shares its histogram with:
data->ref++;
save_named_trigger(data->named_data->name, data);
ret = event_hist_trigger_init(data->named_data);
if (ret < 0) {
kfree(data->cmd_ops);
data->cmd_ops = &trigger_hist_cmd;
}
return ret;
event_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and
nothing takes the trigger back off the list on the way out.
event_hist_trigger_parse() frees it, and the next lookup by name reads the
freed object:
BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0
Read of size 8 at addr ffff888009346860 by task init/1
find_named_trigger+0xac/0xc0
hist_register_trigger+0xc1/0xa00
event_hist_trigger_parse+0x3146/0x6af0
event_trigger_write+0xce/0x160
Freed by task 67:
kfree+0x154/0x420
trigger_kthread_fn+0xfd/0x160
Do the reference first and publish once it has succeeded, so that nothing
which can fail runs after the trigger becomes findable.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ac7ab38c271ba2edaeb0dc35b200ec13339776ae Version: e53a8dcd36b9ebc9229450eb594ae20e0b2ae0fd Version: 7ab0fc61ce73040f89b12d76a8279995ec283541 Version: 7ab0fc61ce73040f89b12d76a8279995ec283541 Version: 7ab0fc61ce73040f89b12d76a8279995ec283541 Version: 740dab2338f70d93aa8235db5a9541d846d7b21c Version: 6.6.94 ≤ Version: 6.12.34 ≤ Version: 6.15.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e5c5dad169fb569161d3eed6c3f6a59e65db1830",
"status": "affected",
"version": "ac7ab38c271ba2edaeb0dc35b200ec13339776ae",
"versionType": "git"
},
{
"lessThan": "b6fb2f5370a9a6aec325ab2db1ca3d1a881499b8",
"status": "affected",
"version": "e53a8dcd36b9ebc9229450eb594ae20e0b2ae0fd",
"versionType": "git"
},
{
"lessThan": "2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b",
"status": "affected",
"version": "7ab0fc61ce73040f89b12d76a8279995ec283541",
"versionType": "git"
},
{
"lessThan": "91c15cdda6033e2439f5975b938754152f3d6e38",
"status": "affected",
"version": "7ab0fc61ce73040f89b12d76a8279995ec283541",
"versionType": "git"
},
{
"lessThan": "0fe23b8eaba0d3372c66b7b31204408da0715edc",
"status": "affected",
"version": "7ab0fc61ce73040f89b12d76a8279995ec283541",
"versionType": "git"
},
{
"status": "affected",
"version": "740dab2338f70d93aa8235db5a9541d846d7b21c",
"versionType": "git"
},
{
"lessThan": "6.6.160",
"status": "affected",
"version": "6.6.94",
"versionType": "semver"
},
{
"lessThan": "6.12.112",
"status": "affected",
"version": "6.12.34",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.6.94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.12.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Take the reference before publishing the named histogram trigger\n\nevent_hist_trigger_named_init() puts the trigger on the global\nnamed_triggers list and only then takes the reference on the trigger it\nshares its histogram with:\n\n\tdata-\u003eref++;\n\n\tsave_named_trigger(data-\u003enamed_data-\u003ename, data);\n\n\tret = event_hist_trigger_init(data-\u003enamed_data);\n\tif (ret \u003c 0) {\n\t\tkfree(data-\u003ecmd_ops);\n\t\tdata-\u003ecmd_ops = \u0026trigger_hist_cmd;\n\t}\n\n\treturn ret;\n\nevent_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and\nnothing takes the trigger back off the list on the way out.\nevent_hist_trigger_parse() frees it, and the next lookup by name reads the\nfreed object:\n\n BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n Read of size 8 at addr ffff888009346860 by task init/1\n find_named_trigger+0xac/0xc0\n hist_register_trigger+0xc1/0xa00\n event_hist_trigger_parse+0x3146/0x6af0\n event_trigger_write+0xce/0x160\n Freed by task 67:\n kfree+0x154/0x420\n trigger_kthread_fn+0xfd/0x160\n\nDo the reference first and publish once it has succeeded, so that nothing\nwhich can fail runs after the trigger becomes findable."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:38.904Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e5c5dad169fb569161d3eed6c3f6a59e65db1830"
},
{
"url": "https://git.kernel.org/stable/c/b6fb2f5370a9a6aec325ab2db1ca3d1a881499b8"
},
{
"url": "https://git.kernel.org/stable/c/2ffaade3611bd9501bc0b9d5d19fc75bfee7a16b"
},
{
"url": "https://git.kernel.org/stable/c/91c15cdda6033e2439f5975b938754152f3d6e38"
},
{
"url": "https://git.kernel.org/stable/c/0fe23b8eaba0d3372c66b7b31204408da0715edc"
}
],
"title": "tracing: Take the reference before publishing the named histogram trigger",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97919",
"datePublished": "2026-09-25T10:22:39.829Z",
"dateReserved": "2026-09-25T10:18:58.202Z",
"dateUpdated": "2026-10-21T12:53:38.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98301 (GCVE-0-2026-98301)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: mst: move switchdev call outside rcu
This is a follow-up of one of sashiko's pre-existing bug reports.
br_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs
while holding rcu_read_lock() which invokes the blocking switchdev
notifier chain and may sleep. Nonzero MSTI changes come from netlink
with rtnl held. Move the switchdev call before entering the rcu section and
assert that rtnl is held.
The call cannot be deferred because netlink needs its error and extack.
Also DSA reads the old bridge MST state during the callback and checks it.
A deferred callback will be late and will see the updated state.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8ca9a750fc711911ef616ceb627d07357b04545e Version: 4488617e5e995a09abe4d81add5fb165674edb59 Version: 3a7c1661ae1383364cd6092d851f5e5da64d476b Version: 3a7c1661ae1383364cd6092d851f5e5da64d476b Version: 3a7c1661ae1383364cd6092d851f5e5da64d476b Version: 3a7c1661ae1383364cd6092d851f5e5da64d476b Version: a2b01e65d9ba8af2bb086d3b7288ca53a07249ac Version: e43dd2b1ec746e105b7db5f9ad6ef14685a615a4 Version: 6.1.93 ≤ Version: 6.6.33 ≤ Version: 6.8.12 ≤ Version: 6.9.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_mst.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b9661fd2423fc25e91e0517ecc0b6156ad83e3a8",
"status": "affected",
"version": "8ca9a750fc711911ef616ceb627d07357b04545e",
"versionType": "git"
},
{
"lessThan": "6b431b63219853eef4054e2f1cb073d2ca2059b4",
"status": "affected",
"version": "4488617e5e995a09abe4d81add5fb165674edb59",
"versionType": "git"
},
{
"lessThan": "abf734d150c61acfdfee102169d0e5d1c482e285",
"status": "affected",
"version": "3a7c1661ae1383364cd6092d851f5e5da64d476b",
"versionType": "git"
},
{
"lessThan": "d5c4ee1fa4e83a12afc051c831936cd8e006cde3",
"status": "affected",
"version": "3a7c1661ae1383364cd6092d851f5e5da64d476b",
"versionType": "git"
},
{
"lessThan": "c40ed3e884c8dc0350f26484030438ef24208ff1",
"status": "affected",
"version": "3a7c1661ae1383364cd6092d851f5e5da64d476b",
"versionType": "git"
},
{
"lessThan": "18a6fe05fb6e18de29fa90d388bb34044114b3d8",
"status": "affected",
"version": "3a7c1661ae1383364cd6092d851f5e5da64d476b",
"versionType": "git"
},
{
"status": "affected",
"version": "a2b01e65d9ba8af2bb086d3b7288ca53a07249ac",
"versionType": "git"
},
{
"status": "affected",
"version": "e43dd2b1ec746e105b7db5f9ad6ef14685a615a4",
"versionType": "git"
},
{
"lessThan": "6.1.189",
"status": "affected",
"version": "6.1.93",
"versionType": "semver"
},
{
"lessThan": "6.6.158",
"status": "affected",
"version": "6.6.33",
"versionType": "semver"
},
{
"lessThan": "6.9",
"status": "affected",
"version": "6.8.12",
"versionType": "semver"
},
{
"lessThan": "6.10",
"status": "affected",
"version": "6.9.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_mst.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "6.1.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mst: move switchdev call outside rcu\n\nThis is a follow-up of one of sashiko\u0027s pre-existing bug reports.\nbr_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs\nwhile holding rcu_read_lock() which invokes the blocking switchdev\nnotifier chain and may sleep. Nonzero MSTI changes come from netlink\nwith rtnl held. Move the switchdev call before entering the rcu section and\nassert that rtnl is held.\n\nThe call cannot be deferred because netlink needs its error and extack.\nAlso DSA reads the old bridge MST state during the callback and checks it.\nA deferred callback will be late and will see the updated state."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:12.171Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b9661fd2423fc25e91e0517ecc0b6156ad83e3a8"
},
{
"url": "https://git.kernel.org/stable/c/6b431b63219853eef4054e2f1cb073d2ca2059b4"
},
{
"url": "https://git.kernel.org/stable/c/abf734d150c61acfdfee102169d0e5d1c482e285"
},
{
"url": "https://git.kernel.org/stable/c/d5c4ee1fa4e83a12afc051c831936cd8e006cde3"
},
{
"url": "https://git.kernel.org/stable/c/c40ed3e884c8dc0350f26484030438ef24208ff1"
},
{
"url": "https://git.kernel.org/stable/c/18a6fe05fb6e18de29fa90d388bb34044114b3d8"
}
],
"title": "net: bridge: mst: move switchdev call outside rcu",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98301",
"datePublished": "2026-10-06T08:45:58.908Z",
"dateReserved": "2026-09-25T10:25:14.337Z",
"dateUpdated": "2026-10-19T09:17:12.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98366 (GCVE-0-2026-98366)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: validate access flags before swapping the MR's PD
rxe_rereg_user_mr() reassigns mr->ibmr.pd first and only then
validates the IB_MR_REREG_ACCESS argument:
if (flags & IB_MR_REREG_PD) {
rxe_put(old_pd);
rxe_get(pd);
mr->ibmr.pd = ibpd;
}
if (flags & IB_MR_REREG_ACCESS) {
if (access & ~RXE_ACCESS_SUPPORTED_MR)
return ERR_PTR(-EOPNOTSUPP);
mr->access = access;
}
Both flags pass the entry check because RXE_MR_REREG_SUPPORTED is
IB_MR_REREG_PD | IB_MR_REREG_ACCESS, so a caller can reach the access
check with mr->ibmr.pd already reassigned.
mr->ibmr.pd is owned by the core, which adjusts pd->usecnt only on the
success path: ib_uverbs_rereg_mr() jumps to put_new_uobj on a driver error
without undoing the reassignment, so mr->pd == new_pd while the usecnts
still charge the MR to orig_pd. ib_dereg_mr_user() then decrements
new_pd, whose count can reach zero while a memory window still references
it; uverbs_free_pd() frees the PD on that count alone and rxe_mw_cleanup()
writes to freed memory:
BUG: KASAN: slab-use-after-free in __rxe_put+0x31/0xa0
Write of size 4 at addr ffff8881301dd690 by task rxe_poc/591
__rxe_put+0x31/0xa0
rxe_mw_cleanup+0x42/0x200
__rxe_cleanup+0x115/0x370
rxe_dealloc_mw+0x4c/0x80
Allocated by task 591:
ib_uverbs_alloc_pd+0x258/0x540
Freed by task 591:
ib_dealloc_pd_user+0x174/0x210
uverbs_free_pd+0x8d/0xc0
ib_uverbs_dealloc_pd+0x18e/0x1d0
Validate the access flags before mutating any state so the callback either
applies every requested change or none.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "08f12745cb72981aa2cabe214af0c7a42a856f0a",
"status": "affected",
"version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
"versionType": "git"
},
{
"lessThan": "7230cc456d4bb2221c20c5f1d22b38b8576aa16f",
"status": "affected",
"version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
"versionType": "git"
},
{
"lessThan": "fe602c91a52e161ace4afd5bdb8f33270c554c6f",
"status": "affected",
"version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
"versionType": "git"
},
{
"lessThan": "4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8",
"status": "affected",
"version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
"versionType": "git"
},
{
"lessThan": "ae36a5b609ae79f4de966328b78d2584be9719a4",
"status": "affected",
"version": "544c7f62cf32db2bd358f1e8a40a98bf98fa2a5c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: validate access flags before swapping the MR\u0027s PD\n\nrxe_rereg_user_mr() reassigns mr-\u003eibmr.pd first and only then\nvalidates the IB_MR_REREG_ACCESS argument:\n\n\tif (flags \u0026 IB_MR_REREG_PD) {\n\t\trxe_put(old_pd);\n\t\trxe_get(pd);\n\t\tmr-\u003eibmr.pd = ibpd;\n\t}\n\n\tif (flags \u0026 IB_MR_REREG_ACCESS) {\n\t\tif (access \u0026 ~RXE_ACCESS_SUPPORTED_MR)\n\t\t\treturn ERR_PTR(-EOPNOTSUPP);\n\t\tmr-\u003eaccess = access;\n\t}\n\nBoth flags pass the entry check because RXE_MR_REREG_SUPPORTED is\nIB_MR_REREG_PD | IB_MR_REREG_ACCESS, so a caller can reach the access\ncheck with mr-\u003eibmr.pd already reassigned.\n\nmr-\u003eibmr.pd is owned by the core, which adjusts pd-\u003eusecnt only on the\nsuccess path: ib_uverbs_rereg_mr() jumps to put_new_uobj on a driver error\nwithout undoing the reassignment, so mr-\u003epd == new_pd while the usecnts\nstill charge the MR to orig_pd. ib_dereg_mr_user() then decrements\nnew_pd, whose count can reach zero while a memory window still references\nit; uverbs_free_pd() frees the PD on that count alone and rxe_mw_cleanup()\nwrites to freed memory:\n\n BUG: KASAN: slab-use-after-free in __rxe_put+0x31/0xa0\n Write of size 4 at addr ffff8881301dd690 by task rxe_poc/591\n __rxe_put+0x31/0xa0\n rxe_mw_cleanup+0x42/0x200\n __rxe_cleanup+0x115/0x370\n rxe_dealloc_mw+0x4c/0x80\n Allocated by task 591:\n ib_uverbs_alloc_pd+0x258/0x540\n Freed by task 591:\n ib_dealloc_pd_user+0x174/0x210\n uverbs_free_pd+0x8d/0xc0\n ib_uverbs_dealloc_pd+0x18e/0x1d0\n\nValidate the access flags before mutating any state so the callback either\napplies every requested change or none."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bad access_flags/pd_handle reach rxe_rereg_user_mr() only through a local IB_USER_VERBS_CMD_REREG_MR on /dev/infiniband/uverbsN via ib_uverbs_rereg_mr(); no RoCE packet carries rereg arguments, so a remote peer cannot drive it.\nAC:L - Deterministic: flags IB_MR_REREG_PD|IB_MR_REREG_ACCESS with access=IB_ACCESS_RELAXED_ORDERING passes core ib_check_mr_access() but fails RXE_ACCESS_SUPPORTED_MR after mr-\u003eibmr.pd was swapped; the attacker then deregs the MR and deallocs the PD its own MW still uses. No race.\nPR:L - uverbs_devnode() creates /dev/infiniband/uverbsN mode 0666 and there is no capability check from ib_uverbs_rereg_mr() to rxe_rereg_user_mr(); any unprivileged local user owning a PD/MR/MW triggers it. Only the one-time admin rxe link creation (RDMA_NL_ADMIN_PERM) is needed.\nUI:N - The attacker\u0027s own process issues alloc_pd, reg_mr, alloc_mw, the failing rereg_mr, dereg_mr and dealloc_pd; no other user or administrator action is involved.\nS:U - The freed rxe PD and the corrupted refcounts are kernel heap objects within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After uverbs_free_pd() frees the PD on usecnt alone, the surviving MW still holds a dangling pointer to it; reclaiming that slab object with sprayed data turns later accesses through the MW into a use-after-free read of attacker-shaped memory.\nI:H - rxe_mw_cleanup() -\u003e __rxe_put() writes (refcount decrement, KASAN write of size 4) into the freed PD, and the inconsistent mr-\u003epd vs usecnt state can be repeated; a decrement into reallocated slab memory is a usable corruption primitive toward privilege escalation.\nA:H - The use-after-free write in __rxe_put() during rxe_dealloc_mw() corrupts freed slab memory and can oops or panic the kernel, and an unprivileged user can repeat it at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:18:18.297Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/08f12745cb72981aa2cabe214af0c7a42a856f0a"
},
{
"url": "https://git.kernel.org/stable/c/7230cc456d4bb2221c20c5f1d22b38b8576aa16f"
},
{
"url": "https://git.kernel.org/stable/c/fe602c91a52e161ace4afd5bdb8f33270c554c6f"
},
{
"url": "https://git.kernel.org/stable/c/4dd7a53f1c5b44693c26dac4b9b5bd5bb9d604c8"
},
{
"url": "https://git.kernel.org/stable/c/ae36a5b609ae79f4de966328b78d2584be9719a4"
}
],
"title": "RDMA/rxe: validate access flags before swapping the MR\u0027s PD",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98366",
"datePublished": "2026-10-06T08:46:51.638Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-19T09:18:18.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97559 (GCVE-0-2026-97559)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fail DACL rewrite when the new DACL exceeds 64K
replace_sids_and_copy_aces() and set_chmod_dacl() accumulate the size of
the DACL they build in a u16. That accumulator can wrap.
validate_dacl() caps num_aces at (dacl_size - sizeof(struct smb_acl)) /
20, i.e. 3276 for a maximally sized DACL, while each rewritten ACE can
grow to sizeof(struct smb_ace) (76 bytes) once its SID is replaced with
one carrying SID_MAX_SUB_AUTHORITIES sub-authorities. The worst case is
therefore sizeof(struct smb_acl) + 3276 * 76 = 248984 bytes, far beyond
what a u16 can hold. A wraparound is reached with 863 ACEs.
After the wraparound, ndacl_ptr->size becomes meaningless and the offset
will point anywhere in the ACE array. As a result, we will see
corruption of the DACL, which then gets sent to the server. This is not
an out-of-bounds write as the allocation now covers the worst-case
expansion, so writes will always go into the buffer.
Adjust the code to use a u32 internally and return -EOVERFLOW in the
overflow case. The operation must be refused, because a DACL can only
hold 2^16-1 bytes on the wire and larger DACLs cannot be represented.
set_chmod_dacl() carries the same pattern and is fixed the same way. It
only wraps once the source DACL comes within roughly 380 bytes of the
64K ceiling, but the failure mode is identical.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifsacl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "284877c6189fda1ac3d81771dd8482660a0c7dc1",
"status": "affected",
"version": "f5065508897a922327f32223082325d10b069ebc",
"versionType": "git"
},
{
"lessThan": "d433376abc47e10870ae732f89c7c1a60b199a0c",
"status": "affected",
"version": "f5065508897a922327f32223082325d10b069ebc",
"versionType": "git"
},
{
"lessThan": "2ef532a01f44687f5b95001e88247cf05bff9892",
"status": "affected",
"version": "f5065508897a922327f32223082325d10b069ebc",
"versionType": "git"
},
{
"lessThan": "ee13d687d06a6fbb2008625dd560c654231b28e0",
"status": "affected",
"version": "f5065508897a922327f32223082325d10b069ebc",
"versionType": "git"
},
{
"lessThan": "d05045177a855386bca5e1909e08d06290e6e3b3",
"status": "affected",
"version": "f5065508897a922327f32223082325d10b069ebc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifsacl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fail DACL rewrite when the new DACL exceeds 64K\n\nreplace_sids_and_copy_aces() and set_chmod_dacl() accumulate the size of\nthe DACL they build in a u16. That accumulator can wrap.\n\nvalidate_dacl() caps num_aces at (dacl_size - sizeof(struct smb_acl)) /\n20, i.e. 3276 for a maximally sized DACL, while each rewritten ACE can\ngrow to sizeof(struct smb_ace) (76 bytes) once its SID is replaced with\none carrying SID_MAX_SUB_AUTHORITIES sub-authorities. The worst case is\ntherefore sizeof(struct smb_acl) + 3276 * 76 = 248984 bytes, far beyond\nwhat a u16 can hold. A wraparound is reached with 863 ACEs.\n\nAfter the wraparound, ndacl_ptr-\u003esize becomes meaningless and the offset\nwill point anywhere in the ACE array. As a result, we will see\ncorruption of the DACL, which then gets sent to the server. This is not\nan out-of-bounds write as the allocation now covers the worst-case\nexpansion, so writes will always go into the buffer.\n\nAdjust the code to use a u32 internally and return -EOVERFLOW in the\noverflow case. The operation must be refused, because a DACL can only\nhold 2^16-1 bytes on the wire and larger DACLs cannot be represented.\n\nset_chmod_dacl() carries the same pattern and is fixed the same way. It\nonly wraps once the source DACL comes within roughly 380 bytes of the\n64K ceiling, but the failure mode is identical."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:17.080Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/284877c6189fda1ac3d81771dd8482660a0c7dc1"
},
{
"url": "https://git.kernel.org/stable/c/d433376abc47e10870ae732f89c7c1a60b199a0c"
},
{
"url": "https://git.kernel.org/stable/c/2ef532a01f44687f5b95001e88247cf05bff9892"
},
{
"url": "https://git.kernel.org/stable/c/ee13d687d06a6fbb2008625dd560c654231b28e0"
},
{
"url": "https://git.kernel.org/stable/c/d05045177a855386bca5e1909e08d06290e6e3b3"
}
],
"title": "smb: client: fail DACL rewrite when the new DACL exceeds 64K",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97559",
"datePublished": "2026-09-25T10:21:48.866Z",
"dateReserved": "2026-09-24T16:01:01.155Z",
"dateUpdated": "2026-10-21T12:53:17.080Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98191 (GCVE-0-2026-98191)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: wlcore: release runtime PM ref on regdomain config failure
wlcore_regdomain_config() gets a runtime PM reference before sending
the regulatory-domain command. When
wlcore_cmd_regdomain_config_locked() fails, the function queues recovery
and returns without dropping that reference.
Release the reference after handling the command result so both success
and failure paths balance the preceding
pm_runtime_resume_and_get(). The recovery worker takes a separate
runtime PM reference and cannot release the reference held here.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 Version: fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 Version: fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 Version: fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 Version: fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 Version: fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 Version: fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 Version: fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ti/wlcore/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "85ec6c451fe681ac3135dfa43a519f1404ae63ad",
"status": "affected",
"version": "fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8",
"versionType": "git"
},
{
"lessThan": "3fbaae01bb7847d8b0124a8bbdb3af865e388d53",
"status": "affected",
"version": "fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8",
"versionType": "git"
},
{
"lessThan": "c02352e2b5a241c8da89b5f5f1a0ae4d403120ed",
"status": "affected",
"version": "fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8",
"versionType": "git"
},
{
"lessThan": "05b5e297bbf46f92c80da4c2ebe67828ca0d0247",
"status": "affected",
"version": "fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8",
"versionType": "git"
},
{
"lessThan": "18eb148105f1af9163f5e9758f0a7bc6ab042423",
"status": "affected",
"version": "fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8",
"versionType": "git"
},
{
"lessThan": "7f1f25b2db14683ab75d0d22c00d6a75ba988b83",
"status": "affected",
"version": "fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8",
"versionType": "git"
},
{
"lessThan": "a6bb6ad517a0d4db33a0cac9448e3ae9f4008fb4",
"status": "affected",
"version": "fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8",
"versionType": "git"
},
{
"lessThan": "8a1f3cf89ddcc700e25afe42cfad333059adcc94",
"status": "affected",
"version": "fa2648a34e73fb7a17fd0a82e0335a9451d8f5c8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ti/wlcore/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: release runtime PM ref on regdomain config failure\n\nwlcore_regdomain_config() gets a runtime PM reference before sending\nthe regulatory-domain command. When\nwlcore_cmd_regdomain_config_locked() fails, the function queues recovery\nand returns without dropping that reference.\n\nRelease the reference after handling the command result so both success\nand failure paths balance the preceding\npm_runtime_resume_and_get(). The recovery worker takes a separate\nruntime PM reference and cannot release the reference held here."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:22.651Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/85ec6c451fe681ac3135dfa43a519f1404ae63ad"
},
{
"url": "https://git.kernel.org/stable/c/3fbaae01bb7847d8b0124a8bbdb3af865e388d53"
},
{
"url": "https://git.kernel.org/stable/c/c02352e2b5a241c8da89b5f5f1a0ae4d403120ed"
},
{
"url": "https://git.kernel.org/stable/c/05b5e297bbf46f92c80da4c2ebe67828ca0d0247"
},
{
"url": "https://git.kernel.org/stable/c/18eb148105f1af9163f5e9758f0a7bc6ab042423"
},
{
"url": "https://git.kernel.org/stable/c/7f1f25b2db14683ab75d0d22c00d6a75ba988b83"
},
{
"url": "https://git.kernel.org/stable/c/a6bb6ad517a0d4db33a0cac9448e3ae9f4008fb4"
},
{
"url": "https://git.kernel.org/stable/c/8a1f3cf89ddcc700e25afe42cfad333059adcc94"
}
],
"title": "wifi: wlcore: release runtime PM ref on regdomain config failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98191",
"datePublished": "2026-10-06T08:44:32.240Z",
"dateReserved": "2026-09-25T10:25:14.323Z",
"dateUpdated": "2026-10-19T09:15:22.651Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90013 (GCVE-0-2026-90013)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing: Take trace_array reference when opening options file
The options files do not take the trace_array reference for the options
they represent. This could cause a use-after-free kernel crash if one of
these files is opened by one task and another task removes the instance
that the option is for. Because it doesn't take a reference upon opening,
it will not stop the removal which will free the options descriptor that
is being used.
As the options are somewhat dynamic in their creation at boot up, each
file represents a flag in the trace_array. The trace_array has an array of
indexes to represent each of these flags that is stored in the
trace_flags_index array. The address of the index array element is used to
pass to the inode->i_private pointer. Then that element is read which
holds the index (which represents the flag) and then the index is used to
calculate the trace_array descriptor from its trace_flags_index array.
One issue is that the index element can not be referenced until the
trace_array's reference is taken. To handle this, create a new helper
function called: trace_array_options_get() that will iterate all the
existing trace_arrays in the ftrace_trace_arrays list (under the
trace_types_lock), and compare the passed in address of the index element
with the entire array of the trace_array's trace_flags_index array.
If it matches, then up the corresponding trace_array's reference and
return.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8cc9c5a8c559d655c32d2190486e89574c14ff52",
"status": "affected",
"version": "577b785f55168d5acb3d123ba41bfe8d7981e044",
"versionType": "git"
},
{
"lessThan": "97ceaffbd672449ad7ead5ae8788dce16374b0c1",
"status": "affected",
"version": "577b785f55168d5acb3d123ba41bfe8d7981e044",
"versionType": "git"
},
{
"lessThan": "d0f37d77b9b4b241e0b30ef2562f6353cbda3bec",
"status": "affected",
"version": "577b785f55168d5acb3d123ba41bfe8d7981e044",
"versionType": "git"
},
{
"lessThan": "64a41f4a9a968f54f3792399aa4d2a9fdb23b0a5",
"status": "affected",
"version": "577b785f55168d5acb3d123ba41bfe8d7981e044",
"versionType": "git"
},
{
"lessThan": "f2951ebd15c36a1ea4820a7f0cbb0b5f1c028b73",
"status": "affected",
"version": "577b785f55168d5acb3d123ba41bfe8d7981e044",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Take trace_array reference when opening options file\n\nThe options files do not take the trace_array reference for the options\nthey represent. This could cause a use-after-free kernel crash if one of\nthese files is opened by one task and another task removes the instance\nthat the option is for. Because it doesn\u0027t take a reference upon opening,\nit will not stop the removal which will free the options descriptor that\nis being used.\n\nAs the options are somewhat dynamic in their creation at boot up, each\nfile represents a flag in the trace_array. The trace_array has an array of\nindexes to represent each of these flags that is stored in the\ntrace_flags_index array. The address of the index array element is used to\npass to the inode-\u003ei_private pointer. Then that element is read which\nholds the index (which represents the flag) and then the index is used to\ncalculate the trace_array descriptor from its trace_flags_index array.\n\nOne issue is that the index element can not be referenced until the\ntrace_array\u0027s reference is taken. To handle this, create a new helper\nfunction called: trace_array_options_get() that will iterate all the\nexisting trace_arrays in the ftrace_trace_arrays list (under the\ntrace_types_lock), and compare the passed in address of the index element\nwith the entire array of the trace_array\u0027s trace_flags_index array.\nIf it matches, then up the corresponding trace_array\u0027s reference and\nreturn."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached only via local tracefs: open() of an instance options file (tracing_open_generic -\u003e trace_options_core_read/write) then rmdir of that instance (__remove_instance). No network, adjacent-radio, or physical-device path reaches get_tr_index() or the freed trace_array.\nAC:L - The attacker fully controls both sides: open an instance options file (no trace_array ref), rmdir the instance so __remove_instance kfree()s the trace_array, then read/write the still-open fd. That sequence is deterministic and retryable; CONFIG_TRACING with instances is standard, not a rare config.\nPR:L - tracing_open_generic() and instance mkdir/rmdir enforce only LOCKDOWN_TRACEFS and DAC (options 0640, dirs 0750) with no capable() gate. Android/Perfetto, ChromeOS, and gid=/uid= tracing mounts routinely delegate this to unprivileged tracing accounts, matching CVE-2026-74606 and CVE-2026-89747.\nUI:N - The attacker mkdir()s their own tracing instance, opens options, rmdir()s the instance, and reads or writes the fd themselves. No victim mount, click, or cooperating process is required.\nS:U - The use-after-free corrupts a kernel trace_array in the tracing subsystem on the same host. It can yield local privilege escalation but does not cross a VM, IOMMU, or other security authority.\nC:H - After rmdir, get_tr_index() reads the freed trace_flags_index byte and reconstructs a trace_array, then trace_options_core_read() loads tr-\u003etrace_flags. Reclaiming that slab lets the attacker control the object and obtain an arbitrary kernel read, which kernel CNA guidance scores High for UAF.\nI:H - trace_options_core_write() calls set_tracer_flag() on the freed/reused trace_array, including tr-\u003ecurrent_trace-\u003eflag_changed and writes to tr-\u003etrace_flags and related tracing state. Heap spraying that object yields an arbitrary kernel write and control-flow hijack primitive.\nA:H - Dereferencing the kfree()d trace_array in get_tr_index()/trace_options_core_read() oopses or panics the kernel, which the fix describes as a use-after-free kernel crash. The attacker can retrigger that crash at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:24.882Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8cc9c5a8c559d655c32d2190486e89574c14ff52"
},
{
"url": "https://git.kernel.org/stable/c/97ceaffbd672449ad7ead5ae8788dce16374b0c1"
},
{
"url": "https://git.kernel.org/stable/c/d0f37d77b9b4b241e0b30ef2562f6353cbda3bec"
},
{
"url": "https://git.kernel.org/stable/c/64a41f4a9a968f54f3792399aa4d2a9fdb23b0a5"
},
{
"url": "https://git.kernel.org/stable/c/f2951ebd15c36a1ea4820a7f0cbb0b5f1c028b73"
}
],
"title": "tracing: Take trace_array reference when opening options file",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90013",
"datePublished": "2026-09-16T10:33:20.136Z",
"dateReserved": "2026-09-11T19:38:34.781Z",
"dateUpdated": "2026-10-21T12:49:24.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98270 (GCVE-0-2026-98270)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: check ras and obj before dereference
nbio_v7_9_handle_ras_controller_intr_no_bifring() dereferences ras and obj
without checking either for NULL. Both amdgpu_ras_get_context() and
amdgpu_ras_find_obj() can return NULL, e.g. during the window between
adev->nbio.ras being set (early in amdgpu_ras_init(), by design, to
enable the fatal-error interrupt as soon as possible) and the PCIE_BIF
ras object actually being created in RAS late_init. Any interrupt in that
window crashes in hard-IRQ context.
This is analogous to commit d190b459b2a4 ("drm/amdgpu: the warning
dereferencing obj for nbio_v7_4"), which fixed the same issue in the
nbio_v7_4 handler.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
(cherry picked from commit c7071767a50a32ed727cf800ac84372429e3b4b3)
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7c7f07a40037514f8e890aa00f8d7b196d680cf",
"status": "affected",
"version": "7692e1ee2446fd1940b5caa6e09779504a58881a",
"versionType": "git"
},
{
"lessThan": "fc5f845a291fc8175e6857cd6ad042818da192e8",
"status": "affected",
"version": "7692e1ee2446fd1940b5caa6e09779504a58881a",
"versionType": "git"
},
{
"lessThan": "37583946d8751f8e285c467d770ac0b609b82a23",
"status": "affected",
"version": "7692e1ee2446fd1940b5caa6e09779504a58881a",
"versionType": "git"
},
{
"lessThan": "315c22712715491f0dfafdaf2c2b437540e68702",
"status": "affected",
"version": "7692e1ee2446fd1940b5caa6e09779504a58881a",
"versionType": "git"
},
{
"lessThan": "723d4dc628d764b19cf9efca14b82cca5ff020c9",
"status": "affected",
"version": "7692e1ee2446fd1940b5caa6e09779504a58881a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/nbio_v7_9.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: check ras and obj before dereference\n\nnbio_v7_9_handle_ras_controller_intr_no_bifring() dereferences ras and obj\nwithout checking either for NULL. Both amdgpu_ras_get_context() and\namdgpu_ras_find_obj() can return NULL, e.g. during the window between\nadev-\u003enbio.ras being set (early in amdgpu_ras_init(), by design, to\nenable the fatal-error interrupt as soon as possible) and the PCIE_BIF\nras object actually being created in RAS late_init. Any interrupt in that\nwindow crashes in hard-IRQ context.\n\nThis is analogous to commit d190b459b2a4 (\"drm/amdgpu: the warning\ndereferencing obj for nbio_v7_4\"), which fixed the same issue in the\nnbio_v7_4 handler.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\n(cherry picked from commit c7071767a50a32ed727cf800ac84372429e3b4b3)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:41.028Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7c7f07a40037514f8e890aa00f8d7b196d680cf"
},
{
"url": "https://git.kernel.org/stable/c/fc5f845a291fc8175e6857cd6ad042818da192e8"
},
{
"url": "https://git.kernel.org/stable/c/37583946d8751f8e285c467d770ac0b609b82a23"
},
{
"url": "https://git.kernel.org/stable/c/315c22712715491f0dfafdaf2c2b437540e68702"
},
{
"url": "https://git.kernel.org/stable/c/723d4dc628d764b19cf9efca14b82cca5ff020c9"
}
],
"title": "drm/amdgpu: check ras and obj before dereference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98270",
"datePublished": "2026-10-06T08:45:32.506Z",
"dateReserved": "2026-09-25T10:25:14.333Z",
"dateUpdated": "2026-10-19T09:16:41.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80935 (GCVE-0-2026-80935)
Vulnerability from cvelistv5
Published
2026-09-11 19:42
Modified
2026-10-21 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block
copy from the address reported by the MCU response (event->addr, a
device-controlled __le32) and clamps only the copy length, never the
destination offset into dev->mt76.eeprom.data. A malicious or
malfunctioning device can report an arbitrary address and drive an
out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past
eeprom.data.
Reject a response whose address would place the copy outside eeprom.data
before deriving the destination pointer. Devices that echo the requested
in-bounds offset are unaffected.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4892be1ef0bbe6db6b13bf46cb79b6706bb5b214",
"status": "affected",
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
"versionType": "git"
},
{
"lessThan": "388f471ca4758f644394b681ce97677a4d0e772c",
"status": "affected",
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
"versionType": "git"
},
{
"lessThan": "9e5abb5e2ade0b6fd0e47209711115d47a255176",
"status": "affected",
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
"versionType": "git"
},
{
"lessThan": "6be59da2063d5b3522bfde8aae0487ec095eb384",
"status": "affected",
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
"versionType": "git"
},
{
"lessThan": "13b3c29a782033ce4a230be9e5618032813dbcd4",
"status": "affected",
"version": "98686cd21624c75a043e96812beadddf4f6f48e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7996/mcu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy\n\nmt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block\ncopy from the address reported by the MCU response (event-\u003eaddr, a\ndevice-controlled __le32) and clamps only the copy length, never the\ndestination offset into dev-\u003emt76.eeprom.data. A malicious or\nmalfunctioning device can report an arbitrary address and drive an\nout-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past\neeprom.data.\n\nReject a response whose address would place the copy outside eeprom.data\nbefore deriving the destination pointer. Devices that echo the requested\nin-bounds offset are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The OOB copy is driven by a MediaTek Wi-Fi 7 MCU EEPROM query response (mt7996/mt7992/mt7990), not a routed IP service; the highest reasonable exposure is an adjacent attacker who can drive malicious firmware or device behavior on the local radio.\nAC:L - A malicious MCU response can set event-\u003evalid and an arbitrary event-\u003eaddr; the host then memcpy\u0027s up to MT7996_EXT_EEPROM_BLOCK_SIZE (1024) device-controlled bytes to eeprom.data+addr with no race or other condition beyond attacker control.\nPR:N - MCU EEPROM responses are consumed in mt7996_eeprom_load() during driver bring-up with no OS credential, capability, or Wi-Fi authentication check; an adjacent attacker needs no local account.\nUI:N - The copy runs automatically in mt7996_eeprom_load() during pci_probe/register after firmware load; no victim action such as mounting a filesystem or opening a file is required.\nS:U - The write corrupts host kernel heap around the mt76 EEPROM buffer and is standard kernel memory corruption, not a VM escape, IOMMU bypass, or other crossed security authority.\nC:H - Attacker-controlled destination offset and payload are kernel memory corruption that can overwrite adjacent objects and pointers and be leveraged for information disclosure, so confidentiality impact is high.\nI:H - Up to 1024 bytes of device-controlled data are written at a device-chosen offset past the 7680-byte eeprom.data allocation, an out-of-bounds write primitive that can yield arbitrary kernel writes or control-flow hijacking.\nA:H - An unbounded kernel heap write during EEPROM init can oops, panic, or hang the host, a high availability impact on Wi-Fi 7 APs, routers, and workstations."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:47:15.492Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4892be1ef0bbe6db6b13bf46cb79b6706bb5b214"
},
{
"url": "https://git.kernel.org/stable/c/388f471ca4758f644394b681ce97677a4d0e772c"
},
{
"url": "https://git.kernel.org/stable/c/9e5abb5e2ade0b6fd0e47209711115d47a255176"
},
{
"url": "https://git.kernel.org/stable/c/6be59da2063d5b3522bfde8aae0487ec095eb384"
},
{
"url": "https://git.kernel.org/stable/c/13b3c29a782033ce4a230be9e5618032813dbcd4"
}
],
"title": "wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80935",
"datePublished": "2026-09-11T19:42:09.286Z",
"dateReserved": "2026-08-26T14:34:25.802Z",
"dateUpdated": "2026-10-21T12:47:15.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98309 (GCVE-0-2026-98309)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Use managed KMS polling to fix UAF on unbind
vc4_kms_load() calls drm_kms_helper_poll_init() but the driver provides
no matching drm_kms_helper_poll_fini(). The output poll work stays
scheduled after unbind and runs on the freed drm_device:
# modprobe vc4; rmmod vc4; sleep 10
BUG: KASAN: slab-use-after-free in delayed_work_timer_fn
BUG: KASAN: slab-use-after-free in drm_client_dev_hotplug [drm]
Workqueue: events output_poll_execute [drm_kms_helper]
Allocated by task 171: __devm_drm_dev_alloc
Freed by task 262 (rmmod): drm_dev_put / component_del
Use drmm_kms_helper_poll_init() so polling is finalized with the device,
as other drivers do.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b6beee927e7f4e3142032ff91b2d0417cdddc0f6",
"status": "affected",
"version": "c8b75bca92cbf064b9fa125fc74a85994452e935",
"versionType": "git"
},
{
"lessThan": "cf0c4432bda37b02e7d430ff5017228ceb7caf0c",
"status": "affected",
"version": "c8b75bca92cbf064b9fa125fc74a85994452e935",
"versionType": "git"
},
{
"lessThan": "ee507691c18f9fee5d4751e295ab9a7ff31d59ae",
"status": "affected",
"version": "c8b75bca92cbf064b9fa125fc74a85994452e935",
"versionType": "git"
},
{
"lessThan": "7f9780df677370a19b4ec9764f13b1b82073e0d9",
"status": "affected",
"version": "c8b75bca92cbf064b9fa125fc74a85994452e935",
"versionType": "git"
},
{
"lessThan": "073a30d75f309812ed61af134f24ffef4107b13a",
"status": "affected",
"version": "c8b75bca92cbf064b9fa125fc74a85994452e935",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Use managed KMS polling to fix UAF on unbind\n\nvc4_kms_load() calls drm_kms_helper_poll_init() but the driver provides\nno matching drm_kms_helper_poll_fini(). The output poll work stays\nscheduled after unbind and runs on the freed drm_device:\n\n # modprobe vc4; rmmod vc4; sleep 10\n BUG: KASAN: slab-use-after-free in delayed_work_timer_fn\n BUG: KASAN: slab-use-after-free in drm_client_dev_hotplug [drm]\n Workqueue: events output_poll_execute [drm_kms_helper]\n Allocated by task 171: __devm_drm_dev_alloc\n Freed by task 262 (rmmod): drm_dev_put / component_del\n\nUse drmm_kms_helper_poll_init() so polling is finalized with the device,\nas other drivers do."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:19.914Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b6beee927e7f4e3142032ff91b2d0417cdddc0f6"
},
{
"url": "https://git.kernel.org/stable/c/cf0c4432bda37b02e7d430ff5017228ceb7caf0c"
},
{
"url": "https://git.kernel.org/stable/c/ee507691c18f9fee5d4751e295ab9a7ff31d59ae"
},
{
"url": "https://git.kernel.org/stable/c/7f9780df677370a19b4ec9764f13b1b82073e0d9"
},
{
"url": "https://git.kernel.org/stable/c/073a30d75f309812ed61af134f24ffef4107b13a"
}
],
"title": "drm/vc4: Use managed KMS polling to fix UAF on unbind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98309",
"datePublished": "2026-10-06T08:46:05.957Z",
"dateReserved": "2026-09-25T10:25:14.338Z",
"dateUpdated": "2026-10-19T09:17:19.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90029 (GCVE-0-2026-90029)
Vulnerability from cvelistv5
Published
2026-09-16 10:33
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: storage: realtek_cr: fix use-after-free on disconnect
realtek_cr_destructor() calls timer_delete() before the chip containing
the timer is freed. The timer callback may still be running and can
rearm itself, resulting in a use-after-free.
Use timer_shutdown_sync() to wait for the callback and prevent further
rearming. Do this unconditionally because ss_en may be changed after
the timer is armed.
Move timer_setup() into init_realtek_cr() so the timer is initialized
before any failure path can invoke the destructor.
Found by static analysis.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/storage/realtek_cr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c1e7e35100efffba7c9e1dfa76519d6cd323ba3d",
"status": "affected",
"version": "e931830bb877e2aad9a1be83506f9bdb26c91e4e",
"versionType": "git"
},
{
"lessThan": "524d4257f741cd95eb85e2817c9c890928fcfef7",
"status": "affected",
"version": "e931830bb877e2aad9a1be83506f9bdb26c91e4e",
"versionType": "git"
},
{
"lessThan": "7c4e2f964c65dea4ea22386799d5fb10ef1e3e54",
"status": "affected",
"version": "e931830bb877e2aad9a1be83506f9bdb26c91e4e",
"versionType": "git"
},
{
"lessThan": "cae9dbba6adae21a04a3bd045e07b489847ff2c6",
"status": "affected",
"version": "e931830bb877e2aad9a1be83506f9bdb26c91e4e",
"versionType": "git"
},
{
"lessThan": "4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc",
"status": "affected",
"version": "e931830bb877e2aad9a1be83506f9bdb26c91e4e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/storage/realtek_cr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.51",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: storage: realtek_cr: fix use-after-free on disconnect\n\nrealtek_cr_destructor() calls timer_delete() before the chip containing\nthe timer is freed. The timer callback may still be running and can\nrearm itself, resulting in a use-after-free.\n\nUse timer_shutdown_sync() to wait for the callback and prevent further\nrearming. Do this unconditionally because ss_en may be changed after\nthe timer is armed.\n\nMove timer_setup() into init_realtek_cr() so the timer is initialized\nbefore any failure path can invoke the destructor.\n\nFound by static analysis."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:29.895Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c1e7e35100efffba7c9e1dfa76519d6cd323ba3d"
},
{
"url": "https://git.kernel.org/stable/c/524d4257f741cd95eb85e2817c9c890928fcfef7"
},
{
"url": "https://git.kernel.org/stable/c/7c4e2f964c65dea4ea22386799d5fb10ef1e3e54"
},
{
"url": "https://git.kernel.org/stable/c/cae9dbba6adae21a04a3bd045e07b489847ff2c6"
},
{
"url": "https://git.kernel.org/stable/c/4ffee1aebb0c0ffcda9faffd17834ea9b00d42cc"
}
],
"title": "usb: storage: realtek_cr: fix use-after-free on disconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-90029",
"datePublished": "2026-09-16T10:33:31.117Z",
"dateReserved": "2026-09-11T19:38:34.782Z",
"dateUpdated": "2026-10-21T12:49:29.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98205 (GCVE-0-2026-98205)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: evdev - zero absinfo before partial copy in EVIOCSABS
The EVIOCSABS handler copies at most the user supplied ioctl size into
an uninitialized on-stack struct input_absinfo:
if (copy_from_user(&abs, p, min_t(size_t,
size, sizeof(struct input_absinfo))))
The size comes from _IOC_SIZE() of the ioctl command and is therefore
fully controlled by userspace. A short size leaves the trailing part of
the structure holding whatever was on the kernel stack, and the whole
structure is then stored into the device:
dev->absinfo[t] = abs;
EVIOCGABS hands that back to userspace, disclosing the stale stack
bytes. Only the resolution field is currently cleared, which covers the
legacy struct layout but not an arbitrarily short size.
Zero the structure before the copy so any part not supplied by the
caller reads back as zero. The existing resolution fixup is kept, since
it also handles a size that partially overlaps that field.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 448cd1664a573e69f54bfd32f3bb7220212b6cf5 Version: 448cd1664a573e69f54bfd32f3bb7220212b6cf5 Version: 448cd1664a573e69f54bfd32f3bb7220212b6cf5 Version: 448cd1664a573e69f54bfd32f3bb7220212b6cf5 Version: 448cd1664a573e69f54bfd32f3bb7220212b6cf5 Version: 448cd1664a573e69f54bfd32f3bb7220212b6cf5 Version: 448cd1664a573e69f54bfd32f3bb7220212b6cf5 Version: 448cd1664a573e69f54bfd32f3bb7220212b6cf5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/evdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c0aebb57b73c7d06ad21731099afe119b113c403",
"status": "affected",
"version": "448cd1664a573e69f54bfd32f3bb7220212b6cf5",
"versionType": "git"
},
{
"lessThan": "89b6ffa4bc10c436fa9aecc73be105124cd58a35",
"status": "affected",
"version": "448cd1664a573e69f54bfd32f3bb7220212b6cf5",
"versionType": "git"
},
{
"lessThan": "e834e134a32b6a5c600fa539bb49146f617743ab",
"status": "affected",
"version": "448cd1664a573e69f54bfd32f3bb7220212b6cf5",
"versionType": "git"
},
{
"lessThan": "af5f7130cbf39e6e12336d0b7a5f6e76e4e1526b",
"status": "affected",
"version": "448cd1664a573e69f54bfd32f3bb7220212b6cf5",
"versionType": "git"
},
{
"lessThan": "30b853a3d71f16bd0aa66b604bc37dd1254a19b3",
"status": "affected",
"version": "448cd1664a573e69f54bfd32f3bb7220212b6cf5",
"versionType": "git"
},
{
"lessThan": "71e5619db11dd6429101bd967230d0321ec5ea26",
"status": "affected",
"version": "448cd1664a573e69f54bfd32f3bb7220212b6cf5",
"versionType": "git"
},
{
"lessThan": "3dfe48d5307a1ba22c58231d04257737015569ca",
"status": "affected",
"version": "448cd1664a573e69f54bfd32f3bb7220212b6cf5",
"versionType": "git"
},
{
"lessThan": "8b852965b8eaf910c314dc346967ed82c8d4f235",
"status": "affected",
"version": "448cd1664a573e69f54bfd32f3bb7220212b6cf5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/evdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: evdev - zero absinfo before partial copy in EVIOCSABS\n\nThe EVIOCSABS handler copies at most the user supplied ioctl size into\nan uninitialized on-stack struct input_absinfo:\n\n\tif (copy_from_user(\u0026abs, p, min_t(size_t,\n\t\t\tsize, sizeof(struct input_absinfo))))\n\nThe size comes from _IOC_SIZE() of the ioctl command and is therefore\nfully controlled by userspace. A short size leaves the trailing part of\nthe structure holding whatever was on the kernel stack, and the whole\nstructure is then stored into the device:\n\n\tdev-\u003eabsinfo[t] = abs;\n\nEVIOCGABS hands that back to userspace, disclosing the stale stack\nbytes. Only the resolution field is currently cleared, which covers the\nlegacy struct layout but not an arbitrarily short size.\n\nZero the structure before the copy so any part not supplied by the\ncaller reads back as zero. The existing resolution fixup is kept, since\nit also handles a size that partially overlaps that field."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:36.157Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c0aebb57b73c7d06ad21731099afe119b113c403"
},
{
"url": "https://git.kernel.org/stable/c/89b6ffa4bc10c436fa9aecc73be105124cd58a35"
},
{
"url": "https://git.kernel.org/stable/c/e834e134a32b6a5c600fa539bb49146f617743ab"
},
{
"url": "https://git.kernel.org/stable/c/af5f7130cbf39e6e12336d0b7a5f6e76e4e1526b"
},
{
"url": "https://git.kernel.org/stable/c/30b853a3d71f16bd0aa66b604bc37dd1254a19b3"
},
{
"url": "https://git.kernel.org/stable/c/71e5619db11dd6429101bd967230d0321ec5ea26"
},
{
"url": "https://git.kernel.org/stable/c/3dfe48d5307a1ba22c58231d04257737015569ca"
},
{
"url": "https://git.kernel.org/stable/c/8b852965b8eaf910c314dc346967ed82c8d4f235"
}
],
"title": "Input: evdev - zero absinfo before partial copy in EVIOCSABS",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98205",
"datePublished": "2026-10-06T08:44:42.563Z",
"dateReserved": "2026-09-25T10:25:14.325Z",
"dateUpdated": "2026-10-19T09:15:36.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93199 (GCVE-0-2026-93199)
Vulnerability from cvelistv5
Published
2026-09-17 16:12
Modified
2026-10-21 12:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: Do not treat master device as a duplicate target
i3c_master_search_i3c_dev_duplicate() searches the bus for another I3C
device with the same PID as the reference device. The search can match
master->this, causing the controller itself to be returned as a
duplicate.
Since the controller is not a target device, it cannot be a duplicate of
one. Exclude master->this from matching so that the function only
returns real duplicate target devices.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7b25b755d59077dd9484ba1360b8fe6396e5ccfb",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "533faf3d2e67ded0a62b7ba753c0fe993d1dfc26",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "d0cc00957292e353ad46039034cd8f82fc4f8057",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "150e71808d3715a0deefbb189c780d03fdbdc735",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
},
{
"lessThan": "4dc1b3eeba7991905a5b5b8129ebea51be7d87b7",
"status": "affected",
"version": "3a379bbcea0af6280e1ca0d1edfcf4e68cde6ee0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.52",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.6",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: Do not treat master device as a duplicate target\n\ni3c_master_search_i3c_dev_duplicate() searches the bus for another I3C\ndevice with the same PID as the reference device. The search can match\nmaster-\u003ethis, causing the controller itself to be returned as a\nduplicate.\n\nSince the controller is not a target device, it cannot be a duplicate of\none. Exclude master-\u003ethis from matching so that the function only\nreturns real duplicate target devices."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:52:17.361Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7b25b755d59077dd9484ba1360b8fe6396e5ccfb"
},
{
"url": "https://git.kernel.org/stable/c/533faf3d2e67ded0a62b7ba753c0fe993d1dfc26"
},
{
"url": "https://git.kernel.org/stable/c/d0cc00957292e353ad46039034cd8f82fc4f8057"
},
{
"url": "https://git.kernel.org/stable/c/150e71808d3715a0deefbb189c780d03fdbdc735"
},
{
"url": "https://git.kernel.org/stable/c/4dc1b3eeba7991905a5b5b8129ebea51be7d87b7"
}
],
"title": "i3c: master: Do not treat master device as a duplicate target",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-93199",
"datePublished": "2026-09-17T16:12:21.081Z",
"dateReserved": "2026-09-17T16:02:15.092Z",
"dateUpdated": "2026-10-21T12:52:17.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97534 (GCVE-0-2026-97534)
Vulnerability from cvelistv5
Published
2026-09-25 10:21
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: accurately adjust free_sections during free_segment_range
In free_segment_range(), MAIN_SECS(sbi) is temporarily reduced by `secs`
to restrict block allocation to the safe remaining main area while valid
blocks in the truncated range are evacuated by GC.
However, FREE_I(sbi)->free_sections tracks the total number of free
sections across the whole filesystem. If any sections within the
truncated range were already free upon entering free_segment_range(),
failing to deduct them from free_sections causes the filesystem to
overestimate available free sections in the active, reduced main area.
This leads to inconsistent free section accounting during GC data
migration and can trigger unexpected allocation failures or assertion
errors when space is tight.
Fix this by calculating the number of already-free sections in the
truncated range, deducting them from free_sections upon entering
free_segment_range(), and restoring them on exit.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/gc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "64a7ed42e9766886dd7300597d90366dfb7a1e53",
"status": "affected",
"version": "b4b10061ef98c583bcf82a4200703fbaa98c18dc",
"versionType": "git"
},
{
"lessThan": "faeb0a20bdd113311519b598dcc075af3b6fb366",
"status": "affected",
"version": "b4b10061ef98c583bcf82a4200703fbaa98c18dc",
"versionType": "git"
},
{
"lessThan": "ca31116fad0954c61a0d38163cc51c48e4981b75",
"status": "affected",
"version": "b4b10061ef98c583bcf82a4200703fbaa98c18dc",
"versionType": "git"
},
{
"lessThan": "8a123a10770d2132d046748f20f02baa8d5539a1",
"status": "affected",
"version": "b4b10061ef98c583bcf82a4200703fbaa98c18dc",
"versionType": "git"
},
{
"lessThan": "8c963d1738fdca400082ff5f9d99e083de4f4e70",
"status": "affected",
"version": "b4b10061ef98c583bcf82a4200703fbaa98c18dc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/gc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: accurately adjust free_sections during free_segment_range\n\nIn free_segment_range(), MAIN_SECS(sbi) is temporarily reduced by `secs`\nto restrict block allocation to the safe remaining main area while valid\nblocks in the truncated range are evacuated by GC.\n\nHowever, FREE_I(sbi)-\u003efree_sections tracks the total number of free\nsections across the whole filesystem. If any sections within the\ntruncated range were already free upon entering free_segment_range(),\nfailing to deduct them from free_sections causes the filesystem to\noverestimate available free sections in the active, reduced main area.\nThis leads to inconsistent free section accounting during GC data\nmigration and can trigger unexpected allocation failures or assertion\nerrors when space is tight.\n\nFix this by calculating the number of already-free sections in the\ntruncated range, deducting them from free_sections upon entering\nfree_segment_range(), and restoring them on exit."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:09.412Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/64a7ed42e9766886dd7300597d90366dfb7a1e53"
},
{
"url": "https://git.kernel.org/stable/c/faeb0a20bdd113311519b598dcc075af3b6fb366"
},
{
"url": "https://git.kernel.org/stable/c/ca31116fad0954c61a0d38163cc51c48e4981b75"
},
{
"url": "https://git.kernel.org/stable/c/8a123a10770d2132d046748f20f02baa8d5539a1"
},
{
"url": "https://git.kernel.org/stable/c/8c963d1738fdca400082ff5f9d99e083de4f4e70"
}
],
"title": "f2fs: accurately adjust free_sections during free_segment_range",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97534",
"datePublished": "2026-09-25T10:21:33.792Z",
"dateReserved": "2026-09-24T16:01:01.153Z",
"dateUpdated": "2026-10-21T12:53:09.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89840 (GCVE-0-2026-89840)
Vulnerability from cvelistv5
Published
2026-09-16 10:31
Modified
2026-10-21 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: validate MOVE_RANGE destination size
F2FS_IOC_MOVE_RANGE checks the source range, but not the destination end
before updating i_size. A source hole can expose this: __clone_blkaddrs()
skips NULL_ADDR entries and returns success, so the caller can still extend
the destination inode with unchecked pos_out + len.
Reject destination overflow and use inode_newsize_ok() before extending
the destination inode.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "54c587f3f95ce2d6932a16566db83f73cc4313e1",
"status": "affected",
"version": "4dd6f977fc778e5a0da604e5f8cb2f36d163d27b",
"versionType": "git"
},
{
"lessThan": "bca61ee5192ea47003722486ae9588a2a4bb47b6",
"status": "affected",
"version": "4dd6f977fc778e5a0da604e5f8cb2f36d163d27b",
"versionType": "git"
},
{
"lessThan": "db13064669526494cd78ba3a4394063b740e940c",
"status": "affected",
"version": "4dd6f977fc778e5a0da604e5f8cb2f36d163d27b",
"versionType": "git"
},
{
"lessThan": "dcae1eeda53149f219dd6af93b3083b7271c1c63",
"status": "affected",
"version": "4dd6f977fc778e5a0da604e5f8cb2f36d163d27b",
"versionType": "git"
},
{
"lessThan": "e533889fc26aea0cd83c90327063f272061dd820",
"status": "affected",
"version": "4dd6f977fc778e5a0da604e5f8cb2f36d163d27b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.5",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate MOVE_RANGE destination size\n\nF2FS_IOC_MOVE_RANGE checks the source range, but not the destination end\nbefore updating i_size. A source hole can expose this: __clone_blkaddrs()\nskips NULL_ADDR entries and returns success, so the caller can still extend\nthe destination inode with unchecked pos_out + len.\n\nReject destination overflow and use inode_newsize_ok() before extending\nthe destination inode."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - F2FS_IOC_MOVE_RANGE is a local ioctl (f2fs_ioctl \u2192 f2fs_ioc_move_range \u2192 f2fs_move_file_range) on f2fs file descriptors. f2fs has no remap_file_range, so nfsd/ksmbd copy_file_range cannot reach this path.\nAC:L - The attacker fully controls pos_out and len and can ftruncate a sparse source so __clone_blkaddrs skips NULL_ADDR holes and returns success, making the unchecked destination i_size update deterministic with no race or uncontrollable layout.\nPR:L - f2fs_ioc_move_range has no capable() check; it only needs FMODE_READ|FMODE_WRITE on the source and FMODE_WRITE on the destination. Any unprivileged user with files on mounted f2fs (Android /data, embedded userdata) can trigger it.\nUI:N - The attacker opens their own files on an already-mounted f2fs volume and issues F2FS_IOC_MOVE_RANGE; no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - Impact is corruption of f2fs inode size metadata and subsequent filesystem/kernel state on the local host, a standard kernel compromise within the same security authority with no VM escape or IOMMU bypass.\nC:N - The bug writes an oversized or overflowed i_size; reads of the resulting sparse file return zeros or EOF (negative i_size makes pos \u003e= i_size), and lookups beyond max_file_blocks fail with -E2BIG, so there is no kernel-memory or cross-file disclosure primitive.\nI:H - Missing overflow and inode_newsize_ok() checks let the attacker set destination i_size past s_maxbytes or wrap size_t into a negative loff_t, persisting corrupt on-disk inode size and poisoning later paths (fallocate COLLAPSE nrpages, __exchange_data_block ALLOC_NODE) that trust i_size for block-tree updates.\nA:H - A poisoned i_size enables unbounded node-tree walks and block-exchange loops (SEEK_DATA/HOLE, fallocate COLLAPSE via DIV_ROUND_UP(i_size)), can hang the kernel or exhaust node space, and leaves durable filesystem corruption on shared f2fs userdata."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:49:02.980Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/54c587f3f95ce2d6932a16566db83f73cc4313e1"
},
{
"url": "https://git.kernel.org/stable/c/bca61ee5192ea47003722486ae9588a2a4bb47b6"
},
{
"url": "https://git.kernel.org/stable/c/db13064669526494cd78ba3a4394063b740e940c"
},
{
"url": "https://git.kernel.org/stable/c/dcae1eeda53149f219dd6af93b3083b7271c1c63"
},
{
"url": "https://git.kernel.org/stable/c/e533889fc26aea0cd83c90327063f272061dd820"
}
],
"title": "f2fs: validate MOVE_RANGE destination size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-89840",
"datePublished": "2026-09-16T10:31:14.646Z",
"dateReserved": "2026-09-11T19:38:34.769Z",
"dateUpdated": "2026-10-21T12:49:02.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98311 (GCVE-0-2026-98311)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: virt_wifi: don't transfer operstate before register
virt_wifi_newlink() calls netif_stacked_transfer_operstate() before
register_netdevice(). If the lower device is dormant, that queues the
new netdev on lweventlist while it is still uninitialized. If
registration fails after that, for example because of an invalid name
such as "bad/name", free_netdev() immediately frees the object. A
later linkwatch_fire_event() then use-after-frees the list entry.
Move the transfer to after netdev_upper_dev_link(), as macvlan and
ipvlan already do.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c Version: c7cdba31ed8b87526db978976392802d3f93110c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/virtual/virt_wifi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee9ea1afd6990def51d52b3a0aecd5cfcc951da0",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "9ce26201f6dedf3fa02b97da8c67ee6f6c5f7225",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "f9526054c2b2cace5916b7225603d008834ec011",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "e8304e25c6dabb8accf38b807969438d0ce84fd7",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "ca49763c42c1089d654bf11b037980a9ede3772c",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "293c56a66510bb7de073a1aba388e38abddff1fb",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "b808a9af5fd21f9c68b0d024eda7535b5dce6a4e",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "e5c8d7acd31b27057ea42cd405d0b3ece097bc89",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/virtual/virt_wifi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: don\u0027t transfer operstate before register\n\nvirt_wifi_newlink() calls netif_stacked_transfer_operstate() before\nregister_netdevice(). If the lower device is dormant, that queues the\nnew netdev on lweventlist while it is still uninitialized. If\nregistration fails after that, for example because of an invalid name\nsuch as \"bad/name\", free_netdev() immediately frees the object. A\nlater linkwatch_fire_event() then use-after-frees the list entry.\n\nMove the transfer to after netdev_upper_dev_link(), as macvlan and\nipvlan already do."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The trigger is a local RTM_NEWLINK netlink request of kind \"virt_wifi\" handled by virt_wifi_newlink(). No remote peer or WiFi frame supplies any input. The bug is a fault in the order of steps when creating the device.\nAC:L - The attacker sets up the state and triggers it alone. They bring the lower device (e.g. lo) up and set it dormant via IFLA_OPERSTATE, then send RTM_NEWLINK with an invalid name like \"bad/name\". netif_dormant_on() queues the device on lweventlist, register_netdevice() fails and free_netdev() frees the device while it is still queued. No race is involved.\nPR:L - rtnetlink_rcv_msg() and __rtnl_newlink() check CAP_NET_ADMIN only against the user namespace that owns the netns, so an unprivileged user can get it with unshare -Urn. __rtnl_newlink() also auto-loads rtnl-link-virt_wifi through request_module().\nUI:N - No victim action is needed; the attacker\u0027s own netlink messages create the dormant lower device, the failing virt_wifi link and the queued linkwatch event.\nS:U - Memory in the same kernel is corrupted and stays within the kernel\u0027s own security authority. No VM, IOMMU or sandbox boundary is crossed.\nC:H - The freed net_device is still linked into the global lweventlist. linkwatch_do_dev() later reads it (flags, state, qdisc pointers), so the attacker can reclaim the freed object with controlled data and use the resulting reads to leak memory.\nI:H - A list_add or list_del on lweventlist writes through link_watch_list into freed memory. With a reclaimed object, linkwatch_do_dev() calls dev_activate() or dev_deactivate() on qdisc pointers the attacker controls, which allows corrupting memory and hijacking control flow.\nA:H - Even without careful exploitation, the queued linkwatch_event work or any later linkwatch_fire_event() corrupts list memory or touches freed memory. That causes a kernel oops or panic, and the attacker can repeat it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:17:21.813Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee9ea1afd6990def51d52b3a0aecd5cfcc951da0"
},
{
"url": "https://git.kernel.org/stable/c/9ce26201f6dedf3fa02b97da8c67ee6f6c5f7225"
},
{
"url": "https://git.kernel.org/stable/c/f9526054c2b2cace5916b7225603d008834ec011"
},
{
"url": "https://git.kernel.org/stable/c/e8304e25c6dabb8accf38b807969438d0ce84fd7"
},
{
"url": "https://git.kernel.org/stable/c/ca49763c42c1089d654bf11b037980a9ede3772c"
},
{
"url": "https://git.kernel.org/stable/c/293c56a66510bb7de073a1aba388e38abddff1fb"
},
{
"url": "https://git.kernel.org/stable/c/b808a9af5fd21f9c68b0d024eda7535b5dce6a4e"
},
{
"url": "https://git.kernel.org/stable/c/e5c8d7acd31b27057ea42cd405d0b3ece097bc89"
}
],
"title": "wifi: virt_wifi: don\u0027t transfer operstate before register",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98311",
"datePublished": "2026-10-06T08:46:07.562Z",
"dateReserved": "2026-09-25T10:25:14.339Z",
"dateUpdated": "2026-10-19T09:17:21.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98232 (GCVE-0-2026-98232)
Vulnerability from cvelistv5
Published
2026-10-06 08:45
Modified
2026-10-19 09:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()
scsi_cdl_enable() uses length fields returned by MODE SENSE to locate
the ATA feature mode page in a 64-byte stack buffer. A target can report
a total length shorter than its mode header and block descriptors. The
unsigned subtraction used for the MODE SELECT length can wrap, and the
separately computed buf_data can point beyond buf.
During automatic scan, enable is false, so the read-modify-write of
buf_data[4] can clear the low two bits of a target-selected
out-of-bounds stack byte. scsi_mode_select() can then copy up to 64
bytes from outside the buffer into the outgoing MODE SELECT payload,
disclosing stack contents to the target.
This is reachable while scanning a USB storage device that identifies as
an ATA device and advertises CDL support. No filesystem mount or
userspace access to the block device is required.
On upstream commit cee9395acd80 ("Linux 7.3-rc1"), a build-specific,
one-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator
sampling executed a fixed proof command inside the guest and created a
UID-0-owned marker during automatic enumeration, with KASLR and NX
enabled.
The issue was independently found during security research at Drivesec
S.r.l.
Cap the available length to the buffer size. Validate and consume the
mode header and block descriptor lengths before using the page, and
require the five bytes needed to access the CDL field.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "39491a1ae93054fea10b4030180e5c797b2c0343",
"status": "affected",
"version": "1b22cfb14142aba7742d307c4f8d7006f919308c",
"versionType": "git"
},
{
"lessThan": "60b0b8ce803e3c2b2a9e5485ab3f88599fb4c7a4",
"status": "affected",
"version": "1b22cfb14142aba7742d307c4f8d7006f919308c",
"versionType": "git"
},
{
"lessThan": "6233d0b3ef4623df0d6934dc8b93b161e9854f6b",
"status": "affected",
"version": "1b22cfb14142aba7742d307c4f8d7006f919308c",
"versionType": "git"
},
{
"lessThan": "99a6e4a9176da456904b67dcbae6e77d122782b7",
"status": "affected",
"version": "1b22cfb14142aba7742d307c4f8d7006f919308c",
"versionType": "git"
},
{
"lessThan": "3d676e458fe0c566f5a62753dc696b6a862fc412",
"status": "affected",
"version": "1b22cfb14142aba7742d307c4f8d7006f919308c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()\n\nscsi_cdl_enable() uses length fields returned by MODE SENSE to locate\nthe ATA feature mode page in a 64-byte stack buffer. A target can report\na total length shorter than its mode header and block descriptors. The\nunsigned subtraction used for the MODE SELECT length can wrap, and the\nseparately computed buf_data can point beyond buf.\n\nDuring automatic scan, enable is false, so the read-modify-write of\nbuf_data[4] can clear the low two bits of a target-selected\nout-of-bounds stack byte. scsi_mode_select() can then copy up to 64\nbytes from outside the buffer into the outgoing MODE SELECT payload,\ndisclosing stack contents to the target.\n\nThis is reachable while scanning a USB storage device that identifies as\nan ATA device and advertises CDL support. No filesystem mount or\nuserspace access to the block device is required.\n\nOn upstream commit cee9395acd80 (\"Linux 7.3-rc1\"), a build-specific,\none-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator\nsampling executed a fixed proof command inside the guest and created a\nUID-0-owned marker during automatic enumeration, with KASLR and NX\nenabled.\n\nThe issue was independently found during security research at Drivesec\nS.r.l.\n\nCap the available length to the buffer size. Validate and consume the\nmode header and block descriptor lengths before using the page, and\nrequire the five bytes needed to access the CDL field."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:16:04.072Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/39491a1ae93054fea10b4030180e5c797b2c0343"
},
{
"url": "https://git.kernel.org/stable/c/60b0b8ce803e3c2b2a9e5485ab3f88599fb4c7a4"
},
{
"url": "https://git.kernel.org/stable/c/6233d0b3ef4623df0d6934dc8b93b161e9854f6b"
},
{
"url": "https://git.kernel.org/stable/c/99a6e4a9176da456904b67dcbae6e77d122782b7"
},
{
"url": "https://git.kernel.org/stable/c/3d676e458fe0c566f5a62753dc696b6a862fc412"
}
],
"title": "scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98232",
"datePublished": "2026-10-06T08:45:05.848Z",
"dateReserved": "2026-09-25T10:25:14.328Z",
"dateUpdated": "2026-10-19T09:16:04.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97597 (GCVE-0-2026-97597)
Vulnerability from cvelistv5
Published
2026-09-25 10:22
Modified
2026-10-21 12:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: flowlabel: cap duplicate leases per socket
ipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every
successful GET. The recheck path for a compatible existing flowlabel
links another lease without applying any lease admission check. Repeated
GET requests for one shareable label can therefore grow a socket's lease
list without bound.
Reject a new unprivileged lease once the socket already holds
FL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse
of a globally interned label, including the fl_intern() collision path,
is covered as well. New-label admission remains under the existing
mem_check() policy.
Use capable(CAP_NET_ADMIN) rather than ns_capable(), matching
mem_check(). An unprivileged user must not bypass the cap by creating a
user namespace and a netns where they have CAP_NET_ADMIN, which would
still consume host memory.
Check the capability only when the socket reaches the limit, so
successful unprivileged GET requests below the cap do not generate a
capability audit. Do the admission check before updating linger and
expires so a rejected GET does not refresh the shared label, matching
the existing socket-list allocation failure path.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_flowlabel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0159f716d8adbe85951cdf008d0afe27d874eaa6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6d917992c22b6029fc2dc1bd464b7f6709357161",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2f1a6dd5c80ceb902f50449efe899f29cd7918e3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "467467bf4209f9f8add0c648bae763f92a0224c3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8d6cd188508513503805c156165de38e4e4a8615",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_flowlabel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.53",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.7",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: flowlabel: cap duplicate leases per socket\n\nipv6_flowlabel_get() allocates an ipv6_fl_socklist entry for every\nsuccessful GET. The recheck path for a compatible existing flowlabel\nlinks another lease without applying any lease admission check. Repeated\nGET requests for one shareable label can therefore grow a socket\u0027s lease\nlist without bound.\n\nReject a new unprivileged lease once the socket already holds\nFL_MAX_PER_SOCK leases. Check this on the shared recheck path so reuse\nof a globally interned label, including the fl_intern() collision path,\nis covered as well. New-label admission remains under the existing\nmem_check() policy.\n\nUse capable(CAP_NET_ADMIN) rather than ns_capable(), matching\nmem_check(). An unprivileged user must not bypass the cap by creating a\nuser namespace and a netns where they have CAP_NET_ADMIN, which would\nstill consume host memory.\n\nCheck the capability only when the socket reaches the limit, so\nsuccessful unprivileged GET requests below the cap do not generate a\ncapability audit. Do the admission check before updating linger and\nexpires so a rejected GET does not refresh the shared label, matching\nthe existing socket-list allocation failure path."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:53:23.601Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0159f716d8adbe85951cdf008d0afe27d874eaa6"
},
{
"url": "https://git.kernel.org/stable/c/6d917992c22b6029fc2dc1bd464b7f6709357161"
},
{
"url": "https://git.kernel.org/stable/c/2f1a6dd5c80ceb902f50449efe899f29cd7918e3"
},
{
"url": "https://git.kernel.org/stable/c/467467bf4209f9f8add0c648bae763f92a0224c3"
},
{
"url": "https://git.kernel.org/stable/c/8d6cd188508513503805c156165de38e4e4a8615"
}
],
"title": "ipv6: flowlabel: cap duplicate leases per socket",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-97597",
"datePublished": "2026-09-25T10:22:12.378Z",
"dateReserved": "2026-09-24T16:01:01.157Z",
"dateUpdated": "2026-10-21T12:53:23.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98209 (GCVE-0-2026-98209)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
Probe failure and removal leave SDHCI child devices registered after the
parent clock and managed resources are released.
Unregister the OF children in reverse order before disabling the parent
clock on both paths. Use of_platform_device_destroy() because manual
child creation does not set the flag required by of_platform_depopulate().
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c Version: bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c Version: bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c Version: bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c Version: bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c Version: bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c Version: bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c Version: bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/sdhci-of-aspeed.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6b22b4d29e4fc1d2de2e4d7174925d68220165fb",
"status": "affected",
"version": "bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c",
"versionType": "git"
},
{
"lessThan": "67e8117df8547433989a6ac1545a68848d0a289f",
"status": "affected",
"version": "bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c",
"versionType": "git"
},
{
"lessThan": "bc5e79a5a5651588f3a93bef7815e4e86f78962c",
"status": "affected",
"version": "bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c",
"versionType": "git"
},
{
"lessThan": "b84d29f2541c8adb768e468388dbaa4bc25ef157",
"status": "affected",
"version": "bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c",
"versionType": "git"
},
{
"lessThan": "7eb896617a6db846b18596c10ca9f8900a73013e",
"status": "affected",
"version": "bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c",
"versionType": "git"
},
{
"lessThan": "15b5ffd8af2dd46856da57467eb6e0f90d8ada51",
"status": "affected",
"version": "bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c",
"versionType": "git"
},
{
"lessThan": "356b4b3b28a8ecd2a6c66d3b9666686315337df1",
"status": "affected",
"version": "bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c",
"versionType": "git"
},
{
"lessThan": "4396d70bb7fec531bcf934fed016b2f3300c670b",
"status": "affected",
"version": "bb7b8ec62dfb9b255027c3a54d01f12fc3bd1d2c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/sdhci-of-aspeed.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: sdhci-of-aspeed: Remove children before releasing SDC resources\n\nProbe failure and removal leave SDHCI child devices registered after the\nparent clock and managed resources are released.\n\nUnregister the OF children in reverse order before disabling the parent\nclock on both paths. Use of_platform_device_destroy() because manual\nchild creation does not set the flag required by of_platform_depopulate().\n\nThis issue was identified during our ongoing static-analysis research\nwhile reviewing kernel code."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T09:15:40.223Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6b22b4d29e4fc1d2de2e4d7174925d68220165fb"
},
{
"url": "https://git.kernel.org/stable/c/67e8117df8547433989a6ac1545a68848d0a289f"
},
{
"url": "https://git.kernel.org/stable/c/bc5e79a5a5651588f3a93bef7815e4e86f78962c"
},
{
"url": "https://git.kernel.org/stable/c/b84d29f2541c8adb768e468388dbaa4bc25ef157"
},
{
"url": "https://git.kernel.org/stable/c/7eb896617a6db846b18596c10ca9f8900a73013e"
},
{
"url": "https://git.kernel.org/stable/c/15b5ffd8af2dd46856da57467eb6e0f90d8ada51"
},
{
"url": "https://git.kernel.org/stable/c/356b4b3b28a8ecd2a6c66d3b9666686315337df1"
},
{
"url": "https://git.kernel.org/stable/c/4396d70bb7fec531bcf934fed016b2f3300c670b"
}
],
"title": "mmc: sdhci-of-aspeed: Remove children before releasing SDC resources",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98209",
"datePublished": "2026-10-06T08:44:45.933Z",
"dateReserved": "2026-09-25T10:25:14.325Z",
"dateUpdated": "2026-10-19T09:15:40.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…